Why do event guests struggle to log in to WiFi?
Most event guest networks use an open network name with a captive portal: a web page that asks for an email address, a code or a click on the terms. It works, but it creates friction at the exact moment a crowd arrives.
- The portal does not always appear. Phones detect captive portals in the background, and when the check fails the guest sees a network with no internet and no obvious next step.
- Sessions expire. A guest who walks between halls or leaves for lunch may have to log in again.
- Open networks are unencrypted by default. Without extra measures, traffic between the phone and the access point is not encrypted over the air.
- Staff devices get mixed in. When ticket scanners or tablets share the guest network, a login timeout can stop check-in.
Passpoint and OpenRoaming were designed to remove the login step and encrypt the connection at the same time.
What is Passpoint?
Passpoint is a Wi-Fi Alliance certification program, also known in the industry as Hotspot 2.0. A Passpoint device holds a credential, such as a profile issued by an organisation, and uses it to discover and join matching networks without the user choosing a network name or opening a web page.
According to the Wi-Fi Alliance, Passpoint is included in most enterprise-class access points and is supported by the major phone, tablet and laptop operating systems. In 2019 the Alliance added four features to the program:
- Online sign-up through a common provisioning method on a single network name.
- Venue-specific information that a device can read before it connects.
- Enterprise-level security, with support for WPA2-Enterprise and WPA3-Enterprise.
- Operator-specific policies, including a simpler way to accept terms and conditions.
Before joining, the device asks the access point which identity providers it accepts, using an IEEE 802.11 query protocol called ANQP. If one matches the credential on the device, it connects and authenticates automatically.
What does OpenRoaming add?
Passpoint on its own needs a credential that the network recognises. OpenRoaming, launched by the Wireless Broadband Alliance in 2020, builds a federation around it so that one identity can work across many unrelated venues.
The latest technical description is an informational Internet-Draft published in June 2026. It is not an IETF standard, but it documents how the federation works:
- Two roles. Access network providers run the WiFi; identity providers issue the credentials that devices carry.
- Network selection by identifier. Access points advertise Roaming Consortium Organisation Identifiers, and the device checks them against its credential. Separate base identifiers cover settlement-free and settled service.
- Secured authentication traffic. Authentication runs over RADIUS over TLS (RFC 6614), with mutual certificates from the federation and dynamic peer discovery (RFC 7585).
- Privacy by default. The baseline policy keeps user identities anonymous to the venue, and a permanent identifier can only be shared with the user's permission.
- Client isolation. Access network providers must block direct traffic between user devices on the network.
The draft also notes that users should not rely on the WiFi encryption alone to protect the services they use, which is sound advice for any public network.
Is Passpoint or OpenRoaming practical for a one-day event?
Usually not as the main guest network, at least today. Both frameworks pay off when the same network serves the same people repeatedly, such as a stadium, campus, airport or permanent venue. For a temporary network, the barriers are practical:
- Federation setup. Joining OpenRoaming means certificates, RADIUS over TLS connectivity and policy configuration before the event, and testing before doors open.
- Guests need a credential. Devices without a matching profile will not see any benefit, so a fallback network is still required.
- Equipment support. Access points, controllers and authentication servers all need to support the features, and firmware should be tested together.
Where Passpoint style authentication does make sense at events is for known groups: staff, exhibitors and production crews who can be issued credentials ahead of time. That gives them encrypted, automatic connection without a shared password written on a whiteboard.
How should organisers design event WiFi with these ideas in mind?
You can apply the same principles without a federation. A practical plan for a temporary site looks like this:
- Separate the networks. Keep guest WiFi, staff and operations, and payments on different network names and VLANs. Our EFTPOS payment networks page explains why terminals should never share the guest network.
- Use enterprise or WPA3 security for staff. Individual credentials are easier to revoke than one shared password.
- Keep guest access simple. If a login page is needed, keep it to one step and set long session times so guests are not asked again during the day. Where devices support it, encrypted open networks (Wi-Fi Enhanced Open) protect traffic without a password.
- Turn on client isolation on the guest network so devices cannot reach each other.
- Size for real numbers. Plan around one device per person at public events, 1.5 to 2 devices per staff member, and about 50 active devices per access point.
Our guest WiFi service covers login options, and the event network planner helps estimate access points before you ask for a design.
What should you ask before your next event?
- Does the venue already run Passpoint or OpenRoaming, and can event staff use it?
- Can guest, staff and payment traffic be kept on separate networks?
- How long do guest sessions last before a new login is needed?
- Is client isolation enabled on the guest network?
- Which devices must connect without a person present, such as scanners, kiosks and cameras, and how are they authenticated?
If the answers are unclear, send us the floor plan and expected attendance and we will suggest a network layout with the right login approach for your crowd.
Questions people ask
What is the difference between Passpoint and OpenRoaming?
Passpoint is a Wi-Fi Alliance certification that lets a device join a network automatically with a stored credential and enterprise-grade security. OpenRoaming is a federation run by the Wireless Broadband Alliance that uses Passpoint so one identity is accepted across many participating venues.
Does Passpoint remove the captive portal?
For devices that hold a matching credential, yes. They discover the network, authenticate and connect without a login page. Devices without a credential still need another way in, so most venues keep a standard guest network alongside it.
Is OpenRoaming an official internet standard?
Not in the IETF sense. The June 2026 technical description is an informational Internet-Draft in the independent submission stream, which documents the federation but is not endorsed as an IETF standard.
Is open event WiFi encrypted?
A traditional open network does not encrypt traffic over the air. Wi-Fi Enhanced Open adds encryption to open networks for supported devices, and Passpoint networks use WPA2- or WPA3-Enterprise security.
Should payment terminals use Passpoint at events?
The more important rule is separation. Payment terminals should run on their own network, not the guest network, with a backup internet link. The login method matters less than keeping payment traffic isolated and stable.
Sources
- IETF Internet-Draft: WBA OpenRoaming (draft-tomas-openroaming-08, June 2026)
- Wi-Fi Alliance: New features added to Wi-Fi CERTIFIED Passpoint
- Wi-Fi Alliance: What's new in Wi-Fi security?
Event dates, prices and product details can change. Check the organiser or manufacturer before you plan around them. Planning figures are starting points; every network is confirmed against the actual site.