Definition
A captive portal is a network gatekeeping technology. When you first connect to public Wi-Fi, it holds you in place for a moment, so you can't reach other websites, and it forces a login or terms-of-service page to show up first.
What Happens When You Join Cafe Wi-Fi
You've probably been there. You connect to free Wi-Fi at a cafe, hotel, or airport. Suddenly a browser pops open on your phone by itself. It says "Agree to the terms" or "Enter your room number."
You never tapped a search bar or opened a website. So why does a page jump in front of you? A captive portal is the reason. As the name "captive" suggests, it holds your connection on a specific web page for a moment before you head out onto the wider internet.
Think of the ticket gate at a theme park. Staff check your ticket at the entrance and put a wristband on you. Your phone may be linked to the Wi-Fi antenna, but until you get through this gate, no website will open.
A Bit More Precisely: How It Intercepts Your Signal
More precisely, a captive portal works by intercepting your internet requests along the way. When your phone joins Wi-Fi, its operating system checks that the internet really works. To do that, it first sends a small signal to a test server run by the maker, such as Apple or Google.
Network equipment like a router or firewall notices that this device hasn't been verified yet. It grabs the signal that was heading to its real destination and forcibly sends it to a web page of its own (an HTTP redirect). Your phone expected one answer but got a login page instead. So it automatically pops up a window for you.
Once you tap "I agree" or finish signing in, the system adds your device's unique ID (its MAC address) to a pass list. The moment you're approved, the firewall that was holding you back opens, and normal internet access is finally allowed.
Why Make You Go Through This Hassle?
Cafes and airports put you through these steps for management and legal reasons. It keeps anyone from hogging the network or abusing it with unlimited access. It also lets the provider be sure you've seen the terms of use.
Hotels and airlines can use it to give internet access only to guests and passengers who have paid. Department stores and cafes can use it as a marketing tool, to share event news or nudge you to log in.
There is one thing to watch out for, though. Getting through a captive portal does not mean the wireless network is safely encrypted. A captive portal is just an entry check. On public Wi-Fi with no password, typing in personal or payment details can expose you to hackers.
Common misconceptions
I logged in and verified myself on the captive portal, so this Wi-Fi is completely safe from hackers.
A captive portal is only an "entry check" that identifies you and gets you to accept the terms. It is not a technology that encrypts the Wi-Fi signal. On open public Wi-Fi, it's safer to avoid banking and other sensitive information.
Where you meet it
It's the screen on hotel Wi-Fi that asks for your room number and guest name before the internet opens.
It's the window that asks you to tap an "I agree to the free internet terms" button when you connect to Starbucks or airport Wi-Fi.
In one sentence
A captive portal is a web gate that pops up on public Wi-Fi to ask for your agreement to the terms or a quick identity check before you can really use the internet.