Passpoint, explained
Passpoint is a Wi-Fi Alliance certification standard that lets mobile devices find, verify, and join Wi-Fi networks automatically and securely. No captive portal, no password, and no action from the user. A phone with a Passpoint profile treats Wi-Fi the way it treats cellular: it finds the network, verifies it cryptographically, connects with enterprise-grade encryption, and moves traffic without the user ever looking up a Service Set Identifier (“SSID”) or asking for a password. Or plainly, no need for, “hey, what’s the Wi-Fi?”.
What is Passpoint?
Passpoint is built on the Hotspot 2.0 technical specification and the IEEE 802.11u standard, and it is the mechanism behind carrier Wi-Fi offload. When a carrier provisions Passpoint credentials to its subscribers, typically automatically and tied to the SIM, those subscribers connect to any Passpoint-enabled access point the carrier trusts, and the carrier's coverage extends into the buildings its towers struggle to reach. This is also the standard the Helium Network runs on: every connection across Helium's community-owned Wi-Fi footprint, tens of thousands of locations carrying live commercial carrier traffic today, happens over Passpoint.
For the people who own Wi-Fi infrastructure, Passpoint changes what an access point can be. A venue's Wi-Fi stops being an amenity for the guests who bother to log in and starts serving carriers’ subscribers automatically.
However, Passpoint itself only opens the door. It says nothing about whether the Wi-Fi is any good, nor gives carriers a way to monitor or enforce quality on the sessions it creates. It can also be a cumbersome setup in such a way that many Wi-Fi system managers rarely integrate it without help. Carriers aren’t going to pay for coverage they cannot verify or measure, so Helium is giving carriers the eyes inside they need for an optimal subscriber experience. Running Passpoint on the Helium Network closes the gap with verified coverage, carrier-grade quality controls and monitoring through WOX on HeliumOS. The Helium Wi-Fi Toolkit gives retailers turnkey Passpoint setup, and infrastructure owners get paid for the traffic they carry. Read on to learn more about Passpoint and why it’s supercharged with intelligence when it runs on Helium’s solutions.
How does Passpoint work?
Passpoint automates the three things that normally make Wi-Fi a manual experience: finding the right network, proving who you are, and securing the connection. Here is the sequence, in plain terms.
Access point advertises
802.11u / ANQP
Device carries a profile
SIM-anchored credentials
Match & mutual authentication
EAP-SIM/AKA/TLS
Encrypted connection
WPA2/WPA3-Enterprise
- The access point advertises what it is. A Passpoint-enabled access point broadcasts information defined by IEEE 802.11u, including which operators and roaming consortiums it serves. Devices read this before connecting, using the Access Network Query Protocol (ANQP), so a phone knows whether a network will accept its credentials without having to join it first.
- The device carries a profile. A Passpoint profile lives on the phone and contains the subscriber's credentials and the rules for which networks to trust. Carriers typically provision profiles automatically, anchored to the SIM, so subscribers never see this step. Profiles can also be installed through an app or other over the top methods.
- The device matches and authenticates. When the phone sees an access point that matches its profile, it authenticates using EAP methods (such as EAP-SIM, EAP-AKA, or EAP-TLS) against the operator's authentication servers. The handshake is mutual: the network verifies the subscriber, and the device verifies the network, which eliminates the spoofed-hotspot attacks that plague open Wi-Fi.
- Traffic is encrypted end to end over the air. Passpoint connections use WPA2-Enterprise or WPA3-Enterprise encryption, the same class of security used on corporate networks. There is no shared password and no unencrypted open network.
The user experiences none of this. The phone connects the way it hands off between cell towers: silently, in the background, based on signal and policy.
Behind the access point, the venue or network operator connects to participating carriers through secure authentication infrastructure (RADIUS, typically carried over RadSec). This is the operational layer most Wi-Fi owners do not have on their own, and it is the part a Passpoint enablement platform exists to provide.
Passpoint vs. captive portals and open Wi-Fi
The difference is not incremental. Captive portals and open networks fail at the exact things Passpoint was designed to fix.
| Feature | Open Wi-Fi / captive portal | Passpoint |
|---|---|---|
| Connection | Manual: find the SSID, open a browser, accept terms or enter details | Automatic: the device connects on its own |
| Security | Often unencrypted; portal pages prove nothing about the network | Mutual authentication plus WPA2/WPA3-Enterprise encryption |
| Spoofing risk | High: anyone can broadcast a copycat SSID | Low: the device cryptographically verifies the network |
| Who connects | The small share of visitors who bother | Every subscriber of every participating carrier in range |
| Carrier value | None: traffic is invisible to carriers | Full offload: measurable, secure capacity carriers can rely on |
| Venue value | An amenity with support tickets | Infrastructure that serves everyone, with no login friction |
Captive portals also break quietly on modern devices. Phones increasingly randomize MAC addresses and suppress portal pages, so portal-based Wi-Fi reaches fewer users every year. Passpoint is the standards-based replacement, and it is already supported natively on iOS and Android.
Passpoint, Hotspot 2.0, and OpenRoaming: what the names mean
The terms get used interchangeably, but they refer to different layers of the same stack.
Hotspot 2.0 is the underlying technical specification, developed by the Wi-Fi Alliance and built on IEEE 802.11u. It defines how access points advertise themselves and how devices discover and select networks before associating.
Passpoint is the Wi-Fi Alliance certification program for Hotspot 2.0. When hardware or a network is "Passpoint certified," it has been validated against the spec. In practice, Passpoint is the name the industry uses for the whole capability, and successive releases added online sign-up, operator policy, and richer venue and QoS information.
OpenRoaming is a federation built on top of Passpoint, operated by the Wireless Broadband Alliance. It standardizes the roaming agreements between identity providers and network operators so that a single profile can work across many unaffiliated networks.
If you remember one distinction: Hotspot 2.0 is the spec, Passpoint is the certification and the common name, and OpenRoaming is one roaming federation that uses them. A note on Helium terminology: Helium Hotspots are the access points deployed on the Helium Network, and the capitalized word is unrelated to the Hotspot 2.0 specification name.
Why do carriers use Passpoint?
Most mobile usage happens indoors, and indoor coverage is the hardest and most expensive problem in wireless. Macro towers were not built to penetrate modern construction, and carrier capital budgets are shrinking while demand for capacity keeps rising. Passpoint lets carriers treat qualified Wi-Fi as an extension of their own network, which changes the economics of coverage.
Seamless, authenticated offload. For years, carriers couldn’t or wouldn’t handoff subscribers to Wi-Fi they did not operate. Anyone could join, nothing was encrypted, and a spoofed access point could look identical to a real one. Passpoint changed that. Subscribers authenticate with carrier credentials, the device verifies the network before it connects, and the session is encrypted. Passpoint gets the subscriber connected securely, but that’s where the standard's job ends.
Coverage where towers cannot go. Venues, campuses, transit systems, and dense indoor environments are exactly where cellular struggles and Wi-Fi is already installed. Passpoint turns that installed base into usable carrier capacity.
Pay for use, not for buildout. Instead of spending capital to densify, a carrier can pay per gigabyte for traffic carried on Passpoint-enabled networks it did not have to build. Coverage becomes an operating expense that scales with actual demand.
Quality of service is the gating question. Offload only works if the Wi-Fi is good, and carriers rightly refuse to hand subscribers to networks that will degrade their experience. This is why Helium pairs Passpoint with real-time quality telemetry and session control, steering subscribers onto Wi-Fi when it outperforms cellular and keeping them off it when it does not. For how this works on the Helium Network, see WOX: the Wi-Fi Offload Experience.
What Passpoint doesn't do on its own
Passpoint deserves the credit it gets. It solved connection and authentication, the two problems that kept Wi-Fi out of the carrier toolkit for a decade. But a standard is not a service, and three gaps stand between a Passpoint-enabled access point and coverage a carrier will actually rely on.
- No quality guarantee. Passpoint gets a subscriber onto Wi-Fi. It says nothing about whether the Wi-Fi is any good. A seamless connection to a congested network is a seamless bad experience.
- No monitoring or control. Once a device connects, the standard gives carriers no live visibility into session quality and no mechanism to enforce their standards or steer traffic back to cellular when Wi-Fi underperforms.
- Heavy integration. Operating Passpoint means certificates, profile provisioning, authentication infrastructure, roaming agreements, and ongoing standards management. It is cumbersome enough that most Wi-Fi owners never attempt it alone.
None of this is a knock on the standard. Passpoint defines the connection. Someone still has to make it trustworthy, measurable, and worth a carrier's traffic. That is the layer the Helium Network adds.
What does Passpoint mean for venues and businesses?
If you own a building where people use their phones, you own something carriers need. Passpoint is the standard that makes that ownership monetizable.
Today, most venues give connectivity away. Guests struggle onto a captive portal, or burn through cellular data on a weak indoor signal, and the venue's investment in Wi-Fi earns nothing beyond goodwill. With Passpoint enabled, the same infrastructure serves every participating carrier's subscribers automatically, and the traffic it carries becomes measurable, billable service delivered to carriers.
What changes in practice:
- Every visitor connects, not just the ones who log in. Subscribers of participating carriers join silently the moment they walk in. Connection rates stop depending on portal patience.
- Guest experience improves without support overhead. No passwords to post at the front desk, no portal pages that fail on half the devices, fewer dead zones forcing guests onto bad cellular.
- The Wi-Fi you already bought starts working harder. Passpoint is a capability layer, not a rip-and-replace. Much existing enterprise Wi-Fi hardware can be Passpoint-enabled with the right configuration and the right authentication infrastructure behind it.
- Infrastructure owners get paid. The economic logic is simple: carriers pay for coverage they do not build everywhere else in their network. Indoor Wi-Fi coverage should work the same way. The venue owns the infrastructure; the carrier pays for the traffic it carries.
The missing piece for most venues has never been the radio hardware. It is everything behind it: the carrier relationships, the authentication and security infrastructure, the quality telemetry carriers demand, and the settlement that gets the venue paid. That is the problem the Helium Network was built to solve.
Passpoint on the Helium Network
The Helium Network is a wireless network built by the businesses and venues that need it most. Passpoint is baked into the operating model and HeliumOS is the software platform that closes the service gaps. Connection comes through Passpoint, then verification, quality control, and getting the infrastructure owner paid are powered by Helium.
HeliumOS, the platform behind the Network, provides the full stack that a Passpoint deployment needs:
- Wi-Fi Toolkit: Turnkey Passpoint for retailers and large venues. Standing up Passpoint yourself means certificates, profile provisioning, secure carrier authentication (RADIUS over RadSec), and roaming agreements. Wi-Fi Toolkit packages all of it, so existing venue and enterprise Wi-Fi becomes Passpoint-enabled without a systems integration project. Convert existing Wi-Fi infrastructure with Helium Plus or deploy fresh hardware with Helium Hotspots that ship Passpoint-ready out of the box.
- WOX: Carrier controls, monitoring, and standards management. WOX, the Wi-Fi Offload Experience within HeliumOS, measures every connection's quality in real time against carrier-defined thresholds, keeps subscribers on Wi-Fi only when it genuinely outperforms cellular, and gives carriers the visibility and enforcement that the Passpoint standard never specified. This is what turns a seamless connection into a trustworthy one.
- Verified coverage. Carriers are not taking anyone's word for where coverage exists or how it performs. Every connection is authenticated, every session is measured, and the traffic the Network reports is traffic that actually moved.
- Measurement and settlement. Traffic on the Network is metered, and the people who deployed the coverage are paid for the carrier traffic their infrastructure carries.
The result is Passpoint at network scale: carriers get secure, quality-assured offload capacity without capital spend, and the businesses and communities that deploy coverage own the infrastructure and share in the value it creates.
Learn more: Introducing HeliumOS and WOX: the Wi-Fi Offload Experience.
Passpoint FAQ
Almost certainly yes. Passpoint has been supported natively on iOS and Android for years, across essentially all modern devices. No app is required; the device needs only a Passpoint profile, which carriers typically provision automatically.
Yes, and this is its core advantage over conventional public Wi-Fi. Passpoint uses mutual EAP authentication, so the device verifies the network just as the network verifies the device, and all traffic is encrypted over the air with WPA2-Enterprise or WPA3-Enterprise. There are no shared passwords and no open, unencrypted sessions.
Functionally, yes. Hotspot 2.0 is the technical specification; Passpoint is the Wi-Fi Alliance certification program for it and the name the industry uses day to day.
Often not. Many enterprise-grade access points already support Passpoint and need configuration plus the authentication infrastructure behind it. Helium Plus brings existing Wi-Fi deployments onto the Helium Network.
Wi-Fi offload is when a mobile carrier moves subscriber traffic from its cellular network onto Wi-Fi. Passpoint is the standard that makes offload seamless and secure enough for carriers to rely on: automatic connection, verified identity, and encrypted sessions, with no user action.
Yes. On the Helium Network, businesses and individuals who deploy Passpoint-enabled coverage are paid for the carrier traffic their infrastructure carries. The carrier gets coverage it did not have to build; the infrastructure owner gets revenue from an asset that previously earned nothing.
The Wi-Fi is already there
The wireless industry is spending billions chasing coverage from towers and satellites. Most of the coverage it actually needs is indoors, and most of it has already been built, by the people who own the buildings. Passpoint is how that installed base goes to work.
If you operate Wi-Fi at a venue, a campus, or a portfolio of properties, the Helium Network can make it carrier-grade, and make it pay. Get in touch and we’ll help you with the appropriate solution!
