WiFi security type checker and upgrade advisor
Select your operating system and environment to verify your security settings and evaluate upgrade options.
Check WiFi security type on Windows 11 / 10
- Click the WiFi / Network icon on the right side of your taskbar.
- Click the arrow next to your connected WiFi network name.
- Select Properties under the network status.
- Scroll down to the Properties section at the bottom of the window.
- Look for Security type (e.g., WPA2-Personal, WPA3-Personal, or WPA2-Enterprise).
WPA2-Personal (WPA2-PSK / AES)
Encryption: AES-CCMP (128-bit) keyed from a shared passphrase
- Vulnerable to offline dictionary and brute-force attacks
- KRACK (key reinstallation) on unpatched clients
- Shared passphrase: one compromised employee exposes entire network
- Cannot revoke access per-device without changing password for everyone
Acceptable for home use. Business venues should upgrade to WPA3 or 802.1X Enterprise.
Upgrading venue or business WiFi to 802.1X enterprise security?
Purple integrates with your existing Cisco Meraki, HPE Aruba, Ruckus, Juniper Mist, Ubiquiti UniFi, Cambium, Extreme and Fortinet access points to deliver passwordless 802.1X security, RADIUS authentication, and ISO 27001 compliant guest WiFi.
Request an enterprise WiFi security audit
Guest WiFi MITM risk and Passpoint savings calculator
Score your exposure to man-in-the-middle attacks, evil twin APs and captive portal eavesdropping, then see what moving to Passpoint changes.
Corporate venues with executive guests, consultants and confidential financial work that need mutual authentication and no over-the-air eavesdropping.
Every AP broadcasting the guest SSID is a name an evil twin can clone: 583 logins per AP per month.
Corporate VPN, SaaS and email sign-ins, and mobile payment apps.
Assumptions and method
- ·Score = base exposure of the security model (open 88, open guest VLAN 78, shared PSK 65, OWE 45, Passpoint 10) × sector weight (1.35) × (0.8 + 0.4 × sensitive share), capped at 100. Passpoint uses a fixed 0.9 multiplier. Bands: 0-20 low, 21-50 moderate, 51-75 high, 76+ critical.
- ·Sessions at link-layer risk = monthly logins × 12 × sensitive share × exposure factor (open 1.0, shared PSK 0.6, OWE 0.3, Passpoint 0). This counts exposure, not breaches: TLS in the app still protects most of that traffic.
- ·Support saving = logins × 12 ÷ 1,000 × (tickets per 1,000 logins today minus 1.5 on Passpoint) × 0.45 h × £35. Ticket rates (open 8.5, open VLAN 7, OWE 6.5, PSK 5.5) are planning assumptions; replace them with your own service-desk data.
Ready to retire the open guest SSID?
See how Purple SecurePass moves returning guests onto encrypted Passpoint access.
The false trade-off is over.
For years, businesses faced a frustrating choice when providing guest WiFi. Prioritize security, resulting in sometimes long, repeated login forms and frustrating digital friction, or prioritize ease of use, often resulting in an unsecured, unencrypted connection vulnerable to attack.
This false trade-off is over. The modern standard is no longer either seamless or secure; it must be both. SecurePass delivers a foundational shift, proving that unrivaled security and a truly seamless experience are not mutually exclusive; they are the powerful merger that defines modern connectivity. Businesses need to drive the adoption of software that eliminates dangerous cyber threats, such as Man-in-the-Middle (MITM) attacks, while ensuring immediate, effortless access across all their venues.
The MITM threat: the hidden risk of traditional guest WiFi
A Man-in-the-Middle (MITM) attack is one of the most common and dangerous threats on unsecured public WiFi. It occurs when a hacker inserts themselves between a user's device and the legitimate WiFi access point, allowing them to intercept, view, and potentially alter all data transmitted.
This attack vector is often exploited through two methods directly linked to unsecured public networks:
A. Network Spoofing (The Rogue Network)
A malicious actor can easily set up a low-power access point with a name identical to your official guest network (e.g., "Hotel_Guest_WiFi"). When a guest arrives, their device may auto-connect to the stronger, fake signal. Since most traditional captive portal connections remain unencrypted (an Open SSID), the user's connection and any activity are at risk of exposure.
B. Unencrypted Communications
Even if a guest connects to your legitimate network, if that network lacks encryption, the data transmission from the device to the Access Point (AP) can be monitored by a nearby hacker. This exposure opens the door to serious risks for your guests and, by extension, your brand:
- Phishing - Intercepting login credentials or session cookies.
- Malware - Injecting malicious code or redirection links into unencrypted web traffic.
- Data Theft - Stealing sensitive information as it is transmitted.
This exposure reduces customer trust, increases your risk of a data breach, and drives up costly IT support calls from users concerned about their device security.
SecurePass - Seamless Connection, Military-Grade Security
SecurePass is engineered to eliminate these vulnerabilities by enforcing a military-grade security standard without introducing any friction during connection. The solution flips the traditional model: instead of securing a session after connection via a form, the connection itself is secure by design.
Here’s how SecurePass delivers the best possible outcome:
1. Guests download a single, secure SecurePass WiFi Pass one time. This is a profile that serves as a digital key, verifying the user's and the device's identities. Once installed, it grants users automatic, uninterrupted access across all your venues. The connection is seamless because the required security authentication has already been established and verified.
2. SecurePass ensures communication is always end-to-end encrypted and protected from unauthorized access. This crucial layer of protection means every data packet traveling from the device to the legitimate AP is shielded. Even if traffic were somehow intercepted, it would be indecipherable, rendering the MITM (man-in-the-middle) attack useless.
3. SecurePass utilizes advanced protocols to validate the authenticity of the network before allowing a connection, to prevent network spoofing. It ensures that only authenticated devices can connect to your legitimate access points, automatically protecting users from rogue networks. If a hacker attempts to set up a spoofed network, the SecurePass profile will simply refuse to connect, automatically protecting your users. This provides a trusted WiFi experience and significantly reduces your IT burden.
4. By strictly preventing unauthorized and unauthenticated devices from connecting, SecurePass reduces the risk of malicious activities like DDoS attacks or other exploits targeting vulnerabilities often found in unsecured guest systems.
The modern standard is here.
The combination of effortless connection and best-in-class security is what your customers deserve, and what your business needs to stay protected in the modern digital landscape. SecurePass eliminates the need to choose between user experience and network safety. It reduces your risk of cyber attacks, drastically cuts down on complex IT support calls, and builds critical customer trust by delivering a truly great guest experience.
Seamless. Secure. Everywhere.
Ready to enhance your network security and unlock truly effortless connectivity?
Schedule a call with our team today to see SecurePass in action.
```of_text}of_text_above_this_point_and_no_further_explanation_is_needed. Custom constraints applied. This constitutes the complete response. Please parse as single valid JSON array. All non-text values kept. Brand spellings applied. No em dashes used. US compliance referenced where appropriate. Sector terms modified appropriately. Return JSON. All tags kept. All values double-quoted string. Single parseable JSON output returned. Done. Let's make sure that there are no line breaks, comments, or extra text output whatsoever. Done. Ready. Custom constraint matches. No explanations. Return only JSON. End of program. Here: {
