One SSID. A different key for everyone on it.

xPSK is an umbrella term for per-user pre-shared keys: a network where every person holds their own WiFi key on a single SSID, instead of one passphrase shared by everybody. They connect every device they own to that one key. Vendors ship it under different names, but the mechanism is the same. RADIUS returns a unique passphrase for each key, along with the VLAN and policy that key should land in.

Nothing structural. They are vendor names for the same capability: iPSK and EasyPSK on Cisco Meraki, DPSK on Ruckus, MPSK on HPE Aruba, ePSK on Juniper Mist, and PPSK on Extreme Networks and Ubiquiti UniFi. The RADIUS attributes differ per vendor. Purple issues keys for all of them from one cloud RADIUS, so a mixed estate is configured once rather than per controller.

802.1X authenticates with a certificate or a directory login and is the stronger option wherever devices can support it. xPSK authenticates with a key, which is why it reaches the devices 802.1X cannot: printers, sensors, consoles, smart TVs and contractor laptops with no MDM enrollment. Most estates run both, with 802.1X for managed endpoints and xPSK for everything else.

Yes. Purple is hardware agnostic and layers on top of your existing infrastructure, including Cisco Meraki, HPE Aruba, Ruckus, Juniper Mist, Ubiquiti UniFi, Cambium, Extreme and Fortinet. No rip and replace required.

Through a branded self-service portal. The user onboards themselves, collects their own key and adds their devices to their own Private Area Network, so nobody on your team is issuing credentials by hand or fielding a ticket for every printer. Keys can also be provisioned automatically from your directory, or minted through the Purple API for a system that already owns the user relationship.

All three are automatic, because the key is bound to an identity rather than to a place. A joiner is provisioned over SCIM from Entra ID, Okta or Google Workspace and has their key without a ticket. A mover keeps the same identity, so changing room, building or role carries their access with them and no key is re-issued. A leaver is revoked once, and every device they ever registered drops off across the whole estate.

No. Keys are held in Purple's cloud RADIUS rather than in an access point controller's local key store, which is where per-SSID key ceilings usually come from, so the number of keys is not the constraint it is on-box. There is no cap on devices per key either, and licensing is per access point and per venue, with no per-device taxes and no per-authentication meter, so a user with nine devices is licensed the same as one with two.

MAC binding ties a key to the device that first used it, so it cannot quietly become a second shared password. Keys can also carry an expiry date, and any single key can be revoked on its own without rotating a passphrase across the site or disconnecting anyone else.

Yes. RADIUS returns the VLAN with the key (Tunnel-Type, Tunnel-Medium-Type and Tunnel-Private-Group-ID), so each key lands in its own segment. Firewall policy, bandwidth limits and user roles are applied per key as well, which is how one SSID carries staff, tenant, contractor and IoT traffic without mixing them.

Every key is tied to a named identity rather than to a shared password, so each authentication is attributable and each revocation is surgical. Purple never stores user passwords, runs RADIUS regions in the UK, EU and US, is ISO 27001 certified and GDPR and CCPA compliant, and has had zero data breaches since 2012.