One SSID. A different key for everyone on it.

Traditional WiFi is one SSID with one password that everybody shares. xPSK is the name for the family of technologies that keeps the single SSID but gives every person (or device) their own password - each one issued separately, revoked separately, and carrying its own network policy. Different hardware vendors call it iPSK, EasyPSK, MPSK, DPSK or PPSK.

Speak to an expert

Someone at a desk connecting a printer alongside their laptop and phone, all on one WiFi key

Someone moving into a new apartment, setting up their phone, laptop, speaker and printer on one WiFi key

Build-to-rent and MDU

Tenant changeover without a site visit

Each resident gets one key on move-in day and connects every device they own to it, with no concierge visit and nothing to install
Move-outs are revoked in a single action, so a apartment is ready for the next tenant the same day
Every resident sits in their own Private Area Network, so nobody can see the neighbor's TV, printer or laptop
One SSID across the whole building, with each key landing in its own VLAN

Explore Multi-Tenant WiFi

Student accommodation

A whole intake onboarded in a weekend

Hundreds of arrivals collect their own key from a branded portal, so there is no queue at the front desk
Consoles, smart TVs, printers and speakers join that same key, so nobody fields a ticket per device
No cap on devices per key, so the student with nine is licensed the same as the one with two
End-of-year revocation is one directory action rather than a passphrase rotation across the estate

Read the multi-tenant WiFi guide

Students in a shared halls kitchen using laptops, a tablet, a games console, smart speakers and a printer

An IT manager working at their desk in an open-plan office, with no RADIUS server on site

Staff and contractors

The devices 802.1X cannot reach

Printers, sensors, door controllers and AV kit join with a key instead of a certificate
Contractors get a time-limited key with no MDM enrolment and nothing to install
Keys are bound to identities in Entra ID, Okta or Google Workspace, so a leaver's devices drop off automatically
Runs on Purple's cloud RADIUS with a 99.9% uptime SLA, so there is no on-site RADIUS server to maintain

See RADIUS-as-a-Service

The same mechanism, a different name per vendor

xPSK is an umbrella term. Your vendor almost certainly ships it already, under its own name and with its own RADIUS attributes. Purple speaks all of them from one cloud RADIUS, so a mixed estate behaves the same everywhere.

Cisco (Catalyst)

iPSK / EasyPSK

Identity PSK, and the industry standard term for this method. Purple is the RADIUS that issues each key and returns its VLAN.

Cisco Meraki

iPSK / EasyPSK

Identity PSK, often used with Meraki Cloud Authentication or RADIUS. Purple is that RADIUS, assigning the VLAN per key from the Meraki Dashboard.

Ruckus

DPSK

Dynamic PSK. Ruckus pioneered this and generates complex keys for users. Purple provisions them through the API with per-key isolation and VLAN routing.

Extreme Networks

PPSK

Private PSK, functionally identical to iPSK. Purple issues them per user, per group or per IoT device class in ExtremeCloud IQ.

Aruba (HPE)

MPSK

Multiple PSK, sometimes referred to as Cloud Auth MPSK. Purple issues each key and maps it to its own Aruba user role and VLAN.

Ubiquiti (UniFi)

PPSK

Private PSK, a newer feature in the UniFi ecosystem. Purple authenticates each key and maps it to its own VLAN on a single broadcast SSID.

Juniper Mist

MPSK

Multi-PSK, using cloud-based key management. Purple provisions keys over the Mist API with per-client roles.

Cambium and Fortinet are supported too, along with anything else that speaks RADIUS. Tell us what you run and we will confirm the attribute set before you commit to anything.

Product

xPSK FAQs

What is xPSK?

xPSK is an umbrella term for per-user pre-shared keys: a network where every person holds their own WiFi key on a single SSID, instead of one passphrase shared by everybody. They connect every device they own to that one key. Vendors ship it under different names, but the mechanism is the same. RADIUS returns a unique passphrase for each key, along with the VLAN and policy that key should land in.

What is the difference between xPSK, iPSK, DPSK, MPSK and PPSK?

Nothing structural. They are vendor names for the same capability: iPSK and EasyPSK on Cisco Catalyst and Meraki, DPSK on Ruckus, MPSK on Aruba and Juniper Mist, and PPSK on Extreme Networks and Ubiquiti UniFi. The RADIUS attributes differ per vendor. Purple issues keys for all of them from one cloud RADIUS, so a mixed estate is configured once rather than per controller.

How is xPSK different from WPA2/3-Enterprise and 802.1X?

802.1X authenticates with a certificate or a directory login and is the stronger option wherever devices can support it. xPSK authenticates with a key, which is why it reaches the devices 802.1X cannot: printers, sensors, consoles, smart TVs and contractor laptops with no MDM enrolment. Most estates run both, with 802.1X for managed endpoints and xPSK for everything else.

Does xPSK work on our existing hardware?

Yes. Purple is hardware agnostic and layers on top of your existing infrastructure, including Cisco Meraki, HPE Aruba, Ruckus, Juniper Mist, Ubiquiti UniFi, Cambium, Extreme and Fortinet. No rip and replace required.

How does a user actually get their key?

Through a branded self-service portal. The user onboards themselves, collects their own key and adds their devices to their own Private Area Network, so nobody on your team is issuing credentials by hand or fielding a ticket for every printer. Keys can also be provisioned automatically from your directory, or minted through the Purple API for a system that already owns the user relationship.

What happens when someone joins, moves or leaves?

All three are automatic, because the key is bound to an identity rather than to a place. A joiner is provisioned over SCIM from Entra ID, Okta or Google Workspace and has their key without a ticket. A mover keeps the same identity, so changing room, building or role carries their access with them and no key is re-issued. A leaver is revoked once, and every device they ever registered drops off across the whole estate.

Is there a limit on how many keys or devices we can have?

No. Keys are held in Purple's cloud RADIUS rather than in an access point controller's local key store, which is where per-SSID key ceilings usually come from, so the number of keys is not the constraint it is on-box. There is no cap on devices per key either, and licensing is per access point and per venue, with no per-device taxes and no per-authentication meter, so a user with nine devices is licensed the same as one with two.

What happens if someone shares their key?

MAC binding ties a key to the device that first used it, so it cannot quietly become a second shared password. Keys can also carry an expiry date, and any single key can be revoked on its own without rotating a passphrase across the site or disconnecting anyone else.

Can each key have its own VLAN and policy?

Yes. RADIUS returns the VLAN with the key (Tunnel-Type, Tunnel-Medium-Type and Tunnel-Private-Group-ID), so each key lands in its own segment. Firewall policy, bandwidth limits and user roles are applied per key as well, which is how one SSID carries staff, tenant, contractor and IoT traffic without mixing them.

How secure and compliant is xPSK?

Every key is tied to a named identity rather than to a shared password, so each authentication is attributable and each revocation is surgical. Purple never stores user passwords, runs RADIUS regions in the US, EU and UK, is ISO 27001 certified and CCPA/CPRA compliant, and has had zero data breaches since 2012.