In brief
One shared password is easy, but it creates three separate problems: you do not know who connected, the line cannot be shared fairly, and the password never changes.
In most cafés, small hotels and offices, guest Wi-Fi runs on a single password. It is pinned to the wall or written on the back of the menu. Setting it up takes five minutes and it works fine on day one.
The problems come later.
Problem 1: you do not know who connected
On a shared-password network, all you hold about connected devices is a MAC address and an IP address. Neither identifies a person.
When something goes wrong — which usually starts with an official letter arriving — you have no answer to "who was on my network at that hour?". A device list does not answer that question.
With verified sign-in, every session has a verified contact detail behind it. When the question is asked, you can produce an answer.
Problem 2: a few people take the whole line
On a shared-password network everyone draws from the same pool. One guest's large download slows down everyone else.
To put a limit per user, you first have to be able to tell users apart. With a shared password there are no users to tell apart, only devices, and the device count keeps changing.
With verified sign-in, every session has an owner. That lets you set:
- A speed limit per guest
- A session length (two hours in a café, say)
- A daily data quota
- Different limits per sign-in method
The line then stretches to everyone, even at the busiest hour.
Problem 3: the password never changes
In theory the password should rotate. In practice it does not, because changing it means:
- Reprinting the card on the wall
- Telling the staff
- Making everyone currently connected reconnect
- Updating fixed devices such as printers, card terminals and tablets
Because of that burden, the password stays the same for years. After a while it is no longer something "the guests know" but something "the neighbourhood knows".
With one-time codes there is no password to change. Each guest gets their own code, and the code is worthless once used.
What about an open network with no password?
Some businesses drop the password entirely and leave the network open. That makes all three problems above worse and adds a fourth: on an open network, devices can see each other.
Client isolation should be on for a guest network. Guests should not see each other's devices, only the internet.
What changes when you switch?
Moving from a shared password to verified sign-in, the only difference a guest notices is that a page opens on first connection and a code arrives on their phone. It takes about 20 seconds. On the second visit, with device remembering, even those 20 seconds disappear.
On your side:
| Shared password | Verified sign-in |
|---|---|
| No idea who connected | Every session has an owner |
| No fair sharing | Limits per user |
| Password fixed for years | No password, one-time codes |
| No logs, or incomplete ones | Session records kept |
| No welcome screen | A welcome screen in your brand |
Where to start
You do not need to rebuild the network. It is enough for guest traffic to pass through a device at the network edge. Your access points stay as they are; their brand and model do not matter.
In practice the order is usually: separate the guest network from the staff network, route guest traffic through the gate device, then configure sign-in methods and limits last.