Free captive portal software vs a paid platform: what you get

Search for free captive portal software and you find two sorts of answer. One is the portal your WiFi hardware already has, switched off in a menu you have never opened. The other is an open source project you install on a spare machine or a router. Both cost nothing, and both do the core job of a captive portal: hold a new device back, show it a sign-in page, and let it online once the guest has done what the page asks.

This guide sets out what each free option does, where it stops, and what a paid platform adds on top. It is written for venue owners deciding whether the portal they already have is enough, and for installers advising them; the guide to guest WiFi for MSPs and resellers covers the partner side. CaptiFi is a paid platform, so we say plainly below when a free portal is the better choice.

What free captive portal software means

The first kind is built into the controller. Business WiFi systems from Ubiquiti, TP-Link, Cisco Meraki, HPE Aruba, DrayTek, MikroTik and Ruckus all ship a guest portal of their own, at no extra cost. It lives in the same dashboard as the rest of the network and is configured there.

The second kind is open source software you run yourself. pfSense and openNDS are the two best known. They cost nothing to download and give you more control than a built-in portal, in exchange for hardware to run on and someone who can set them up and keep them patched.

The portals built into WiFi controllers

Each vendor's own portal is designed to control access. The table summarises what each one offers and where it stops, drawn from our setup guide for that hardware.

Every one of these will put a sign-in page in front of the internet, and several handle vouchers or payments well. The pattern across the table is that the guest's details either go nowhere or sit on the controller with no marketing consent attached and nothing to send from. The setup guides for UniFi, Omada, Meraki, Aruba Instant On, DrayTek, MikroTik and Ruckus each describe their built-in portal in more detail.

Open source captive portals

pfSense, the open source firewall from Netgate, includes a captive portal. Its documentation says the firewall presents a login page where users enter "a username/password, a voucher code, or a simple click-through agreement". Authentication can use the local user database or vouchers, an external authentication server, RADIUS MAC authentication, or none at all for a click-through page, and a "Use Custom Captive Portal Page" option lets you upload an HTML page you have written yourself.

openNDS, short for open Network Demarcation Service, describes itself as "a high performance, small footprint, Captive Portal" and runs on OpenWrt routers and other Linux systems. Its Forwarding Authentication Service (FAS) API hands the sign-in to a separate application, which is how developers build custom portals with data capture on top of it.

Both are capable and well documented. Both assume someone on the team can install and configure a firewall or flash a router, write and host the sign-in page, and apply updates. Anything beyond access control, such as storing guest details or emailing them, is software you build or connect yourself. Our OpenWrt post compares NoDogSplash, the predecessor of openNDS, with a managed portal.

Where free portals stop

A free portal decides whether a device may go online. A venue that runs guest WiFi to win repeat visits needs five more things from it.

The first gap is the guest list. A built-in portal authorises a device and, at most, keeps a log on the controller. A venue that wants to email guests needs their details in a database it can search, segment and export, with each guest's consent attached. Recording that consent is the second gap: under the UK GDPR and PECR the marketing opt-in has to be separate from getting online and provable later, and with a free portal the checkbox design, the storage and the proof are all yours to build.

The third gap is everything after the visit. A welcome email, a review request the next day and a win-back offer for a regular who has gone quiet all need an email system connected to the list, plus unsubscribes that flow back to it. The fourth is reporting: a free portal counts connections, while a venue usually wants to know how many guests came back. The last is scale, because a group with several venues often has different hardware at each, and every built-in portal is configured separately.

What a free portal costs to run

There is no licence fee, but someone still has to do the work. The table shows who does each job when the portal is free, and who does it on a platform.

For a venue with an IT team that already builds systems like this, the free route can make sense. For a pub, cafe or hotel whose manager is also the marketing department, the jobs in the left column mostly never get done, and the guest WiFi stays a cost.

What a paid platform adds

A captive portal platform keeps the controller in charge of the network and replaces its sign-in page with one the platform hosts. On CaptiFi that brings a branded splash page from a visual builder, a guest database that grows with every sign-in, and marketing consent recorded per guest for email and SMS separately. Guests sign in with an email address or a phone number, and returning devices are recognised and let straight through.

On the Growth plan and above, welcome emails, Google, Tripadvisor and Yelp review requests and win-back offers send themselves after each visit, and the workflow builder on Pro runs longer guest journeys. The guest list exports as CSV on every plan, and from Growth it connects to 20+ other tools through the integrations directory. WiFi vouchers and paid WiFi are included on every plan, and every venue sits under one login whatever hardware it runs, with combined figures across venues on Pro.

Plans start from $69/mo on the pricing page, shown in your currency. CaptiFi works with the access points you already have on ten hardware ecosystems, and venues without compatible hardware get the plug-and-play CaptiFi device, included with a refundable deposit.

Free and paid side by side

When a free portal is the right choice

A free portal is the right answer when the only goal is access control. A council building, a bus station or a small office that needs visitors to accept an acceptable use policy has no use for a marketing list, and the controller's click-through page does that job at no cost. The same goes for a venue that wants vouchers and nothing else: UniFi, Omada and pfSense all handle codes without a subscription.

Open source makes sense for an organisation with its own developers who want full control of the code and the data and are happy to maintain both. For a venue that wants guests to come back, a paid platform is the route that does the follow-up, and it earns its cost only if the venue uses the list. The complete guide to WiFi marketing covers what that involves.

Moving from a built-in portal to CaptiFi

You keep your hardware. The move is a change to the guest network's portal setting on the controller, from the built-in page to an external portal, plus a few walled garden entries. On UniFi, CaptiFi writes the hotspot settings itself once you connect the controller with an API key. On the other systems, the setup guide for your hardware lists each value, and you switch off the built-in sign-in methods so that CaptiFi is the only thing authorising guests.

If you already have a list of customers from a booking system or till, it can come into CaptiFi through the import, with the permission each contact gave recorded against them; the guide to importing a customer list under PECR explains what the rules allow. You can try the whole thing on your existing network with the 30-day free trial before paying anything.

Sources: Netgate, pfSense Captive Portal and its zone configuration documentation; openNDS documentation; CaptiFi's setup guides for each controller, which cite the vendors' own documentation; and CaptiFi's feature pages, October 2026. UniFi, Omada, Meraki, Aruba Instant On, DrayTek, MikroTik, Ruckus and pfSense are trade marks of their owners; CaptiFi is not affiliated with or endorsed by them.