Passpoint Profile Generator
Create a Passpoint (Hotspot 2.0) profile for Android or iOS and install it on your device in a few taps. Enter your network's details and test credentials, then download the profile.
How it works
Enter your network details
Your home domain, NAI realm and any Roaming Consortium OIs, as configured on your access points and RADIUS server.
Add credentials and the CA certificate
A username and password for EAP-TTLS, and the CA certificate the device uses to verify your RADIUS server.
Download and install
On Android, accept the download in Chrome and install the profile. On iPhone and iPad, download it in Safari and install it from Settings.
Connect automatically
When the device is in range of your Passpoint access points, it joins and signs in on its own.
What your network needs
The generator creates the profile. For a device to connect with it, your network needs:
Access points with Passpoint (Hotspot 2.0) enabled, advertising the same home domain, NAI realm or Roaming Consortium OI as the profile.
A RADIUS server that supports EAP-TTLS and knows the username and password in the profile.
The CA certificate that issued your RADIUS server's certificate.
No Passpoint-ready RADIUS server? We provide cloud and on-premises RADIUS with Passpoint support.
Frequently Asked Questions
What is a Passpoint profile?
A small file installed on a device that tells it which Wi-Fi networks to trust and how to sign in to them: the home domain, the NAI realm or Roaming Consortium OIs, the EAP method and the credentials. Once it's installed, the device connects automatically whenever it's in range.
Which devices are supported?
Android phones and tablets, installed from Chrome, and iPhones and iPads, installed from Safari. The Apple profile is a standard .mobileconfig file, so it also installs on a Mac.
Is anything I enter stored?
No. The profile is created when you download it and sent straight to your device. Nothing you enter is stored or logged. We still recommend using test credentials.
Which authentication methods are supported?
EAP-TTLS with a username and password, with PAP, CHAP, MSCHAP or MSCHAPv2 as the inner method. Certificate-based (EAP-TLS) and SIM-based profiles aren't supported yet.
Do I need a RADIUS server?
Yes. The profile only tells the device how to connect. Your access points pass the sign-in to a RADIUS server, which checks the username and password. If you don't have one that supports Passpoint, we provide cloud and on-premises RADIUS.
What is the RADIUS server certificate name for?
Before sending the password, iOS checks that your RADIUS server's certificate carries this name, so the password can't be sent to an impostor server. Enter the name (CN or SAN) on the certificate. If you leave it blank, the home domain is used.