Can Passbeam do guest Wi-Fi or a captive portal?

Yes, using your access points' own guest portal. Passbeam holds the guest logins: a username, password and expiry for each visitor, made under Guest users on the client. Your portal shows its own sign-in page, sends what the guest typed to Passbeam over RADIUS, and lets the device on when Passbeam says yes. The sign-in page is yours. The logins, device limits and log are in Passbeam.

It's tested on UniFi's Hotspot portal, over standard RADIUS with CHAP and accounting on. The step-by-step guide with screenshots is “How do I set up UniFi's guest portal with Passbeam?”.

There are three ways to make logins. One at a time, with a generated password on a printable card. From a CSV file, where each person is emailed a link to choose their own password. Or from an Entra group, for staff on their own phones: everyone in the group gets a login and a link, and leaving the group ends it within fifteen minutes.

A guest login never gets anyone onto the staff network. Guest logins are only checked against Passbeam's own list, never your directory, and a staff member's work password doesn't work on the portal.

For wired, a network point in a meeting room can give guest access by default and move a device onto the staff VLAN once its certificate is checked. That's a switch setting and a VLAN rule, covered in “How do I make a switch port default to Guest, but put authenticated devices on the staff VLAN?”.

Passbeam doesn't do Identity PSK, where each device has its own Wi-Fi password. Certificates do that job.