NeverSSL is a website that deliberately doesn't use encryption, so that public WiFi can hijack it. That sounds backwards, but it's exactly what you need when a hotel, airport or cafe WiFi login page refuses to appear. Visit http://neverssl.com, the network intercepts the request, and you land on its sign-in page.
How to use it: connect to the WiFi, open any browser, type http://neverssl.com into the address bar (with http, not https) and press go. The login page should appear in its place.
Why a website would avoid HTTPS on purpose
Public WiFi login pages, also called captive portals, work by intercepting the first web page you ask for and swapping in their own sign-in page. That only works on unencrypted http:// traffic. An encrypted https:// page can't be swapped without your browser noticing and showing a security warning.
Almost every site you visit today is HTTPS, and most browsers upgrade addresses to HTTPS automatically. So when your phone or laptop fails to open the login page on its own, typing in a normal website just hangs. NeverSSL fixes that by being one of the few sites guaranteed to stay on plain HTTP, giving the network something it can redirect.
Who runs it
NeverSSL was built by Colm MacCárthaigh, an engineer at Amazon Web Services, as a quick fix for getting online at airports, on planes, in hotels and in cafes. His notes on the site's history mention it handling around six million hits a day (source code on GitHub).
Newer versions also send you to a random subdomain each time. That gets around networks and browsers that have cached an old answer, which is one of the reasons the login page sometimes fails to reappear.
Is NeverSSL safe?
Yes, for what it's for. It's a tiny page with nothing to log in to, and the whole point is that the network replaces it. Two things to keep in mind:
- Don't type anything private on any
http://page on public WiFi. That's general advice, not a NeverSSL problem. - Check the login page you land on looks like it belongs to the venue before entering details.
NeverSSL not working?
- Your browser upgraded it to HTTPS. Chrome, Firefox and Safari can all force HTTPS. If you see a warning, choose to continue to the site, or try a private window or another browser.
- You're already online. If NeverSSL loads normally, the network isn't holding you at a login page. If websites still won't load, the problem is something else.
- A VPN or Private DNS is on. It sends your traffic around the portal. Turn it off until you've signed in.
- Try an alternative.
http://example.comandhttp://captive.apple.comalso stay on plain HTTP and trigger the redirect the same way. Our explainer on captive.apple.com covers how that one works.
For step-by-step fixes on each device, see how to open the captive portal login page.
If you run the venue
If your guests need NeverSSL to reach your login page, the portal isn't being detected automatically. Phones should open it by themselves the moment they join. Usually the automatic check addresses phones use aren't being redirected, or they're allowed through before login so the phone thinks it's already online. Our setup guides for UniFi, Meraki and Omada cover the settings that matter.