Identity PSK (iPSK) is a way to run one Wi-Fi network name with many pre-shared keys. When a device connects, a RADIUS server decides which key is valid for it and which network policy it gets, so each user, room or group of devices has its own password and its own place on the network.
A home network has one password, and everyone who knows it is on the same network. That is fine at home. In a residence hall, an apartment building or an office full of sensors, one shared password means one leak exposes everyone, and changing it disconnects every device at once.
iPSK keeps the simplicity of a password, which every phone, console, TV and printer understands, and adds what the shared password lacks: a key per user or group, a separate network behind each key, and keys that can be changed one group at a time.
Home Wi-Fi has one password because one household shares it. A building is not one household.
Both run one SSID with many keys. They differ in what the RADIUS server uses to decide which key, and that single choice decides how much work onboarding is and whether modern phones stay connected.
The controller sends the connecting device’s MAC address to a RADIUS server, which looks it up and returns the key and policy registered for that address. It works well for fleets of known devices whose addresses never change.
The catch: every device must be registered first, and phones and laptops now present private, randomized addresses that no longer match what was registered.
The key the user enters identifies the group. Nothing has to be registered in advance: the device connects with its room’s or group’s key and lands in that group’s private network, whatever address it presents.
This is how EasyPSK works in its Instant groups. Where only known devices may join, its Approved and Dedicated groups add pre-registration or a unique key per device.
Two rooms and an office share one SSID. Pick how the network tells their devices apart, and watch what each device has to present, whether it gets on, and which network it lands in.
Example rooms and keys. In EasyPSK the platform generates every key. Nobody chooses one.
| Question | Shared PSK | MAC-based iPSK | Key-based iPSK (EasyPSK) | WPA2/WPA3-Enterprise (802.1X) |
|---|---|---|---|---|
| What decides the network a device joins | The one password | The device’s MAC address, looked up by a RADIUS server | The key the user enters | The user’s or device’s own credential: a username and password or a certificate |
| Keys | One for everyone | One per device or group, tied to registered MAC addresses | One per room, user or group, generated by the platform | No shared key, an identity per user or device |
| Devices that cannot use 802.1X (consoles, smart TVs, printers) | Work | Work, once their MAC is registered | Work | Do not work, they need a separate SSID or MAC authentication |
| Phones and laptops with private, randomized MAC addresses | Work | Break until the new address is registered | Work: the key, not the address, identifies the group | Work |
| Separation between users | None, everyone shares one network | Per group or device, where the controller enforces it | Per room, user or group: a private network inside the shared SSID | Per policy, such as VLAN or role |
| Changing a key | Every device in the building reconnects | Per device or group | Only that group’s devices reconnect | Per user, no shared key to change |
| Onboarding effort | Hand out one password | Collect and register MAC addresses first | Hand out a key or a QR code | Configure each device or push a profile |
| Typical fit | Small sites with no need to separate users | Known fleets of IoT and headless devices | Residence halls, apartments, senior living, co-working | Managed corporate devices, eduroam |
The lime column is key-based iPSK as EasyPSK runs it. Scroll sideways on a narrow screen.
Key-based iPSK with a personal network per room, unit or user on one SSID. Security flavours Instant, Approved and Dedicated per group, and a Self-Service Portal where people find their key, a QR code and their connected devices.
EasyPSK overviewPer-group keys over RADIUS for IoT and device fleets, organised by device class, with Cisco security group tags, and wired devices through MAC Authentication Bypass.
Read the documentationCloud RADIUS for WPA2/WPA3-Enterprise with certificates or passwords, for managed devices that support 802.1X, including eduroam.
EntryPoint overviewEasyPSK for residence halls EasyPSK requirements Talk to an engineer
Something else on your mind? Talk to an engineer.
iPSK stands for Identity Pre-Shared Key. It runs one SSID with many pre-shared keys, so each user, room or group of devices gets its own Wi-Fi password and its own network policy instead of everyone sharing one password.
A normal WPA2-Personal network has one password for everyone, and everyone who has it lands on the same network. With iPSK the network accepts many keys, and the key a device uses decides which group, VLAN or private segment it belongs to.
MAC-based iPSK looks up the device’s MAC address to find its key. Current phones and laptops use private, randomized Wi-Fi addresses by default, so the address that was registered may not be the one the device presents, and the device is refused until it is registered again.
In key-based iPSK the key itself identifies the group. EasyPSK works this way: a user enters their room’s or group’s key and lands in that group’s private network, with no MAC address registered in advance in its Instant groups. Stricter groups can still require pre-registered devices or a unique key per device.
They solve different problems. 802.1X with certificates gives each device its own credential and is the stronger choice for managed devices that support it. iPSK is a large step up from one shared password, because a leaked key exposes one group instead of the whole network, and it works for devices that cannot use 802.1X. Many networks run both on separate SSIDs.
No. iPSK needs a RADIUS server that returns the right key and policy, and Cisco ISE is one option. EasyPSK and EntryPoint provide that RADIUS service from the cloud for Cisco Meraki and Cisco Catalyst 9800, so there is no RADIUS server to run on site.
They are the same idea under different names. Several wireless vendors call per-user pre-shared keys private PSK (PPSK) or dynamic PSK (DPSK). Cisco calls it Identity PSK.
Cookies help us improve this site. With your consent we also measure how it is used, with our own analytics and Google Analytics, configured with no advertising or cross-site tracking. Read our Privacy Policy for more.
When you visit our website it may store or retrieve information in your browser, mostly as cookies. This information is used to make the site work as you expect and, with your consent, to understand how it is used. Because we respect your privacy, you can choose not to allow some cookies. Note that blocking some of them may affect your experience.
These cookies are needed for the website to function and cannot be switched off. They are usually set only
in response to actions you take, such as signing in to internal areas or filling in a form. They store no
information that identifies you personally (cookie: ng_learn_session).
With your consent, we measure how the site is used: unique and returning visitors, approximate city and
region, time on a page, and entry and exit pages. This runs on our own first-party cookies
(ng_consent, ng_vid, ng_sid) and on Google Analytics
(_ga), configured so Google gets no advertising or cross-site signals. We never store your IP
address. If you do not allow this, we use only privacy-friendly, cookieless measurement.
