Secure by design, not by afterthought

Guests are kept off your network

Guests join a separate network that can't reach your private devices, tills or systems. Fair-use limits (time, speed, data) are enforced by your own router or controller.

No open ports, no static IP

MojoWiFi never asks you to forward ports. Routers connect out to us: UniFi through your Ubiquiti account or a WireGuard® tunnel, MikroTik through a WireGuard tunnel, and Omada controllers by RADIUS.

Credentials encrypted, certificates pinned

• Device credentials (API keys, passwords) are encrypted with AES-256-GCM and never shown again after you enter them.
• When we talk to a device directly, we pin the certificate you confirmed, so a different device can't pretend to be yours.
• Account passwords are stored hashed. Sign-ins use short-lived access tokens, and longer-lived session tokens are stored only as hashes.

Access you control

• Team roles (owner, admin, operator, viewer) for everyone in your organization.
• Every security-relevant change is recorded in an audit log.
• Each hardware device can belong to only one MojoWiFi account.

Reporting a vulnerability

Found something? Email security@mojowifi.com. We reply quickly and credit researchers who report responsibly.

WireGuard is a registered trademark of Jason A. Donenfeld.