The ESP8266 connects to open WiFi hotspots, even If I supply a password
It's probably by chance - however it's impossible to know.

Connecting is done by wifi_station_connect(), which is a function provided by the (closed source) ESP8266 SDK. So we can never know what it's actually doing.

However, the sequence is probably something like:


-> Connect
&lt;- Ok, give me a password
-> Here it is
&lt;- Right, you're connected


Or, with no PSK:


-> Connect
&lt;- Right, you're connected


Although you specify the password (which just gets stored in the configuration) if it never asks for it then it just doesn't use it.

Can you force it? Not without knowing what's going on in the mystery wifi_station_connect() function.  There is nothing much in the documentation for the SDK that even hints at a clue.