Technologies for cloud-based secure WLAN group self-forming are described. One provisioner portal device receives, from a client provisionee device that desires to connect to a home WLAN, a first SSID and forwards, to a cloud service via a wireless AP device, the first SSID and a MAC address. The provisioner portal device receives, from the cloud service via the WAP device, a second SSID and a passphrase. The provisioner portal device sends, to the client provisionee device, a response that includes the second SSID. The provisioner portal device creates a one-time provisioning wireless network with the second SSID and the passphrase. Through the provisioner portal device, WAP credentials can be exchanged from the cloud server to the client provisionee device over a secure channel. The WAP credentials can be used to switch to the home WLAN without user interaction to manually enter the WAP credentials at the client provisionee device.