An access point is the WiFi device that bridges wireless to wired internet.
A hotspot is a WiFi service that you access the Internet wirelessly.
I often speak of Hotspot 2.0 and lament both the name and that this standard hasn’t been widely adopted. (Because it is unnecessarily, hideously complicated.)
Hotspot 2.0 is a way for you to get onto an access point (sometimes also called a hotspot) in a safe, encrypted, fully secure way. The Hotspot 2.0 protocol allows you to link up to a hotspot or access point without any password. Your connection is encrypted from the moment it starts.
So you can find a Hotspot 2.0 wifi hotspot, choose it, and presto! You are online and secure from the get-go. It’s a great service.
How does it do this? It uses your MAC address or your SIM card as an initial authentication. So when trying to connect to the access point your device hardware identity is offered to the WiFi box and then this is passed through to an authentication server. The encryption keys are then passed to the access point (unique to each session) and your device connects securely.
Hotspot 2.0 is potentially a great service.
Unfortunately, Hotspot 2.0 is a terrible name because people confuse it with a hotspot, which is a common name for open public WiFi.
An access point is the box that bridges wired and wireless. A hotspot is a publicly open WiFi. And Hotspot 2.0 is the protocol that is not widely adopted (and should be) that allows you to get onto hotspots in a safe and secure and password-free way.