How to Share WiFi With a QR Code

A WiFi QR code genuinely saves effort: no spelling out a 20-character passphrase, no autocorrect mangling your guest network, no "is that capital I or lowercase L?" at the front desk — when it works. A badly formatted string produces a scan that does nothing at all, with no error message. The phone reads the text and shrugs.

What is actually inside the code

Nothing clever. It is plain text in a defined shape that every scanner app looks for:

WIFI:T:WPA;S:GuestNetwork;P:summer2026;;

Field	Meaning	Notes
WIFI:	Prefix that identifies this payload type	Capital W-I-F-I, then a colon
T:	Security type	WPA covers WPA/WPA2/WPA3 personal; use WEP for legacy, nopass for open networks
S:	Network name (SSID)	Case-sensitive, up to 32 characters in the Wi-Fi standard itself
P:	Password	Omitted entirely when T:nopass
H:	Hidden network flag	H:true — see the compatibility section before you use it
;;	Terminator	Two semicolons; the last field also ends with one

The terminator trips people up more than anything else. Each field ends with a semicolon, including the last one, and then there is one final semicolon to close the block. Miss either and strict parsers reject the whole thing while lenient ones read it fine — which is how you get a code that works on your phone and fails on a guest's.

Escape these four characters or nothing happens

Semicolon, comma, colon and backslash all have structural meaning inside the payload. If your SSID or password contains one literally, escape it with a backslash — otherwise the scanner reads a field boundary and the string falls apart.

If the value contains	Write it as	Example
semicolon ;	\;	pa;ss → P:pa\;ss
comma ,	\,	a,b,c → S:a\,b\,c
colon :	\:	office:2 → S:office\:2
backslash \	\\	dom\user → P:dom\\user

The practical advice: if the network has any of these characters in it, change the password before printing anything. Non-ASCII values are another minefield — accented letters and emoji in an SSID need UTF-8 handling that some scanners manage and some do not. Keep guest credentials plain alphanumeric plus a couple of safe symbols.

Hidden networks: technically supported, practically annoying

H:true exists in the format and modern readers mostly honour it. Support still gets patchy across third-party scanner apps, and some Android builds join the network but then show it out of range, because the phone stops actively probing for an SSID that is not broadcast. If you were hiding the network for security: "hidden" stops casual browsing, not a determined person with a capture card. Isolation does far more for you than concealment does.

iOS and Android do not behave identically

• iOS recognises the WiFi payload in the Camera app and needs a tap on "Join Network?" to confirm. Nothing is silent.
• Android behaviour varies by version and manufacturer skin. Recent versions usually show a network tile with a Join button; some older versions add straight to the saved network list without asking, which sounds convenient and occasionally adds networks people did not intend to save.
• Generic QR apps often just display the string as text, so guests relying on one never get onboarded.

Either way the user stays in control — that prompt is a security boundary, not friction to design around. Any tool claiming to push credentials onto a device silently deserves suspicion.

Put guests on an isolated network first

Before you print a code, make sure the network it points at is the one you would be comfortable handing to a stranger. Guest network / client isolation is a router setting that stops devices talking to each other, and it is usually one checkbox away.

1. Isolate guest clients from each other and from your LAN — printers, NAS boxes and staff machines should be unreachable.
2. Check whether your router rate-limits guest traffic; if not, cap bandwidth so one guest's update does not flatten your point-of-sale.
3. Confirm the guest SSID shares no credentials with internal networks. Same password on two SSIDs is one SSID with extra steps.
4. Turn off WPS and admin access from the guest side.

None of this is QR-specific, but printing a beautiful code for a network that exposes your office printer is a bad trade.

Where to put it, and how big

WiFi codes get scanned at conversational distance, so you have it easier than billboard codes: a 4–5 cm square on a table tent or a card next to the till works almost everywhere. Put it where people already look rather than where mounting is easy. Print the network name underneath so staff can answer out loud without hunting for the router sticker.

Laminate it. Paper near a coffee machine has a short life.

What to do when you rotate the password

Here is the real argument for keeping these codes static: there isn't one. A static code encodes the credentials, so rotating the password invalidates every printed copy at once. Plan for it deliberately.

1. Pick a rotation interval and put it where you keep other reminders — quarterly for a holiday rental, monthly for a busy cafe, annually for a home office.
2. Print fewer, better-placed copies rather than dozens of stickers you lose track of.
3. Photograph where each copy lives so the replacement run covers the same spots.
4. Regenerate and reprint before the password changes, not after.
5. If reprints are not viable, point the code at a page holding the current credentials. Slower for the guest, cheaper for you.

Staff deserve a fallback too: the plain password somewhere readable. A dead QR and no backup just means everyone retypes it after a delay.

Tradeoffs worth stating plainly

A WiFi QR code moves the password from your memory onto your wall. If the guest network is also the one your business runs on, that makes things worse, not better. The cards get photographed — assume anything you print will eventually be public. On an isolated network with a rotation schedule, though, they are one of the few QR patterns that reliably delights people.

FAQ

Why does nothing happen when I scan my WiFi code?

Three usual causes: an unescaped semicolon, comma, colon or backslash; a missing trailing double semicolon; or a scanner app that displays text instead of acting on WiFi payloads. Test with the default camera on both iOS and Android before blaming the code.

My password contains a semicolon. Now what?

You can escape it as \;, and it should work. Changing the password to something without punctuation is more reliable across scanners and takes about thirty seconds.

Do I need T:WPA if my router uses WPA3?

Yes. The field tells the phone the general security family, not the exact cipher, and routers running WPA3 in transition mode negotiate down.

Can I leave out the password for an open network?

Yes — T:nopass;S:NetworkName;; with no P field. Whether an open guest network is a good idea without a captive portal accepting terms first is a separate question, and most venues will want that portal anyway.

Does scanning automatically connect a device?

No. iOS always asks. Android generally asks, and behaviour differs across versions and manufacturer skins. A form of user confirmation is standard across modern platforms.

Is putting my WiFi password in a QR code unsafe?

It publishes the password to anyone in the room or holding a camera. With client isolation on and a rotation schedule, that is acceptable for most guest setups. Without isolation, do not.

What size should a WiFi QR code be?

Around 4–5 cm square for scanning at arm's length. The payload is short, so the symbol stays sparse — size is limited by your print quality, not data capacity.