A 20-character WPA2 password is a bad thing to read aloud across a café counter, and a worse thing to type on a phone keyboard. A WiFi QR code moves the whole job to the camera: scan, confirm, connected. This guide covers the exact payload format, the escaping rules that trip people up, how large to print the card, and why the network you encode matters more than the code itself.

What is a WiFi QR code?

A WiFi QR code contains a short structured string describing a network — its name, its password and its security type — in a format phones recognise as connection instructions rather than text. Scan it and the phone offers to join that network. Nothing is downloaded and no server is contacted; the credentials are decoded on the device and handed straight to its WiFi stack.

The syntax is the WIFI: URI, a de-facto standard that came out of the ZXing barcode project and was adopted broadly enough that both major mobile platforms now handle it. It is not part of the ISO QR code specification, which is why support depends on the operating system rather than on the code:

  • iOS 11 and later reads WiFi codes straight from the built-in Camera app and shows a "Join Network" banner.
  • Android 10 and later supports it natively, both in the camera on most devices and via Settings → Network & internet → WiFi → Add network, where a QR icon sits next to the SSID field. Android 10+ can also generate a code for a network it is already on, via the network's Share button — handy for checking what a correct payload looks like.
  • Older Android versions vary by manufacturer. Some OEM camera apps handled WiFi codes years before Android 10; plain builds often did not. A generic scanner app will still show the raw WIFI: string, which the user then has to interpret manually.

Because everything happens locally, the code works with no internet connection at all — which is the point, since the person scanning it has not got online yet.

When to use a WiFi QR code

  • Cafés and bars. A small card in an acrylic table stand, on the guest network only. Saves your staff from repeating the password forty times a shift.
  • Short-term rentals and holiday lets. Print it in the welcome folder and stick a laminated copy inside a kitchen cupboard door, where it survives cleaning but is not visible from the street. This is the single most appreciated item in most welcome packs.
  • Office reception and meeting rooms. Guest network on a desk card; a separate code for the boardroom means visiting clients stop asking IT for help mid-presentation.
  • Clinics and waiting rooms. People wait 20 minutes with a phone in hand; a code on the wall beats a receptionist dictating credentials over a queue.
  • Conferences and venues with rotating passwords. Generate a fresh code each morning and print it on the day's signage, so yesterday's badge photograph is useless.
  • Retail staff areas and warehouses. Onboarding handheld scanners, label printers and tablets onto the right SSID without an engineer typing on a tiny on-screen keyboard.
  • Classrooms and training rooms. Thirty devices joining in two minutes instead of twenty, with no password written on a whiteboard where it stays for a term.
  • Home guests. A card on the fridge for the guest SSID, so visiting family never learns the credentials your NAS and cameras sit behind.

Two situations where this is the wrong tool. If your network uses WPA2/WPA3-Enterprise with 802.1X — individual usernames, certificates, RADIUS — a WIFI: code is not a realistic route. The URI syntax has some enterprise extensions, but reader support is patchy enough that you should not build a process on it; use your MDM or an onboarding portal instead. And if the network is behind a captive portal, the code only gets the device associated: the user still has to accept terms in a browser. Say so on the card, or people will report the code as broken.

How to create a WiFi QR code

  1. Decide which network you are sharing. Almost always the guest network, not the one your printers, NAS, cameras and point-of-sale terminals live on. If you do not have a guest SSID, most business routers can create one in about five minutes, with client isolation enabled.
  2. Copy the SSID exactly as the router broadcasts it. Case matters, spaces matter, and a trailing space is invisible and fatal. Check it against your phone's WiFi list, not against a label on the router that may predate a rename.
  3. Confirm the security type. Choose WPA/WPA2 for any modern protected network (WPA3 networks in transition mode also work with this setting), WEP only for genuinely ancient hardware, and No Password for an open network.
  4. Open the WiFi generator and enter SSID, password and encryption type.
  5. Generate and download the PNG. Use the 400 pixel option for anything printed.
  6. Test on both platforms before printing. Forget the network on your phone first (otherwise a successful "join" proves nothing), then scan. Test one iPhone and one Android.
  7. Print, laminate matte, and date it. A small "updated March 2026" in the corner tells staff which cards to replace after a password rotation.

The data format

The payload is a single line. For a network called CafeGuest with the password flatwhite2026:

WIFI:T:WPA;S:CafeGuest;P:flatwhite2026;;

That is 40 characters, which fits comfortably in a version 3 symbol (29 × 29 modules) at error correction level M. WiFi codes are usually small and chunky, which is why they scan so well off a table card.

FieldMeaningValues and notes
WIFI: Scheme Tells the reader this is a network, not text. Must come first.
T: Security type WPA (covers WPA, WPA2 and WPA3 in practice), WEP, or nopass for an open network.
S: SSID The network name, character for character, case-sensitive.
P: Password The pre-shared key, case-sensitive. Left empty for nopass.
H: Hidden network flag Optional, H:true if the SSID is not broadcast. This generator does not emit it — see the note below.
;; Terminator The final field ends with a semicolon and the whole string ends with another. Both are required.

Escaping special characters

Because semicolons and colons separate the fields, a password containing them has to be escaped with a backslash. The characters that need escaping are \, ;, ,, : and ". A password of be;er4me must be encoded as:

WIFI:T:WPA;S:CafeGuest;P:be\;er4me;;

There is one more edge case: an SSID that consists only of hexadecimal characters (say ABCD1234) can be misread as a hex-encoded value, so the specification allows wrapping it in double quotes — S:"ABCD1234". Rare, but it explains an otherwise baffling failure.

This generator writes the values you type into the string as-is. That is deliberate — it means you can paste an already-escaped value — but it also means you are responsible for the backslashes if your password contains one of those five characters. If it does, and you would rather not think about escaping, changing the guest password to alphanumerics is the pragmatic fix. Same for hidden networks: if your SSID is not broadcast, expect some devices to need the network added manually, since the H:true flag is not included here.

Sizing and printing

WiFi codes are read close up, usually by someone sitting down, so they can be small — but the 10:1 rule still applies: code width should be roughly a tenth of the scanning distance.

PlacementScan distanceMinimum code widthNotes
Table tent / acrylic stand25–35 cm2.5–3 cmAngle it towards seated eye level, not straight up
Fridge magnet or welcome card25–30 cm2.5 cmMatte finish; magnets often ship glossy
Reception counter card40–50 cm4–5 cmFlat on the counter beats propped up under downlights
Hotel room / rental info sheet30–40 cm3 cmInclude the SSID in plain text as a fallback
A4 wall notice1 m10 cmMount at 130–150 cm from the floor
Window or door decal1–1.5 m15 cmMatte vinyl; glass glare is the usual culprit
Conference / venue banner2–3 m20–30 cmPut it where people stop walking

The underlying constraint is module size: code width ÷ (grid modules + 8), allowing four modules of quiet zone per side. A version 3 WiFi code printed 25 mm wide gives modules of about 0.68 mm, which is comfortable for any office printer. Do not go below 0.4 mm on laser or offset print, or 0.6 mm on thermal labels.

The 400 pixel PNG holds 300 dpi up to about 3.4 cm, so it is fine as-is for cards and table tents. For a wall poster, either have the artwork redrawn at final size or ask the printer to scale without smoothing so the module edges stay crisp.

Always print the SSID and password in readable text beside the code. Old phones, cracked lenses, a laptop that needs connecting, a guest with a scanner app that only handles URLs — the fallback costs you two lines and saves the interaction.

Common mistakes and how to fix them

SymptomCauseFix
"Unable to join the network" on every device SSID typo, wrong capitalisation, or a trailing space Copy the SSID from a device that is already connected, then regenerate.
Phone prompts to join, then reports a wrong password A ; : , \ or " in the password was not escaped, so the string was cut short Escape it with a backslash, or change the guest password to letters and digits.
Nothing happens on an open network Security type left as WPA when the network has no password Select No Password so the payload uses T:nopass.
Works on iPhone, ignored on an Android phone Android 9 or older, or an OEM camera app without WiFi support Point the user to Settings → WiFi → Add network and the QR icon, and keep the printed password as a fallback.
Some devices never find the network Hidden SSID, which needs the H:true flag Broadcast the guest SSID (hiding it adds no real security) or have those devices add it manually.
Connects but there is no internet Captive portal, or the guest VLAN has no route out Add "accept the terms in your browser" to the card, and check the VLAN's gateway and DNS.
Code stopped working overnight Password rotated, network renamed, or the router was replaced and restored to defaults Regenerate and reprint. Date every printed card so you know which ones to swap.
Random devices join a different network with the same name Separate 2.4 GHz and 5 GHz SSIDs with different passwords, or a neighbouring duplicate SSID Use one SSID across both bands with a single key, and avoid generic names like "Guest".
Scanner shows raw text starting with WIFI:T: A third-party scanner app that only understands URLs Use the native camera app. The code is correct; the reader is limited.
Card scans in the shop, fails on the terrace Bright sunlight plus gloss laminate, or the code is out of AP range Matte laminate, and check signal coverage where the card actually sits.

Privacy and safety notes

Be clear about what this is: a WiFi QR code is your password in plaintext, in a machine-readable format. Anyone who photographs the card can decode it with a free scanner app in seconds. It is convenience, not encryption, and printing one is the same decision as writing the password on a chalkboard — just tidier. So the question is never "is the code secure" but "is this network safe to hand out".

Practical rules that follow from that:

  • Share a guest network, not your main one. The guest SSID should be on its own VLAN with client isolation on, so a scanned-in device cannot reach your NAS, cameras, till system or a colleague's laptop.
  • Keep the card out of camera range of the street. A code taped to the inside of a shop window can be read from the pavement, at night, by anyone with a phone. Table height and indoors is better than window height.
  • Watch what you publish online. WiFi cards leak constantly through interior photos on listing sites, review platforms and social posts. Before uploading a photo of a café or rental interior, check whether the card is legible in the frame.
  • Rotate on a schedule you can live with. Monthly for a busy venue, after each stay for a rental if the platform makes that easy. Reprinting a card takes a minute; a rotation you never do is worse than a password you accepted was semi-public.
  • Never encode router admin credentials. Obvious, but it happens when someone copies the wrong line off the label on the underside of the router.
  • Cap bandwidth and session length on the guest VLAN if your equipment supports it. It limits what a shared password can cost you.

One more thing about generating the code itself. Your browser builds the WIFI: string locally, then requests the QR image from an external image endpoint, which means the string — password included — is part of that request. For a café guest network that is a reasonable trade. For a corporate network, or any key you would not want in a third party's logs, use offline tooling instead: Android's own Share network screen generates a valid code without any network request. Our Privacy Policy describes exactly what leaves your browser.

FAQ

Does a WiFi QR code work without internet access?

Yes, and that is the whole point — the person scanning it is offline. The credentials are held in the pattern itself and decoded on the device, so no server is involved. Only generating the image needs a connection; using it does not.

Is the password encrypted inside the code?

No. It is stored as readable text. Any scanner app will display the full WIFI:T:WPA;S:...;P:... string, and screenshots of a printed card are enough to extract it. Treat a printed WiFi code as a password you have chosen to make public to everyone who can see the card.

Can iPhones and Android phones both scan it?

iOS 11 and later handles WiFi codes in the standard Camera app. Android 10 and later supports them natively, either in the camera or through the QR icon in Add network. Below those versions it depends on the manufacturer, so keep the password printed underneath for older devices and laptops.

Will one code work for both the 2.4 GHz and 5 GHz bands?

If both radios broadcast the same SSID with the same password — the normal modern setup — then yes, one code covers both and the device picks a band. If your router publishes separate names such as "Guest" and "Guest_5G" with different keys, you need one code per network, which is a good reason to consolidate them.

Does it work with WPA3?

In practice yes, using the WPA setting. Most WPA3 deployments run in transition mode alongside WPA2, and devices negotiate the best they support. A WPA3-only network with older clients is a separate compatibility problem that the QR code neither causes nor solves.

What about WPA2-Enterprise networks with individual logins?

Not a good fit. Enterprise authentication involves per-user identities, an EAP method and often a certificate, and while the URI syntax has extensions for some of that, reader support is unreliable enough that you should not build onboarding around it. Use an MDM profile or a provisioning portal, and reserve QR codes for the pre-shared-key guest network.

My password contains a semicolon. Will it work?

Only if it is escaped as \;, because a bare semicolon ends the field and the rest of the password is silently dropped. The same applies to : , \ and ". Either type the backslash yourself before generating, or switch the guest password to letters and digits and avoid the issue.

Can I make a code for an open network with no password?

Yes — choose No Password, which produces T:nopass and an empty password field. Do not leave the type as WPA with a blank password, as that fails on most devices. Bear in mind that traffic on an open network is unencrypted over the air, whatever the code says.

Do I need to reprint the code after changing the WiFi password?

Yes. The old credentials are baked into the image, so a rotated password makes every printed copy dead. Keep a list of where cards are displayed — tables, cupboard doors, reception, the staff room — and print a date on each one so you can spot the stragglers.

Can I see who connected by scanning the code?

Not from the code, which reports nothing to anyone. Your access point or controller is where that information lives: it can list connected clients, MAC addresses and session data. If you need per-guest accountability, a captive portal with a sign-in is the tool for that, not a QR code.

Related QR code guides