What a WiFi QR code actually contains
A WiFi QR code is not a link and it does not connect to anything. It encodes a short, structured string that phones recognise and hand to the operating system's network settings. The format looks like this:
WIFI:T:WPA;S:CoffeeBar Guest;P:flatwhite2024;H:false;;
Four fields do all the work:
| Field | Meaning | Accepted values |
|---|---|---|
T |
Security type | WPA (covers WPA/WPA2/WPA3), WEP, nopass |
S |
Network name (SSID) | Exactly as broadcast, case-sensitive |
P |
Password | Omitted entirely when T:nopass |
H |
Hidden network | true only if the SSID is not broadcast |
The double semicolon at the end is part of the spec, not a typo. Enter your details in the generator above and it assembles this string for you.
The escaping rule that breaks most hand-made codes
If your SSID or password contains any of \ ; , : ", each one must be prefixed with a backslash. A password of pa;ss\word has to be encoded as pa\;ss\\word. Miss this and the phone will read the ; as a field separator, truncate your password, and fail to connect — usually with a generic "incorrect password" message that gives you no clue where the problem is.
This is the single most common reason a WiFi QR code silently fails. The generator above handles escaping automatically, which is worth knowing if you have previously tried to build one of these by hand or with a template.
Why WiFi codes are denser than most
The payload is longer than it looks. A 20-character SSID and a 16-character password produce a string of around 60 characters once the field markers are added. Passwords are usually mixed case with symbols, which forces the encoder into byte mode (8 bits per character) rather than the more efficient alphanumeric mode.
The practical consequence is a physically busier code with more modules packed into the same square. That matters when you print it small. A WiFi code needs more physical space than, say, a short URL code carrying the same visual weight.
Printing one that actually scans
- Minimum size: 3 × 3 cm for a typical WPA2 password on a table card. Smaller works in good light with a recent phone, but you are gambling on your guests' hardware.
- Keep the quiet zone. The QR spec requires four modules of blank margin on all sides. Designers routinely crop this to fit a layout, and it is the second most common cause of scan failure after escaping errors.
- Dark code on light background. Inverted codes — light modules on dark — are read by some scanners and rejected by others. There is no upside worth the compatibility risk.
- Matte, not gloss. Glossy lamination under café spotlights creates specular highlights that blow out sections of the code. Matte laminate costs the same and scans reliably.
- Test with two phones, one iPhone and one Android, before you print 200 of them.
Platform behaviour you should expect
iOS 11 and later reads WiFi codes directly from the native Camera app and shows a "Join Network" banner. The user taps it, then confirms in a system dialog. Two taps total.
Android 10 and later supports it from the Camera app on most manufacturer skins, and every version since Android 6 supports it through Google Lens. Android also generates WiFi QR codes natively — Settings → Network → your network → Share — which is a good way to verify that your printed code matches what the phone expects.
Older devices and locked-down corporate phones may need a dedicated scanner app. If you are putting a code in a hotel room, add a line of small print naming the network so someone can always join manually.
WPA3 and the compatibility question
The T:WPA value covers WPA, WPA2 and WPA3 in practice — the phone negotiates the actual handshake with the router, and the QR code only declares the broad family. There is no separate WPA3 token in widespread use.
Where WPA3 does cause trouble is on routers running a WPA2/WPA3 transition mode with an SSID that some older client devices refuse to join. That is a router configuration issue rather than a QR code issue, but it presents to the user as "the QR code doesn't work," so it is worth ruling out if a code scans and then fails to connect.
The security question, answered honestly
Anyone who can see the code can join the network. A photograph of a table card from across the room is enough. Treat a printed WiFi QR code as equivalent to writing the password on the wall, because functionally that is what it is.
That is completely fine for a guest network and a bad idea for your main one. The distinction matters more than most small businesses realise: devices on the same network segment can often reach each other. A guest who joins your primary network is on the same LAN as your point-of-sale terminal, your network printer, and any unpatched device you have forgotten about.
Set up a separate guest network on your router — nearly every consumer router made in the last decade supports this, usually labelled "Guest Network" or "Guest WiFi." Enable client isolation if the option exists. Then generate the QR code for that network only.
Rotate the guest password periodically and reprint. Because the code is trivial to regenerate, changing the password is a printing cost rather than a support burden.
Where these earn their keep
- Cafés and restaurants — table tents, the back of the menu, or a small card in the bill folder
- Hotels and short-term rentals — the welcome booklet, or framed on the desk alongside the checkout time
- Offices — reception and each meeting room, so visitors stop interrupting people to ask
- Conferences and venues — on signage at the entrance, sized for a 2 metre scan distance (which means roughly 20 cm across)
- Home — inside a kitchen cupboard door, which sounds trivial until the fourth houseguest asks
Frequently asked questions
Why does my code scan but say the password is incorrect?
Almost always an escaping problem: a semicolon, colon, comma, backslash or double quote in the SSID or password was not escaped with a backslash. Regenerate it with the tool above rather than editing the string by hand. The other possibility is a trailing space in the SSID field that you cannot see.
Does it work on iPhone and Android?
Yes — iOS 11 and later reads WiFi codes from the built-in Camera app, and Android 10 and later does the same on most devices. Older Android phones can use Google Lens. A small number of managed corporate devices block automatic network joining entirely.
What if I change my WiFi password?
The old code stops working immediately and cannot be updated — the password is baked into the image, not fetched from anywhere. Generate a new code and reprint. This is why guest networks with rotating passwords are worth the setup effort.
Can I make a QR code for a hidden network?
Yes. Set the hidden flag so the code carries H:true, which tells the phone to probe for the SSID rather than expecting to find it in the broadcast list. Without this flag a hidden network will not connect even though the code scans correctly.
Is my password stored on your servers?
No. The code is assembled and rendered in your browser using JavaScript — the network name and password are never sent to us, and there is nothing on our side to store or leak. You can verify this by opening your browser's network inspector while you generate a code.
How small can I print it?
3 × 3 cm is a safe floor for a typical WPA2 password at arm's length. Longer passwords produce denser codes that need more space. The general rule for QR codes is a 10:1 ratio of scan distance to code width, so a code meant to be read from 2 metres away should be about 20 cm across.
Can someone extract my password from the printed code?
Yes, trivially — any QR scanner app will display the raw text including the password in plain form. There is no encryption in the format. Assume that anyone who photographs the code has your password, and place it accordingly.