Wi-Fi QR Code

How does it work?

The QR content follows the format WIFI:T:<type>;S:<name>;P:<password>;H:<hidden>;;, which iOS and Android both recognize.

Point the native camera at it and the phone suggests "Connect to network". Handy for handing off the Wi-Fi to a guest.

The password never leaves your device; the QR is just a visual stand-in for the string. Generation is 100% local.

Why use a Wi-Fi QR code instead of typing the password

Sharing a Wi-Fi password used to mean dictating a long string of mixed case letters and symbols while the guest squinted at a fridge magnet, mistyped twice and gave up on mobile data. A Wi-Fi QR removes that friction. You generate a small square, print it once, stick it on the wall, and any visitor joins in three seconds: open the camera, point, tap, done.

The mechanism is simple. The QR code does not store any encrypted token or session. It is just a short text string in a format the camera apps of iOS and Android recognise as a Wi-Fi join intent. The phone decodes it, shows a banner like Join "MyNetwork"?, and tapping that banner is identical to choosing the network manually and pasting the password. The underlying security is unchanged: the phone still performs the normal WPA2 or WPA3 handshake with the access point.

For a household, the QR is a "guests welcome" sticker — you can keep an ugly random 40-character password and never read it aloud again. For a café, restaurant or coworking space the gain is bigger: the staff stops repeating the password all day, and the network can rotate to a new random secret without anyone having to memorise it. For events, hotels and Airbnb rentals the printed QR on the welcome card is by now an expected detail.

The technical format: WIFI:T:<type>;S:<ssid>;P:<password>;H:<hidden>;;

The format is a de facto standard introduced by the ZXing open-source barcode library around 2010 and adopted by every major camera and QR scanner since. It is a single line of ASCII text starting with the literal prefix WIFI: followed by semicolon-separated key/value pairs and terminated by a double semicolon.

WIFI:T:WPA;S:CoffeeGuest;P:bluem0untain42;;

The fields are:

• T: authentication type. Accepted values: WPA (covers WPA, WPA2 and WPA3), WEP (legacy), nopass (open network), and WPA2-EAP (enterprise).
• S: the SSID (network name). Required.
• P: the password. Ignored when T is nopass.
• H: optional boolean (true/false) marking the SSID as hidden, so the phone does not refuse to join when it cannot find the network in a passive scan.

Field order is not strict, but the trailing double semicolon is, because the second semicolon marks the end of the record. An open network with a hidden SSID looks like this:

WIFI:T:nopass;S:EventOpen;H:true;;

Security types: WEP, WPA, WPA2, WPA3 and open networks

The T: field tells the scanning device which authentication handshake to negotiate. Understanding the four families matters because not all of them are safe to deploy today.

WEP (obsolete, 1997)

Wired Equivalent Privacy uses RC4 and is trivially crackable in minutes. Deprecated for over a decade. If you still see WEP on a network, replace the router or update the firmware.

WPA (deprecated, 2004)

A transitional standard built on the TKIP cipher to patch WEP's worst flaws while AES-capable hardware was rolling out. WPA was replaced by WPA2 the same year it was certified. Like WEP, treat it as historical.

WPA2 (mainstream, 2004 onwards)

WPA2 uses AES with CCMP and remains the dominant protocol on home networks. Its main weaknesses are offline dictionary attacks on weak Pre-Shared Keys and the KRACK key reinstallation flaw, both mitigated by patched firmware and strong random passwords. For a Wi-Fi QR code, selecting WPA covers WPA2 correctly.

WPA3 (current standard, 2018 onwards)

WPA3 replaces the four-way handshake with SAE (Simultaneous Authentication of Equals), making offline brute-force attacks impractical, and enforces Protected Management Frames. The QR format has no separate WPA3 token because the type field describes the credential, not the cipher: phone and access point negotiate the strongest mutually supported protocol at join time.

Open networks (nopass)

Open networks have no password, just an SSID. The QR code can still be useful as a captive-portal entry point or to advertise the right SSID when several are nearby. Use T:nopass and omit P: entirely.

Operating system support

Native support is now universal on smartphones:

• iOS 11+ (2017): stock Camera app shows a "Join Network" banner. No extra app needed. iPadOS identical.
• Android 10+ (2019): Camera, Google Lens and Wi-Fi settings all recognise the format. Android 11+ has a QR scanner in Quick Settings.
• Older Android: third-party scanners like Google Lens handle the format.
• Windows 11: limited native support; Phone Link can read it from a phone.
• macOS: no native scanning in Camera; Continuity Camera and iPhone fill the gap.

Special characters and escaping

Because the format uses : as a key separator and ; as a field terminator, any password or SSID containing those characters must escape them with a backslash. The full list of characters that must be escaped is \, ;, ,, " and :.

SSID raw : foo;bar\baz
SSID encoded: WIFI:S:foo\;bar\\baz;T:WPA;P:secret;;

If the SSID consists only of hex digits, the spec recommends wrapping it in escaped double quotes. The generator on this page handles escaping automatically; the rules matter mostly if you build the string by hand.

Privacy: the password is in plain text inside the QR

A QR code is not encryption. It is a 2D barcode any scanner can read, and the Wi-Fi password is stored verbatim. Anyone with a phone camera extracts it in under a second. Consequences:

• Do not post your home QR on social media, even cropped — super-resolution reads surprisingly low-resolution images.
• If you print the QR for a café, accept that any photo of the wall is a credential leak (the alternative — shouting the password — is no better).
• For higher-value networks use a guest VLAN with limited access and rotate on a schedule, or use WPA2-Enterprise with per-user credentials and skip the QR entirely.
• Never reuse a Wi-Fi password elsewhere; if the QR leaks, the damage stays contained.

Typical applications

• Home guest network: laminated card on the fridge.
• Cafés and restaurants: on the menu or framed on the counter.
• Events and conferences: badge backs or the welcome slide.
• Hotels and rentals: welcome card next to the TV.
• Offices and coworking: a sticker on each meeting-room door.
• Schools and libraries: a QR at the front desk replaces a printed list.

FAQ

Does the QR work offline?

Yes. The QR contains SSID and password as plain text; the scanning phone needs no internet to decode it. Internet starts after joining.

Different QR for WPA2 and WPA3?

No. Use T:WPA for both. The cipher is negotiated at join time.

Can it carry IP or DNS settings?

No. Only SSID, password, type and the hidden flag. IP, DNS, proxy and certificates require manual setup or MDM profiles.

Does emoji in the SSID work?

QR codes support UTF-8, so emoji SSIDs encode correctly. Whether router and phone render them depends on Unicode handling. ASCII is safer for guest networks.

How small can I print the QR?

A Wi-Fi string is short, so the QR reads well at 2-3 cm square from 20-30 cm. Smaller than that, raise the error correction level and verify with a real phone before laminating.