The WIFI: payload, field by field
The de-facto WiFi format packs four fields into one string: T is the security type, S the network name, P the password, H marks a hidden network. Two semicolons close the payload.
Special characters are where homemade WiFi codes die. Backslash, semicolon, comma, colon and the double quote must each be escaped with a backslash, or the payload's own separators tear the password apart. A network called Cafe;Guest with password tea\cake:42 encodes as:
This generator applies the escaping automatically — the example is here so you can verify the output, and so you know what went wrong with a code made elsewhere.
WIFI:T:WPA;S:Cafe\;Guest;P:tea\\cake\:42;H:true;;Choosing the security type
Pick WPA for any network using WPA or WPA2 Personal — the value covers both, and it is what almost every home and café router runs. WEP exists for legacy hardware; nopass is for open networks and needs no password at all.
The format predates WPA3 and has no dedicated value for it, and enterprise networks that ask for a username and certificate are outside what this simple string can carry. For a WPA2-Enterprise office network, a QR code is the wrong tool — talk to whoever runs the RADIUS server.
How phones join
Recent iOS and Android cameras recognise the payload, display the network name, and offer to join; the credentials are saved like any manually entered network. Older devices and some third-party scanners show the raw string instead — the password is still readable, just not auto-joined.
Test with a device that has never seen the network. A phone already carrying the credentials may silently do nothing when it scans, which looks exactly like a broken code and isn't.
The password is readable by design
A WiFi code is convenience, not encryption: the password sits in the payload in plain text, and anyone who scans or photographs the code can extract it. Decode any WiFi code with the reader and you will see every field.
Treat the printed code like a printed password, because it is one. Put guests on a guest network, rotate the password on your own schedule, and reprint — codes here are free, so rotation costs you one sheet of paper.
When the phone won't connect
Work through the usual suspects in order: the SSID must match exactly, including case and any trailing space a router UI let slip in; the security type must match what the router actually broadcasts; the hidden-network flag must reflect reality; and on the phone side, forget the saved network before retrying.
If the code was made elsewhere, unescaped special characters in the password are the classic silent killer — decode the image and inspect the P field. If the router settings changed since printing, the paper is stale: reprint.
Printing a code guests can actually scan
A WiFi payload is compact, so the code tolerates small print well — but table tents get scanned from arm's length and wall posters from across a room, and size must follow distance. Keep the quiet zone, keep dark-on-light contrast, and mind glare if you laminate.
Run one printed proof past both an iPhone and an Android before making fifty. The two-minute test catches the case-sensitive-SSID surprise while it is still cheap.
Frequently asked questions
How do I generate a WiFi QR code?
Choose the security type, enter the exact network name and password, flag the network if it is hidden, and download the PNG or SVG. Test with a device that is not already connected.
Is a WiFi QR code free?
Yes. This generator runs in your browser with no account, watermark, or limit — and the code itself never expires.
Does a WiFi QR code reveal the password?
Yes, to anyone who scans it. The payload stores the password as plain text; it is a convenience format, not a security measure. Use a guest network and rotate the password when needed.
Why won't my phone join from the code?
Usually an SSID or password mismatch — case, trailing spaces, wrong security type, or a hidden-network flag that doesn't match the router. Forget the saved network on the phone, verify the fields by decoding the code, and reprint if the router settings changed.
Do guests need an app to scan it?
No. The built-in camera on recent iPhones and Android phones recognises WiFi codes directly. Very old devices may need a scanner app and may only display the credentials.
Build the join record field by field
A Wi-Fi QR code is a structured record, not an encrypted connection ticket. The commonly implemented ZXing form is `WIFI:T:WPA;S:Guest;P:tea2026;H:false;;`: S is the required SSID, T declares the security type, P holds the password, and H marks a hidden network. ZXing documents the field grammar and its WPA2-EAP extensions at https://github.com/zxing/zxing/blob/master/core/src/main/java/com/google/zxing/client/result/WifiResultParser.java . An SSID literally named `Cafe;Guest` needs an escaped semicolon, so `S:Cafe\;Guest` remains one value rather than two fields. Test the exact exported QR on a phone that has forgotten the network; an already-connected handset can make a wrong password look successful. Use the network's configured security mode, including `nopass` only for an open network, rather than guessing from a router label.
Use a guest credential with a rotation plan
The QR image contains the password in recoverable text. A visitor can photograph it, and a standard decoder can reveal the SSID, security type, password and hidden flag without joining the network. Put a guest SSID and a replaceable guest password on public signage; do not expose an administrator or staff-network credential as a convenience feature. In a meeting room with 30 visitors, verify four facts after printing: the SSID preserves case and spaces, the password is unchanged after escaping, the join prompt names the intended network, and a test device reaches only the network it should. When the password changes, replace the physical QR artwork as well as the access-point setting. A static image cannot rotate itself. Enterprise Wi-Fi with EAP identities, certificates, device policy, captive portals, or VLAN assignment needs its own managed enrolment process; a basic QR payload cannot certify those conditions even when a phone recognises it.
Diagnose the join result without guessing
A code that opens a join prompt but fails authentication usually points to SSID, password, security-mode, or captive-portal policy—not to the QR geometry. Compare the decoded fields with the access-point configuration before regenerating. A code that will not be recognised at all may have a malformed escape sequence or be handled by a scanner that only displays text. Keep one plain QR export as a control, then test the production sign. This separates a structured-data fault from glare, scale, or a cropped quiet zone. Do not work around a staff-network failure by publishing that password on a guest sign; correct the network contract instead.