How to make a Wi-Fi QR code (and what the string actually contains)

What a Wi-Fi QR code actually is

A Wi-Fi QR code is a QR code whose payload is a short line of text describing a network. When a phone decodes it and sees that the text begins with WIFI:, it stops treating the string as text and starts treating it as a join request: it reads the network name, the security type and the password, and offers to connect.

There is no service in the middle, no account, and no encryption beyond what the Wi-Fi network itself uses. The QR code is a font your camera can read, and the thing written in it is your password. Everything in the security section follows from that one fact.

How do you make a Wi-Fi QR code?

Five steps, about a minute. The one people get wrong is the second: SSIDs are case-sensitive, so “Cafe Guest” is a different network from “cafe guest”.

1. Step 01

   Choose the Wi-Fi type

   Open the generator and pick Wi-Fi as the QR type, so the fields match what a phone expects.

2. Step 02

   Enter the exact SSID

   Type the network name exactly as it is broadcast, including capitals and spaces. SSIDs are case-sensitive, so check it against your router rather than typing from memory.

3. Step 03

   Pick the security type

   Choose WPA for almost every modern network — it covers WPA2-Personal and WPA3-Personal alike. Use nopass only for a genuinely open network.

4. Step 04

   Enter the password

   Type it exactly. Semicolons in particular need escaping, which the generator handles for you.

5. Step 05

   Test, then export

   Scan the on-screen preview with a real phone before printing, then export SVG or PDF for print and PNG for screens.

What does the WIFI: string contain?

Four fields, each followed by a semicolon, with one extra semicolon closing the string:

WIFI:T:WPA;S:Cafe Guest;P:flat white 42;;

It is worth knowing this, because every failure mode below is a failure to produce that string correctly.

Two conventions you will see in the wild are not in that specification. nopass and WEP come from ZXing’s original 2010 format; the Wi-Fi Alliance does not define WEP at all, and says to omit the T field entirely for an open network. Both still work on current phones.

A consequence worth noting before you print: longer SSIDs and passwords mean more characters, a denser grid, and smaller modules — so a network with a 30-character password needs a larger printed code than one with an 8-character password.

Which characters must be escaped?

The semicolon is the one genuinely structural character — it separates fields — and there are two authorities that disagree about the rest.

• The de facto format, as ZXing defined it in 2010 and as most phones still implement it, asks for a backslash in front of \, ;, ,, " and : anywhere inside an SSID or password.
• The Wi-Fi Alliance specification instead percent-encodes the semicolon as %3B and treats the other four as ordinary text — but Android does not parse percent-encoding when scanning.

So backslash escaping is what actually works today, and the semicolon is the one that bites either way. A password of guest;2026 must be written guest\;2026. Without the backslash, the phone reads the password as guest, tries to join, and fails with a generic “incorrect password” error that tells the user nothing useful.

One more edge case: if your SSID consists entirely of hexadecimal digits — say, C0FFEE — some parsers will read it as hex rather than literal text. The ZXing format allows a quoted form to disambiguate it, but the Wi-Fi Alliance specification has no quoted form at all, so support is patchy. If your network name looks like hex, test carefully or rename it.

Does it work on iPhone and Android?

On iPhone, yes, straight from the Camera app. On Android it depends where you scan — which is why you should print the password as text underneath regardless.

What Android 10 actually introduced was Wi-Fi Easy Connect and the Settings-based scanner, not camera-app support. That distinction matters in practice: a guest who points the stock camera at your code and gets nothing has not hit a broken code, and a line of printed text rescues the moment.

Is a Wi-Fi QR code secure?

No — and it is not meant to be. Because the password is the payload, the code is not a scoped credential: it is not time-bound, it cannot be revoked, and it does not know who scanned it. Anyone who photographs it keeps it.

That is genuinely fine for the case it was designed for: a guest network in a café, an office lobby, a holiday rental. It is a bad idea for the network your file server, your printer and your security cameras share. The practical rules:

• Put the code on a guest network, isolated from your main LAN. Most consumer routers support one — look for “Guest network” in the admin panel.
• Assume the code will be photographed and shared. Someone will post it to social media with your table setting in the background.
• Place it where you would be comfortable writing the password in marker pen. A window facing the street is not that place; a table tent inside is.
• Rotate the password on a schedule that matches your risk, and accept that rotating means reprinting.

Printing it so it actually scans

Wi-Fi codes are usually printed small — a table tent, a card by the till, a sticker on a router — which puts them at the edge of what a camera can resolve. Three things matter:

• Size. At least 2.5 cm (1 in) across for arm’s-length scanning, and larger if the password is long.
• Quiet zone. Four empty modules on every side. Designers crop this to tidy up a card, and it reliably breaks the code.
• Vector export. SVG or PDF, not PNG — a vector file has no resolution to get wrong when the printer scales your artwork.

All three are covered properly in the print guide. And if you are weighing whether a static code is right at all, the static vs dynamic comparison lays out what you gain and give up.