WiFi QR Codes: How They Work and How to Make One

A WiFi QR code is a square somebody points a camera at to join your network. No reading a password out loud, no guests squinting at a card taped behind the till. The network name and the password are encoded in the pattern itself, which is why it works with no app, no account and no internet connection at the moment of scanning.

That last point is the one most guides skip. The credentials are in the picture. Not on a server somewhere, not behind a link — printed into the black and white squares, where anyone who scans the code can read them. That single fact decides everything else in this guide: why the code cannot expire, why changing your password breaks it, and why you should think before you tape one to a window.

This guide covers the format itself, the escaping rule that silently breaks codes, how to print one that actually scans, and when handing one out is a bad idea. If you just want to make one, the free QR code generator does it in the browser — your password is typed into the page and never sent anywhere.

What a WiFi QR code actually is

A QR code is a container for a short piece of text. That is the whole of it. What makes a WiFi code different from a link code is not the pattern — it is the text inside, which follows a convention phone cameras recognise as "these are network credentials, offer to join".

The credentials are inside the pattern, not on a server

Scan a WiFi QR code with a plain barcode-reader app rather than the camera, and you will see the raw text: your network name and your password, in the clear. Nothing is encrypted. Nothing is looked up. The phone reads the string, recognises the shape of it, and offers to join.

This is genuinely useful. It means the code works when your guest has no mobile data, it works forever with no service behind it, and it works on a printed card with no power. It also means the code is exactly as secret as the paper it is printed on.

Why there is nothing to subscribe to

Most QR code pages you will find are published by companies selling dynamic QR subscriptions — codes that encode a short link to their server, which then redirects wherever you point it. Those are genuinely useful for a poster campaign where the destination changes.

They make no sense for WiFi. A dynamic code has to reach the internet to resolve, and a guest scanning your WiFi code has no internet yet — that is the entire reason they are scanning. A WiFi code is necessarily static, which means it has no expiry date, no dashboard and no monthly fee. Any page telling you otherwise is selling something.

The format, in plain terms

The convention comes from ZXing's barcode contents specification, which is the de facto reference every phone and scanner library follows. A WiFi string looks like this:

WIFI:T:WPA;S:mynetwork;P:mypass;;

Four fields, semicolon-separated, with a double semicolon closing it. Order does not matter.

What T, S, P and H mean

• T — the security type. WPA covers WPA, WPA2 and WPA3-transition networks. The other accepted values are WEP, WPA2-EAP and nopass.

• S — the network name (SSID). Required, and case-sensitive.

• P — the password. Ignored when the type is nopass.

• H — set to true only if the network is hidden. Leave it out otherwise.

For an open network with no password, the whole thing collapses to WIFI:T:nopass;S:cafe-guest;; — the P field is simply absent.

The escaping rule that breaks codes

This is the part no other guide seems to mention, and it is the most common reason a hand-built WiFi code fails.

The characters \, ;, ,, " and : are structural — they separate the fields. If your password contains any of them, each one has to be escaped with a backslash, or the string breaks apart at the wrong place. The specification is explicit: these "should be escaped with a backslash (\) as in MECARD encoding."

So a password of p:ss;word has to be written P:p\:ss\;word. Get it wrong and the phone reads a truncated password, or refuses the string entirely — and the failure is silent, because the code still looks like a perfectly good QR code.

One ordering trap if you are building the string by hand: escape literal backslashes first, before the other characters. Do it the other way round and you end up escaping your own escape characters.

A generator handles all of this for you. That is the main argument for using one over typing the string yourself.

Hidden networks

If your network does not broadcast its name, add H:true. The phone then knows to look for a network it cannot see in the list rather than giving up.

Worth knowing: ZXing's own documentation notes that the H field "was mistakenly also used to specify phase 2 method in releases up to 4.7.8" — so a very old scanner may misread it. In practice this affects almost nobody, but it explains the occasional hidden-network code that works on one phone and not another.

How to make one

The QR code generator builds the string, escapes it correctly, and renders the code without any of it leaving your browser. That matters more here than for any other QR type: you are typing a password, and a tool that sends it to a server to render an image has just put your network credentials in somebody's log file.

Step by step

1. Choose the WiFi type.

2. Enter the network name exactly as it appears — capitals, spaces, hyphens and all. SSIDs are case-sensitive, and this is the single most common typo.

3. Enter the password, and pick the security type. WPA is right for almost every modern router.

4. Download as PNG for a screen or a quick print, or SVG if it is going to a printer or a sign that needs to stay sharp at any size.

Colours and a logo without breaking the scan

QR codes tolerate damage by design. Each one carries redundant data at one of four levels, and DENSO WAVE — who invented the format — puts the restoration rates at roughly 7% for level L, 15% for M, 25% for Q and 30% for H.

Read that carefully, because it is widely misquoted. Those percentages are a proportion of total codewords, not of the image area, and the three corner finder patterns are not protected at all. "Level H means I can cover 30% of the code with my logo" is wrong, and it is how people end up with a beautiful code that no phone will read.

What actually works: keep a logo small and centred, and raise the error correction level when you add one. This tool does that for you — adding a logo pushes the level to Q automatically, because a code that silently fails to scan is the worst possible outcome when it is already printed on a hundred flyers.

On colour: dark pattern on a light background, always. The scanner is looking for contrast, and it expects the dark modules to be the data. A light code on a dark background fails on many readers, and a low-contrast pairing — mid-grey on beige, navy on black — fails on most.

A QR code on a document works the same way, with a different payload: adding a QR code to an invoice puts a payment link or contact details in the same square.

How people scan it

No app needed on any current phone.

On iPhone, the built-in Camera app has recognised QR codes since iOS 11. Point it at the code and a notification drops down offering to join the network. If nothing happens, check Settings → Camera → Scan QR Codes is switched on.

On Android, the camera app handles it on Android 10 and later; on some devices it lives in Google Lens instead. Android can also work in the other direction — open your WiFi settings, tap the connected network, and choose Share to have the phone generate a QR code of the network it is already on. Useful when you are standing next to someone, less useful for a printed sign.

Is it safe to put your WiFi password in a QR code?

It depends entirely on which network, and on where the code ends up.

Anyone who scans it can read the password

Say this part plainly: a WiFi QR code is not encryption and offers no protection at all. Many scanner apps display the decoded text before doing anything with it, so the password appears on screen in plain sight. A photo of the code, taken from across a room, is a copy of your password.

A code taped inside a café is fine. A code taped to a window facing the street is your home network password, readable from the pavement.

Use the guest network

The right answer for almost every situation is to put visitors on a guest network and make the QR code for that. Nearly every router made in the last decade supports one. It gives you:

• A password you can change without re-pairing your own devices.

• Separation from the network your laptop, NAS and printer are on.

• Client isolation on most routers, so guests cannot see each other's devices either.

Then, if the code leaks, the cost is that a stranger gets internet access — not a route to your file shares.

Where the code is generated matters

Most online QR generators build the image on their server, which means your network name and password are sent to a company you have never heard of, and land in a request log. For a link that is harmless. For a password it is not.

Check whether the tool works offline as a test: load the page, turn off your connection, and see whether it still generates. If it does, the work is happening in your browser. This one does.

Printing it: size, contrast and quiet zone

A WiFi string is short — usually 40 to 80 characters — so the code stays low-version and coarse, with large modules that scan easily. Capacity is not a concern here; the format tops out at 177×177 modules and thousands of characters, which a network password will never approach.

Three things decide whether a printed code scans:

• Size. The usual rule of thumb is that a code should be about a tenth of the distance it will be scanned from — a code read at 30 cm wants to be around 3 cm across. This is industry convention rather than anything in the standard, so treat it as a starting point and test.

• Quiet zone. The blank margin around the code is part of the code. Crop it tight against a border or a photo and scanners lose the edge. Leave clear space all the way round.

• Contrast and finish. Matte beats gloss under a ceiling light. A glossy laminate with a lamp reflecting off it is a code nobody can scan, no matter how well it was generated.

Test the printed copy, not the file on screen. Print one, scan it with a phone that has never been on the network, and only then print a hundred.

When it stops working

You changed the password

The most common cause, and there is no fix but a new code. The password is inside the pattern; changing it at the router makes every printed copy wrong. Make a new code and replace the printed ones — and if the password changes often, this is another argument for a guest network with a password you set once.

The network name is slightly wrong

SSIDs are case-sensitive and often contain characters you would not guess from looking — a trailing space, a non-breaking hyphen, a 5G suffix. Copy it from the router's admin page rather than typing what you remember.

WPA3-only networks and older phones

A network running WPA3 exclusively, rather than in WPA2/WPA3 transition mode, can refuse older devices regardless of the QR code. If one phone joins and another does not, this is worth checking before blaming the code.

The code itself will not read

If no phone reads it at all, the problem is almost always physical: too small, too little contrast, no quiet zone, a logo too large, or a blurred print. Generate it again as an SVG and print from that — a PNG scaled up past its original size goes soft, and soft edges are what scanners fail on.

A short answer to the question behind all of this

A WiFi QR code is a piece of text in a square: the network name, the password and the security type, readable by anyone who scans it and working forever because there is nothing behind it to stop working. Put your guest network in one, print it large enough with a clear margin, test it before you print a hundred, and generate it somewhere the password never leaves your own device.