WiFi QR Code Generator - Share Network Passwords Without Typing Them Out

What a WiFi QR Code Actually Contains

A WiFi QR code is not a link or a website. It is a short text string formatted in a very specific way that phones know how to recognize. When you scan it, your camera app sees the string, reads the prefix, realizes it describes a network, and offers to connect you directly. No app, no server, no cloud service involved. The entire instruction is encoded into the black and white pattern itself.

This matters because it means your password is not stored anywhere online. The QR code is the password, printed onto paper or a screen. Whoever can see the code can extract the password just by scanning it. That is both a feature (no backend, works offline, cannot be revoked by some third party) and a limitation we will come back to later.

The WIFI String Format, Line by Line

Every valid WiFi QR code encodes a string that looks something like this:

It looks cryptic, but every piece has a purpose:

• WIFI: the prefix that tells the scanner this is a network credential, not a URL or phone number.
• T:WPA sets the encryption type. WPA covers WPA, WPA2, and WPA3. Other valid values are WEP or nopass for an open network.
• S:MyHomeNetwork is the SSID, meaning the network name. Case sensitive.
• P:coffee-beans-2026 is the password. Also case sensitive, and this is where most problems happen.
• H:false marks whether the network is hidden. Skip this field entirely for non-hidden networks.
• ;; the double semicolon at the end is the terminator. Leaving it off breaks the scan on some phones.

Field order can be rearranged, and fields are separated by single semicolons. What cannot be skipped is the prefix and the trailing double semicolon. If you are generating the code by hand, those are the two things to double-check before printing anything.

Picking the Right Encryption Type

The T field accepts three values, and picking the wrong one will cause the phone to attempt a connection that immediately fails with a vague "incorrect password" message. That is maddening because the password is fine, the encryption type is wrong.

For the open network case, set T:nopass and leave the P field empty or drop it entirely. Do not put a blank string like P:; because some scanners will still prompt for a password. And if your router is still on WEP in 2026, changing the encryption is more urgent than generating a QR code.

Handling Special Characters and Spaces in Passwords

This is the single biggest reason hand-crafted WiFi codes break. The format uses semicolons, colons, commas, backslashes, and double quotes as delimiters or escape characters. If your password contains any of them, they have to be escaped with a backslash or the string falls apart mid-parse.

The five characters that need escaping inside the SSID or password fields:

• Backslash becomes \\
• Semicolon becomes \;
• Comma becomes \,
• Colon becomes \:
• Double quote becomes \"

So a password like pass:word;1 has to be written as pass\:word\;1 inside the QR string. Spaces are fine, they need no escaping. Unicode characters and emojis technically work but a lot of older scanners choke on them, so if your SSID is literally "Cafe Mocha Pro" you are fine but "Cafe Mocha Pro" is safer than one with an accented e.

The real lesson is to let a generator build the string for you. Typing escape sequences by hand for a long password is how typos happen. A proper QR code generator handles all the escaping automatically. While you are at it, the error correction level matters too - a long password pushes the code into a denser version, and a stray smudge on a fridge card can render it unreadable at Level L. See QR code error correction levels explained for which level to pick for printed WiFi cards.

Hidden Networks and the H Flag

Some people hide their SSID so it does not appear in the list of nearby networks on a phone. That is not really a security measure, a determined attacker can still see hidden networks, but it does stop the network from showing up in lists. For WiFi QR codes, hiding the SSID changes how the phone has to connect.

When a phone scans a code for a hidden network, it will not find the SSID in its list of visible networks. The connection attempt has to tell the device explicitly that this network is hidden and should be searched for. That is what the H field does. Set H:true for hidden networks, and the phone will add it as a hidden SSID. Without that flag, the phone scans, sees nothing matching the name, and the connection silently fails.

If your network is not hidden, the cleanest option is to leave the H field out entirely. Setting H:false works too, but the field is optional and some older scanners behave inconsistently with it present.

Which Phones Actually Auto-Connect

Support for WiFi QR codes is much better than it used to be, but it is not universal. Here is the state of things as of 2026:

• iPhone (iOS 11 and later) supports WiFi QR codes natively through the Camera app. Point the camera, a banner appears, tap it, done. No app needed.
• Android 10 and later supports them through the Camera app on most manufacturer skins. Samsung, Google Pixel, OnePlus, Xiaomi all handle it. Some older Android versions require using the Google Lens feature or a dedicated QR scanner app.
• Older Android (below 9) generally needs a third-party QR scanner. The built-in camera will not recognize the WIFI prefix.
• Desktop and laptop scanning is unusual. If you need a guest with a laptop to connect, show them the password directly, a QR code on a laptop workflow is more hassle than it is worth.

For a cafe or home setting, assume iPhones and modern Androids will scan cleanly. If you have guests on ancient phones, keep a paper password backup nearby just in case.

Where to Place the Code for Actual Use

WiFi codes have a specific placement problem that URL codes do not. People scan a menu QR code once per visit, then leave. A WiFi code gets scanned by someone who is standing in your space holding their phone in one hand and a bag or drink in the other. The ergonomics of that moment matter more than the technical specs.

A few placement choices that work better than the obvious ones:

• Kitchen counter card for homes. Most guests put their phone down on the kitchen or dining counter at some point. A small stand with the code there gets scanned naturally without anyone feeling like they have to hunt for it.
• Back of the receipt or the bill for cafes. Some cafes I have visited print the WiFi QR right on the receipt. It is a clever move because the receipt is already in the customer's hand and they do not need to look around.
• Inside the door for Airbnbs. Guests check the back of the door or the welcome area within the first two minutes of arriving. That is the moment they want the WiFi.
• Never above the router. The router is usually tucked somewhere inconvenient. Asking guests to walk over to it is the opposite of what a QR code is supposed to solve.

One detail that trips people up: matte paper scans far more reliably than glossy or laminated surfaces, especially under ceiling lights. If the code is going to live under a spotlight or behind glass, test scanning it from the angle people will actually hold their phone, not from directly above. Reflections kill scans in ways that are hard to predict until you are already printing the tenth copy.

The Security Trade-offs Nobody Tells You About

This is the section most WiFi QR tutorials skip. Here is the uncomfortable truth: the QR code is your password, in plain text, readable by any phone with a camera. The encoding is public. There is no decryption, no key exchange, no server-side validation. If someone can see the code, they can scan it and now they have your WiFi password. Forever.

That is fine for most situations. Your friends and family at home, customers in your cafe, guests at a party. These are people you are happy to give the password to anyway. The QR code just saves them typing.

But a few situations deserve a second thought:

• A photo of your fridge on social media can include the WiFi QR code. Now anyone who zooms in has your password. If you post photos of your home, make sure the code is not in frame, or use a separate guest network for the code.
• Walking by a cafe window can be enough to scan a code if it is displayed facing out. If that code gives access to your point of sale system, that is a problem.
• Coworking spaces and open offices should almost always use a separate guest network for the QR code, keeping the main business network on a password shared only verbally or through a credential manager.

The clean workaround for most of these is to set up a guest network on your router and generate the QR code for that network only. Most modern routers support this in the admin panel, and it isolates visitors from your main LAN. Your smart TV, laptop, and NAS stay on the main network. Guests go on the guest network. The QR code only unlocks the guest side.

Enterprise WiFi and Why QR Codes Do Not Work

If your office uses enterprise WiFi (WPA2-Enterprise or WPA3-Enterprise, sometimes called 802.1X), the standard WIFI string format does not support it. Enterprise authentication uses individual usernames, certificates, and EAP methods, none of which fit into the simple S/P/T field structure. A QR code cannot carry all that.

There are a few workarounds people try:

• Apple Configuration Profiles are a better fit for enterprise iOS deployments. You create a .mobileconfig file with the full network settings and distribute it through MDM or email.
• Android has similar device provisioning flows through work profiles and EAP QR codes, but support varies wildly by vendor.
• Passpoint / Hotspot 2.0 is the standards-based answer for seamless enterprise onboarding, though deployment is still limited to larger organizations.

For small business or home office WiFi with a shared password, stick with the basic WIFI string format. For true enterprise authentication, QR codes are the wrong tool.

Generating Your Own in Under a Minute

Once the theory is out of the way, the actual setup is quick. For a normal WPA2 or WPA3 home network you type in the SSID (exactly as it appears on your router, case matters), pick WPA as the encryption type, paste in the password, and download the image. A good generator will handle the escaping for you, which is the main thing to outsource. Typing escape sequences by hand is how typos happen and typos do not get caught until someone complains that the scan is not working.

The step most people skip is testing. Before you print a stack of cards or stick the code to the wall, forget the WiFi network on your own phone, scan the code, and confirm that it reconnects cleanly. If it works on one phone it will generally work on every other phone running a recent OS. If it does not, you have a problem to fix now rather than after ten guests have already failed to scan it.

For something as sensitive as a network credential, the generator you use should build the QR code locally in your browser rather than sending your SSID and password to some server. Open the browser devtools network tab while you generate the code if you want to verify, a local-only generator will not make any network requests after the page has loaded.

Frequently Asked Questions

Can I change my password without regenerating the QR code?

No. The password is literally baked into the pattern. If you rotate the password, you have to regenerate and reprint the code. That is actually a feature in disguise, a rotated password immediately invalidates every printed code, which is useful after a break-in or after staff turnover.

Do WiFi QR codes expire?

They do not have a built-in expiration. They work as long as the network they describe exists with the same name, password, and encryption type. Change any of those and the code stops working. That is why putting the code on a laminated card is fine, you will reprint it only when you rotate the password, not because the code "wore out."

Can a QR code connect to 5 GHz and 2.4 GHz bands separately?

Only if the two bands are configured as separate SSIDs with different names. If your router broadcasts both bands under the same SSID (band steering), a single QR code works for both. The phone decides which band to join based on signal strength. If you have split SSIDs with different names like MyNetwork and MyNetwork-5G, you will need two separate codes or just pick whichever band most devices should use.

What happens if someone scans the code but cannot connect?

Usually a generic "unable to join network" error, which is unhelpful. The most common causes are an incorrect encryption type in the QR code, a network name typo (case matters), special characters in the password that were not escaped properly, or the phone being out of range of the actual router. Regenerate with a proper tool, double-check the SSID spelling, and test with your own device first.

Can I include guest WiFi instructions along with the code?

Yes, and you should. A printed card with the QR code plus a small line saying "Scan to connect to GuestNet" plus a tiny text fallback with the actual password below is the gold-standard layout. Some guests will have phones that cannot scan WiFi codes, and giving them the password in readable text means they are not stuck. The QR is the fast path, the text is the backup.

Is it safe to generate the QR code on a website?

Only if the site builds the code in your browser and does not send the SSID and password to a server. Many free online generators phone home with whatever you type. Always use a tool that explicitly says it processes data client-side, or just use the browser developer tools network tab to check whether anything is being uploaded. A good browser-based QR generator does all the work locally.

Can the QR code store multiple networks?

The standard WIFI format only supports one network per code. If you have multiple networks (a main one and a guest one, or one per band), you will need separate codes. Some vendor-specific extensions exist but compatibility is inconsistent across iOS and Android, so stick with one network per code.