Wi-Fi QR Code: Format, Escaping and How to Make One

What a Wi-Fi QR code does

A Wi-Fi QR code stores the network name, the security type and the password in a short text string. When a phone camera reads it, the operating system recognises the WIFI: prefix and offers a single tap to join the network. No app, no spelling out a 16-character password across a noisy cafe, and no printed password sheet that guests have to type character by character.

The code is static: the network details are inside the image, so it works offline and never expires. That also means changing the password requires printing a new code, which is worth remembering when you decide how many to laminate. You can create one for free at [qrsvg.app](/) by choosing the Wi-Fi tab, and the rest of this guide explains exactly what the generator puts into the code and how to print and place it well.

The WIFI: string format explained

The format was introduced by the ZXing barcode project and is now supported natively by iOS and Android. A complete payload for a typical protected network looks like this: WIFI:T:WPA;S:CoffeeHouse;P:latte2026;H:false;;. Each field is a letter, a colon, the value, and a semicolon; the payload ends with an extra semicolon after the last field.

• T: is the security type: WPA for WPA, WPA2 and WPA3 personal networks, WEP for legacy WEP, or nopass for an open network.
• S: is the SSID, the network name exactly as it appears in the Wi-Fi list, including capital letters and spaces.
• P: is the password. Omit the field entirely for open networks.
• H: is true for a hidden network that does not broadcast its SSID; it can be omitted or set to false for a normal network.
• The double semicolon ;; at the end terminates the record. Without it some scanners ignore the last field.

Escaping special characters

Because semicolons, colons and commas have meaning inside the format, a network name or password that contains one of them has to be escaped, otherwise the scanner splits the string in the wrong place and the join fails with an incorrect password error. The escape character is a backslash. The characters that need it are ;, ,, :, \ itself and the double quote, which is written as \". So a password of a;b:c is encoded as P:a\;b\:c; and a password containing a literal backslash is encoded with \\.

There is one more trap. If your SSID or password consists only of hexadecimal characters (0 to 9 and a to f), some readers may interpret it as a hex-encoded value instead of the literal text. The convention is to wrap such values in double quotes inside the payload, for example S:\"deadbeef\";. The Wi-Fi generator on qrsvg.app applies these escaping rules for you; the point of knowing them is to understand why a code built by hand or by a spreadsheet formula might scan but refuse to connect.

Passwords with emoji or non-Latin characters are technically allowed by the QR standard (the payload is encoded as UTF-8 bytes) but support varies by phone, and they make the code denser. Plain ASCII passwords of 12 to 20 characters are the safe zone for a printed code.

Security types: WPA, WPA2, WPA3, WEP and open networks

The T: field is coarser than the settings page on your router. WPA, WPA2 and WPA3 personal all use T:WPA; the phone negotiates the actual protocol with the access point when it connects, so you do not need to and cannot specify WPA3 separately. T:WEP exists for old hardware but WEP has been broken since 2001, and modern phones increasingly refuse to join WEP networks at all, so if your router still uses it, upgrading it is a better fix than a QR code.

Open networks use T:nopass and no P: field: WIFI:T:nopass;S:Library Guest;;. Phones will join but will typically warn that the network is unsecured. Networks that require a captive portal (a login page after connecting) still work with a QR code; the code handles the join, and the browser or a system prompt then opens the portal.

Enterprise networks that use WPA2-Enterprise or WPA3-Enterprise with a username and certificate (802.1X) are not supported by the standard format. There is an extended syntax with E: and I: fields used by some Android versions, but iOS does not read it, so for office networks the practical approach is a separate guest SSID with a normal shared password.

Hidden networks

A hidden network does not appear in the Wi-Fi list, so users normally have to type the SSID by hand as well as the password. Setting H:true in the payload tells the phone to look for that specific SSID even though it is not being broadcast. It is one of the most convenient uses of a Wi-Fi QR code, because it removes the two hardest steps at once.

Two caveats. Hidden SSIDs add no meaningful security, since the name is transmitted in the clear whenever a device connects, so do not hide a network for that reason. And some older Android versions ignore the H: flag and fail silently on hidden networks, so test the printed code with the phones your guests actually carry.

Which phones can scan Wi-Fi QR codes

iPhones and iPads running iOS 11 or later (September 2017 onward) read Wi-Fi codes with the built-in Camera app: point the camera, tap the notification, and the device joins. Android added native support in the system camera and in the Wi-Fi settings scanner with Android 10 (2019); many manufacturers shipped it earlier through their own camera apps, and Google Lens handles it on almost any Android phone regardless of version. Android also has the reverse feature: a device already connected to a network can display a QR code from Wi-Fi settings for others to scan.

Laptops are the weak spot. Windows and macOS do not natively join a network from a QR code, so a printed SSID and password line under the code is still worth including for laptop users. Newer versions of Windows 11 can scan Wi-Fi codes from the Settings app on devices with a camera, but do not count on it.

Printing for guest rooms, cafes and offices

A typical Wi-Fi payload is 40 to 70 characters, which lands in QR version 3 or 4 (29 or 33 modules across) at the default error correction level M. That is a comfortable density: a 3 cm code scans easily from arm's length, and 5 cm works from across a small table. Follow the general rule that the code should be at least one tenth of the scan distance, and see the size and print guidelines for the numbers behind it.

Print in dark modules on a light background, keep the default quiet zone of 2 modules or more, and leave the design plain where the code sits. If you want the card to match a brand, style the module and eye shapes rather than lowering contrast, and download the SVG so the sign or table tent stays sharp at any size. Matte lamination beats glossy because glare from ceiling lights is the most common cause of scan failures in restaurants.

• Hotel rooms: a small framed card on the desk plus one near the bed; add the SSID and password as text for laptop users.
• Cafes and restaurants: table tents or a sticker on the menu; use the same card style as your menu QR codes.
• Offices and coworking: a poster in reception and meeting rooms pointing to the guest network only.
• Events: on the badge lanyard insert or a banner at registration; test the code before the room fills with phones.
• Airbnb and rentals: one code in the welcome binder and one on the fridge; reprint when you rotate the password.

Security considerations

The password is stored in plain text inside the code, so anyone who can see or photograph the print can read it. A Wi-Fi QR code is a convenience, not an access control. Treat every printed code as public: someone can scan it, decode the string with any reader app, and share the password. Put codes on the guest network, never on the network your point of sale, cameras, printers or file shares live on, and rotate the guest password on a schedule you are comfortable with.

For a small business the safe pattern is: a separate guest SSID with client isolation turned on so guests cannot see each other's devices, bandwidth limits if your router supports them, and a Wi-Fi QR code that you regenerate whenever the password changes. If you use a dynamic QR code from an account on qrsvg.app you can track how often a sign is scanned, but note that the network join itself is handled by the phone and does not pass through any server; a Wi-Fi payload is always static.

How to make a Wi-Fi QR code

1. 1

   Open the Wi-Fi tab

   Go to qrsvg.app and select the Wi-Fi content type in the generator.

2. 2

   Enter the network details

   Type the SSID exactly as it appears on your devices, choose WPA/WPA2/WPA3, WEP or open, enter the password, and tick hidden if the network does not broadcast its name.

3. 3

   Style the code

   Pick module and eye shapes and a dark color on a light background. Keep the quiet zone at 2 modules or more and leave error correction at M or higher.

4. 4

   Download

   Export SVG or PDF for printed cards and signs, or PNG for a screen in the lobby or a message to guests.

5. 5

   Test and print

   Scan the printed proof with an iPhone and an Android phone, confirm both join the network, then print at 3 cm or larger and add the SSID as text underneath.

Frequently asked questions

What is the format of a Wi-Fi QR code?

WIFI:T:WPA;S:NetworkName;P:Password;H:false;; where T is the security type (WPA, WEP or nopass), S the SSID, P the password and H true for hidden networks. Special characters ; , : \ and double quotes are escaped with a backslash.

Does WPA3 need a different QR code than WPA2?

No. WPA, WPA2 and WPA3 personal networks all use T:WPA in the payload; the phone negotiates the protocol with the router when it connects.

Do Wi-Fi QR codes work on iPhone?

Yes. iOS 11 and later read them with the built-in Camera app; tap the banner that appears and the phone joins the network. Android 10 and later do the same with the system camera, and Google Lens covers older Android phones.

Can someone see my Wi-Fi password from the QR code?

Yes. The password is stored as plain text in the code and any reader can display it. Only print codes for a guest network and change the password when needed.

Does a Wi-Fi QR code work for a hidden network?

Yes. Set the hidden option so the payload includes H:true; the phone then looks for the SSID even though it is not broadcast. Test on the phones your guests use, since a few older Android versions ignore the flag.