WiFi QR codes: the complete guide

A WiFi QR code is the highest-value QR code most small businesses will ever print. It removes a small, constant friction — dictating a password across a counter — and it takes five minutes.

It also has more ways to fail than any other type, because it depends on details you cannot see.

What is actually in the code

There is no magic. A WiFi QR code contains a plain text string in a specific format:

WIFI:T:WPA;S:MyNetwork;P:hunter2;;

Four parts:

• T — the security type: WPA, WEP, or nopass
• S — the SSID, the network name
• P — the password
• The trailing ;; closes the string

Your phone recognises the WIFI: prefix, parses the fields, and offers to join. That is the whole mechanism, and it is why the code cannot expire: there is no server involved.

The three things that break it

1. The SSID does not match exactly. Network names are case sensitive. MyCafe and mycafe are different networks as far as the phone is concerned. Trailing spaces are invisible and lethal — copy the name from your router settings, do not retype it from memory.

2. The wrong security type. Choose WPA for anything modern: it covers WPA, WPA2 and WPA3. WEP only for genuinely ancient equipment. nopass for open networks — and if you pick nopass while the network has a password, the join silently fails.

3. Unescaped special characters. Semicolons, colons, commas, backslashes and quotes are structural in this format. A password of p@ss;word would break the string in half unless the semicolon is escaped as \;. Our WiFi generator escapes automatically, but a hand-written string will not.

iPhone and Android are not identical

Both work, with differences worth knowing:

iOS 11+ joins from the Camera app. The prompt appears as a banner at the top — easy to miss in bright sunlight, which is why people sometimes claim "it did nothing".

Android 10+ joins from the camera or Google Lens. Some manufacturer skins bury the QR reader in a separate mode rather than the main camera.

Older Android often needs a dedicated scanner app. If your customers include people on five-year-old phones, print the network name and password in small text beside the code as a fallback.

Hidden networks need the H:true flag. Without it the phone will not find a network that is not broadcasting. Most generators omit this option entirely.

The security decision nobody makes

Here is the part that gets skipped: a printed WiFi QR code is a printed WiFi password.

Anyone who photographs that table tent from across the room has your network. Not a hypothetical — a phone camera reads a QR code at surprising distance.

So the real question is not whether to print it. It is which network it joins.

• Guest network, always. Almost every router made in the last decade can broadcast a second, isolated SSID. Guests get internet; they do not get your point-of-sale terminal, security cameras, printers or file shares.
• Never your main network. If your till and your customers share a network, one compromised laptop is a very bad day.
• Rotate the guest password periodically if the code is somewhere public. Quarterly is fine for a café.
• Consider client isolation, a router setting that stops guests from seeing each other. It protects your customers from each other, which is also your problem.

Printing a code for the guest network costs the same as printing one for the main network. The difference only shows up on the day it matters.

Print size and placement

A WiFi code is read at arm's length, from a table or a wall:

• Table tent: 3 cm minimum, 4 cm comfortable
• Wall poster at 1–2 m: 12 cm minimum
• Sticker on a counter: 2.5 cm, but expect wear — laminate it

Keep the 4-module quiet zone. And print the SSID as text next to the code: it tells people what they are joining, and gives a fallback if the scan fails.

Our generator exports a print-ready A6 PDF sized for a table tent, so the size decision is already made.

Test properly before printing 50 of them

The test that actually catches problems:

1. Print one at final size on the real material.
2. Forget the network on your phone first — otherwise it "works" because you were already connected. This is the single most common false pass.
3. Scan with an older Android, not only your newest phone.
4. Try it in the actual lighting of the room.

Step 2 catches more errors than the other three combined.

Common questions from the counter

Can I have one code for two networks? No. One code, one network. Print two codes if you offer a 2.4 GHz and a 5 GHz SSID — or better, give them the same name and let the router steer.

Will it work without internet on their phone? Yes. Joining a network needs no internet, which is the whole point.

Does the code stop working if I change the password? The code keeps working, but the join fails. Regenerate and reprint whenever the password changes — which is the argument for not changing it too often on a guest network.

Can someone see my password from the code? Yes. Any reader shows it as text. Assume the printed code is the printed password.

In short

• Copy the SSID exactly, including capitals — do not retype it
• Use WPA unless your router is genuinely ancient
• Point it at a guest network, never your main one
• 3 cm minimum on a table, with a 4-module quiet zone
• Forget the network before testing, or the test lies to you
• Print the network name in text as a fallback

Create a WiFi QR code — free, and your password is encoded in your browser rather than sent to a server, which for this particular payload matters more than for any other.