Wi-Fi QR codes: how they work

A Wi-Fi code is ordinary text that starts with WIFI: and lists fields separated by semicolons: WIFI:T:WPA;S:Nook Coffee Guest;P:latte-and-cake-2026;; — T is the security type, S the network name, P the password, and the double semicolon at the end closes the record. An optional H:true marks a hidden network so the phone probes for it instead of waiting for a beacon.

The format was invented by the open-source ZXing barcode project for its Android scanner app around 2011. It was never blessed by the Wi-Fi Alliance or any standards body; it simply became what everyone generated, and Apple and Google eventually built support into their camera apps. The Wi-Fi Alliance's own Easy Connect codes start with DPP: and are a different, certificate-based mechanism you will rarely meet on a café sign.

For T, use WPA for any WPA, WPA2 or WPA3 personal network — phones do not need to know which one, they negotiate it. WEP still exists as a value but no network should be using it in 2026. For an open network write T:nopass or leave the field out and omit the password.

Because semicolons separate fields, a semicolon inside a password would end the field early. The ZXing rules say to put a backslash before five characters wherever they appear in a name or password: backslash, semicolon, comma, double quote and colon. QR Nook does this for you, but if you assemble a string by hand and your password contains p@ss;word, it must be written p@ss\;word.

Two more corner cases. A network name that consists only of hexadecimal digits — say ABCD12 — can be mistaken for a hex-encoded name by some readers; the ZXing convention is to wrap such a name in double quotes. And names or passwords with non-Latin letters are stored as UTF-8, which every modern phone handles, but very old scanner apps may not.

iPhones have recognised Wi-Fi codes in the built-in Camera app since iOS 11 in 2017: a banner offers to join the network, and the credentials go straight into Settings. Android added the same behaviour to the system camera and Google Lens with Android 10 in 2019, and since then the Wi-Fi settings screen can also generate a code for the network you are on — the same WIFI: string.

Older Android phones need a scanner app, and most of them (anything built on ZXing) handle the format. Laptops are the gap: neither Windows nor macOS has a built-in way to scan a code from a webcam, so a sign aimed at laptop users should still print the network name and password in plain text underneath the code.

Enterprise networks are a separate story. The format has fields for WPA2-EAP with an EAP method, identity and anonymous identity, and Android accepts them; iOS ignores enterprise codes entirely. If your network asks for a username, hand out a profile instead of a code.

The password sits in the code in plain text. The camera app shows a friendly "Join network" button, but any generic QR reader displays the whole string, password included, and a photo of the sign is as good as the sign itself. That is fine for a café; it is not fine for the network that also carries your point-of-sale terminal or your office file server.

Put the code on a guest network that is isolated from your internal one — every consumer router made in the last decade offers this — and rotate the guest password on a schedule, reprinting the code each time. Because the code is static, rotation is the only way to revoke access from people who photographed it months ago.

Skip the code when the network has a captive portal. The phone will join, then the portal page appears anyway, and guests are confused about whether the code worked. Skip it for networks with per-user logins, for networks whose password changes weekly (the reprints will lag behind), and for anything you would not write on a whiteboard in a public room.

It is also the wrong tool for onboarding smart devices that have no camera. Those want the WPA3 Easy Connect flow or a vendor app, not a WIFI: string. Where a code does fit — cafés, guest rooms, coworking desks, event venues — it is hard to beat.

A typical Wi-Fi string is 40 to 70 bytes, which fits a version 4 code at level M — 33×33 modules — so it stays crisp even at 3 cm. Level M is enough unless you add a logo. Give the code four modules of quiet zone, print dark modules on a light background, and place it where a phone can hover 15 to 30 cm away without glare from a window.

Print the network name and password in text next to the code for laptops and for people who prefer typing, and add the date you last changed the password somewhere small so staff know which signs are stale. The scan check in QR Nook will confirm the code decodes; a quick scan with a phone before you laminate a stack of them confirms it joins.