The WIFI: string behind a WiFi QR code

You print a WiFi code for the guest network, tape it up by the door, and roughly half the people who scan it get a web search for gibberish instead of a join prompt. The code is fine. The string inside it is not.

What the code encodes

A WiFi QR code holds one line of text. No link, no server, no redirect — the phone reads a prefix it recognises and turns the fields into a join dialog.

WIFI:T:WPA;S:CafeCentral Guest;P:flatwhite-2026;H:false;;

That is the whole payload. Fifty-seven characters, which at error correction level M encodes as a version 4 symbol: 33 modules across.

The fields

Field order is not fixed. WIFI:S:...;T:WPA;P:...;; is equally valid, and Android’s own network-sharing screen emits the fields in that order. What is not optional is the trailing double semicolon: drop one and a good number of readers refuse the payload outright.

Two other keys occasionally appear — E: and A:, for the EAP method and anonymous identity on enterprise networks. Support outside Android is thin, and if you are running WPA2-Enterprise you are provisioning devices through mobile device management anyway, not through a poster.

T: what to write for WPA2 and WPA3

Only three values are worth printing. WPA covers WPA, WPA2 and WPA3 Personal: phones read it as a general marker and negotiate the strongest mode the access point actually offers, so there is no WPA2 value to write and nothing to gain from inventing one. WEP exists for networks that should have been retired a decade ago. nopass is for open networks, and it must come with no P: field at all:

WIFI:T:nopass;S:Airport Free;;

A nopass string carrying an empty password field confuses several readers.

Some Android builds now emit T:SAE when sharing a WPA3-only network, and older readers do not recognise it. Print WPA. The Wi-Fi Alliance’s own answer for WPA3 provisioning is Easy Connect, which uses a completely different DPP: URI carrying a public key rather than a shared secret — a separate mechanism, not a variant of this one.

Characters you have to escape

Five characters are structural, and each has to be prefixed with a backslash wherever it appears inside a value:

\  ;  ,  :  "

So a network called Baecker; Soehne with the password a:b;c becomes:

WIFI:T:WPA;S:Baecker\; Soehne;P:a\:b\;c;;

This is the most common reason a WiFi code fails. Hospitality network names are full of ampersands, colons and apostrophes, and router-generated passwords are full of punctuation. Unescaped, the reader treats the semicolon in the middle of your password as the end of the P: field and the remainder as a malformed key.

Non-ASCII characters are fine as UTF-8, but they cost more bytes in the symbol and a few older readers mangle them. If you get to choose the network name, staying inside ASCII removes a whole class of problem.

The pure-hex SSID quirk

If your SSID consists only of the characters 0–9 and A–F, some readers assume it is a hex-encoded name rather than a literal one, decode it to bytes, and look for a network that does not exist. A network called CAFE01 is genuinely ambiguous. The convention, inherited from the original ZXing implementation, is to wrap the value in double quotes to force a literal reading:

WIFI:T:WPA;S:"CAFE01";P:beans1234;;

The same applies to a password that happens to be all hex digits — if your PSK is DEADBEEF, quote it. Support for the quoting convention is not universal, so the more reliable fix is to rename the network so it contains at least one character outside the hex range.

Hidden networks

H:true tells the phone the SSID is not broadcast, so it must probe for the name rather than wait to see it in a scan. Getting this wrong in either direction fails silently: a hidden network without the flag never appears, and a visible network wrongly flagged as hidden makes some devices probe and then give up.

Hiding an SSID is not a security measure — it makes every client device announce the name it is hunting for, wherever that device happens to be — and it makes your code more fragile. For a guest network, leave it visible and leave H: out entirely.

Why iOS and Android behave differently

On iOS, the Camera app has parsed WIFI: natively since iOS 11. Point, tap the banner, confirm, joined. No third-party app and no browser in the middle.

On Android it depends on who made the handset. Android’s built-in scanner and Google Lens both handle the prefix, and Settings has a share button that generates one, but several manufacturer camera apps only look for URLs and pass anything else straight to a search box. That is the mechanism behind almost every “it works on my phone but not on theirs” report.

Two things follow. Print the network name and password as readable text under the code — it costs a centimetre of paper and rescues every guest whose camera app is unhelpful. And test on an Android handset that is not yours before you print a hundred copies.

The password is in cleartext, and that is the design

There is no encryption anywhere in a WIFI: string. Anyone who photographs the poster from across the room decodes it in seconds with any reader, and keeps that password long after they have left the building. A code on a wall is a password published on a wall.

That is perfectly fine, provided what it opens is worth nothing. Put guests on a real guest network: a separate SSID with client isolation and no route to the till system, the NAS, the cameras or the office printers. Rotate it whenever it would embarrass you not to. If your router can only run one network, a WiFi QR code is not a feature you want.

One related detail. The image API reads its payload out of the request path, so a WIFI: string sent through it travels across the network with the password in the URL. Generate WiFi codes in the browser generator instead, where the string never leaves your tab — the FAQ sets out exactly what each route does and does not transmit.

Nor do you have to type the string yourself any more. The generator has a Wi-Fi content type: network name and password go in their own inputs, the security type is a dropdown covering WPA/WPA2/WPA3, WEP and open networks, and there is a checkbox for a hidden SSID. It handles the five escapes, drops the P: field entirely for an open network and closes the string with the double semicolon — the three faults this page has just catalogued. Make a WiFi QR code shows the exact string each combination produces, which is worth a look precisely because you now know how to read it.

Printing one for a wall

The example above is 33 modules across, which puts the raw floor at 33 × 0.4 mm, a little over 1.3 cm. Nobody stands 13 cm from a wall, though, so size for the real reading distance instead, using the tenth-of-the-distance rule from the print size guide: roughly 3 cm on a table tent, 10 cm for a code read from a metre away beside the door.

Matte stock, never gloss and never a shiny laminate — a WiFi code lives under a ceiling light that will bounce straight back into the lens. Error correction M is right unless a logo covers the middle. And keep the four-module quiet zone clear of whatever frame you mount it in, because the decoder uses that margin to find the symbol at all.

If you are also printing a contact code beside it, the vCard field guide covers the equivalent syntax trap there.

Troubleshooting