How to Create a WiFi QR Code
A WiFi QR code is not magic and not a login link. It is a short, strictly formatted string that tells the phone's operating system to add a network — and getting the punctuation wrong is the reason most of them fail.
The format, exactly
The string a WiFi QR code contains looks like this:
WIFI:T:WPA;S:CafeCentral;P:flatwhite2026;H:false;;Field by field:
| Field | Meaning | Values |
|---|---|---|
T | Security type | WPA, WEP, nopass |
S | Network name (SSID) | Exactly as broadcast, case sensitive |
P | Password | Omit entirely for an open network |
H | Hidden network | true or omit |
Three details trip people up. The prefix is WIFI: in capitals. Every field ends with a semicolon. And the whole string ends with two semicolons — one closing the last field, one closing the record. A string ending in a single semicolon is rejected by some scanners and accepted by others, which produces the worst kind of bug.
An open network with no password:
WIFI:T:nopass;S:LibraryGuest;;The characters you must escape
Since semicolons and colons are structural, any of them inside your SSID or password have to be escaped with a backslash. The full set that needs escaping is:
\ ; , : "So a password of flat;white:2026 is written:
WIFI:T:WPA;S:CafeCentral;P:flat\;white\:2026;H:false;;Two further edge cases:
- Leading or trailing spaces in an SSID or password must be preserved by wrapping the value in double quotes:
P:" spaced "; - An SSID that is entirely hexadecimal characters — say
C0FFEE— may be interpreted as a hex-encoded SSID rather than literal text. Wrap it in quotes to force literal treatment:S:"C0FFEE";
Our generator handles all of this for you; the reason to know it is that it lets you check a code someone else produced by decoding it and reading the string.
Security types, including WPA3
The T field only really distinguishes three cases. WPA covers WPA, WPA2 and, in practice, WPA3 as well — the phone negotiates the actual protocol with the access point, and the field is only telling it that a passphrase is required.
- WPA2 / WPA3 personal:
T:WPA. This is almost every network. - Open:
T:nopass, and omit thePfield. - WEP:
T:WEP. If you are using WEP, the QR code is not your most urgent problem. - WPA2-Enterprise (username and certificate): not supported by this format at all. Some Android builds accept an extended syntax with
E,AandIfields, but nothing about it is portable. Enterprise networks need a proper provisioning profile.
Hidden networks
If the network does not broadcast its SSID, H:true is mandatory. Without it, the phone scans for a network with that name, does not see one, and gives up — even though the credentials are perfect.
WIFI:T:WPA;S:BackOffice;P:correcthorse;H:true;;What each phone does
iPhone. The native camera recognises the string and offers a "Join network" banner. Tapping it joins immediately; the network is saved. iOS has handled this since iOS 11, so any phone that receives updates will manage it.
Android. Handled by the camera or Google Lens on most modern devices, with a confirmation prompt. On older or heavily customised builds the native camera may not recognise the format, and the user needs a QR reader app. This is the main reason to print the network name and password in small type underneath.
Neither will join a network the phone cannot currently see, and neither will work for a captive portal — a code cannot fill in a hotel's web login page.
Practical advice for a guest network
- Put it on a separate guest SSID. A printed code is a printed password. Anyone who photographs the card has it permanently, so it should not be the network your card terminal is on.
- Print the credentials underneath. Two small lines of text rescue every guest whose phone will not cooperate.
- Do not laminate glossy. Table cards catch overhead light exactly where the code is.
- 35–40 mm on a table card. Read from about 30 cm, which is the 10:1 rule; details in the printing size guide.
- Change the password and you must reprint. The password is inside the image. This is a static code doing exactly what a static code does, and it is why the card should live somewhere you can replace it.
You can make one on the WiFi tab of the generator. It runs in your browser, so the password is never sent anywhere — which for this particular payload is not a small detail.
Written by Manuel Llovet, who builds and maintains QR Code Free Forever. Published 2026-08-31, last checked 2026-09-08. Figures and measurements on this page were produced for this site; the method is described in each caption.