# Why you should not upload a WiFi password to a website

> A WiFi QR form on a server-side generator transmits your network name and password to someone else's server, where standard logging retains them for an unknowable time. Generate WiFi codes with a client-side tool instead: one that still works in airplane mode, proving the password never left your device.

Source: https://useqr.app/docs/security/why-not-to-upload-a-wifi-password-to-a-website · Last reviewed 2026-08-21 · UseQR is free forever, no signup.

---

## What a WiFi QR code contains

The payload is a plain-text string in a well-known format:

```
WIFI:T:WPA;S:CafeGuest;P:the-actual-password;;
```

Network name, security type, password, readable by anything that decodes the code. That is
the point: your guests scan it and join without typing. It also means the password exists
in cleartext wherever that string travels.

## What happens on a server-side generator

Most QR websites render the image on their server. Fill in their WiFi form and your SSID
and password are transmitted, in that string, to hardware you do not control. From there:

- **Default logging captures it.** Standard access-log configurations record full request
  URLs and bodies pass through application logs; nobody had to decide to keep your
  password for it to be kept.
- **Retention is unknowable.** Log rotation policies, backups, third-party log platforms:
  none of it is visible from outside, whatever the marketing page says.
- **Breaches inherit it.** If that provider is compromised in two years, your network
  credentials are part of the spill.

The broader inventory of what generators observe is in
[what your QR provider can see](/docs/security/what-your-qr-provider-can-see).

## Why this matters more than a URL

Uploading a public URL to a generator leaks nothing: the URL was public anyway. A WiFi
password is a **credential**. It grants join access to your network, and for a small
business the guest network often sits one misconfiguration away from the till, the printer
and the CCTV. Credentials deserve a stricter rule than content: they should never transit
infrastructure you cannot audit.

## The architectural fix

The QR encoder is a few kilobytes of code that runs happily in a browser, so nothing about
this problem is necessary. A safe WiFi generator has three verifiable properties:

1. **Client-side encoding**: the code is built on your device. Full comparison in
   [client-side vs server-side generation](/docs/security/client-side-vs-server-side-qr-generation).
2. **Offline capable**: the proof ritual: load the page, switch on airplane mode (flight
   mode on Android), then enter the password and generate. A tool that still works
   provably sent nothing.
3. **No account**, so there is no profile for the password to be filed against, and nothing to breach later.

This is UseQR's exact design. The [WiFi generator](/wifi-qr-code) encodes in your browser,
keeps the password out of the shareable page URL, and works with the network off. You can
[start from a prefilled link](/wifi?ssid=CafeGuest&sec=WPA) and add the password only on
your own device. For a printable table-top version, the [WiFi card maker](/wifi-card) works
the same way.

## If you have already uploaded it

Treat the password as disclosed, in proportion to what it protects:

1. Change the WiFi password on the router.
2. Regenerate the code client-side with the new password.
3. Reprint. A scan with your [scanner](/scan) confirms the new code carries the new
   credentials before it goes on the wall.

Remember the printed code itself is also cleartext. Anyone who can photograph it can read
the password. Put it where guests sit, not in the front window.

## FAQ

### Is it safe to make a WiFi QR code online?

Only with a tool that generates the code in your browser. A server-side generator receives
your network name and password in plain text, and you cannot verify what its logs retain.
The airplane-mode test distinguishes the two in ten seconds.

### Can someone get my WiFi password from the QR code?

Yes: anyone who scans or photographs the code can read the password, because the payload
is plain text by design. Display the code only where you would happily display the
password itself.

### Does UseQR see my WiFi password?

No. The WiFi code is generated entirely in your browser, the password never crosses the
network, and it is excluded from the page URL so it cannot leak through history or
referrer headers. Switch on airplane mode and generate one, if it still works, nothing was sent.

### What should I do if I typed my WiFi password into a QR website?

Change the password on your router, then regenerate the code with a client-side tool.
There is no way to confirm deletion from someone else's logs, so rotation is the only
reliable remedy.

## Try it

- https://useqr.app/wifi
- https://useqr.app/wifi-card
- https://useqr.app/scan