WiFi QR code special characters: the escaping rules

The five characters

The WIFI: format is structured by punctuation: fields end at semicolons and keys end at colons. Five characters are therefore reserved, and each must be preceded by a backslash wherever it appears inside an SSID or password:

\   ;   ,   :   "

The backslash itself is escaped first (\ becomes \\), then the other four. That ordering matters when you write the escaping yourself: escape backslashes before adding new ones, or you double-escape.

Nothing else needs escaping. Apostrophes, @, #, $, %, &, spaces, and every other symbol pass through literally: over-escaping is its own bug, because the phone then tries a password containing literal backslashes.

Broken and fixed, side by side

Password p@ss;word:

WIFI:T:WPA;S:CafeGuest;P:p@ss;word;;      broken, phone tries "p@ss"
WIFI:T:WPA;S:CafeGuest;P:p@ss\;word;;     correct

The unescaped semicolon terminates P: early. The phone attempts to join with p@ss, fails authentication, and reports a wrong password, which sends everyone off to retype a password that was never the problem.

SSID Bob's "Blue" Café, Bar with password pass:word\1:

WIFI:T:WPA;S:Bob's "Blue" Café, Bar;P:pass:word\1;;                broken twice
WIFI:T:WPA;S:Bob's \"Blue\" Café\, Bar;P:pass\:word\\1;;           correct

Note what changed and what did not: the apostrophe and the é are untouched; the quotes, comma, colon and backslash each gained a backslash.

The hex rule

A quirk inherited from the format's scanner-side conventions: a value consisting entirely of hexadecimal digits (like 1A2B3C4D) can be interpreted as a raw hex key rather than a literal passphrase. If your SSID or password genuinely is all hex characters, wrap the whole value in double quotes (P:"DEADBEEF12";), to force literal interpretation. This is also why the double quote is on the reserved list. Related but different: a 64-character all-hex password is a raw WPA PSK by definition, covered in WiFi QR code not connecting.

Emoji and non-ASCII SSIDs

SSIDs are byte strings, and plenty of routers happily broadcast ☕ Café Wifi. In a QR payload these are encoded as UTF-8, and current iPhone and Android cameras handle them. Older scanner apps are less reliable, some decode the bytes with the wrong character set and search for a mangled SSID that does not exist. If a network name uses emoji and guests report failures on older devices, the pragmatic fix is renaming the network; no payload trick repairs a scanner-side decoding assumption.

Where this really bites

Hand-built payloads, spreadsheet formulas and naive templates: anywhere the string is assembled by concatenation. UseQR's WiFi generator applies exactly the escaping above automatically (backslash first, then ; , " :), and the printable WiFi card uses the same builder. Generation runs client-side, so the password never leaves your browser, worth knowing before typing credentials into any online tool.

The ten-second check

Decode your own code with our scanner and read the raw string. If the password in the payload stops at a punctuation mark, you have found the bug. Fields out of order or a missing T: value are the neighbouring failure, covered in wrong security type.

FAQ

Which characters need escaping in a WiFi QR code?

Exactly five: backslash, semicolon, comma, colon, and double quote, each preceded by a backslash inside the SSID or password. Everything else, including spaces, apostrophes and symbols like @ or #, passes through literally with no escaping.

Why does my WiFi QR code say incorrect password?

Most often an unescaped semicolon or colon in the password terminated the field early, so the phone tried a truncated password. Decode the code and read the string, if the password stops at punctuation, that is the bug.

Do spaces in an SSID or password need escaping?

No. Spaces are literal in the WIFI: format and need no treatment. Only backslash, semicolon, comma, colon and double quote are reserved. Escaping characters that do not need it inserts literal backslashes into the password and breaks it differently.

Why is my all-hex password treated strangely?

Values made entirely of hex digits can be read as a raw hex key instead of a passphrase. Wrap the value in double quotes to force literal interpretation. A 64-character hex string, though, is by definition a raw WPA PSK.