WiFi QR codes — how they work

The payload, field by field

WIFI:T:WPA;S:CafeGuest;P:espresso1234;H:false;;

Field	Meaning	Values
T	Security type	WPA, WEP, nopass
S	SSID (network name)	any string
P	Password	omitted for nopass
H	Hidden network	true / false

The trailing double semicolon is part of the format. Note there is no separate WPA3 value — WPA3 networks use T:WPA, and phones negotiate the actual protocol when they connect.

The escaping rule that breaks most hand-made codes

Four characters are structural and must be backslash-escaped inside S and P:

\   ;   ,   :   and the double quote "

A password of p@ss;word written literally terminates the password field early, and the phone tries to join with p@ss. A network named Bob's Café; Guest is worse. This is the single most common cause of "the QR code connects to the wrong thing" and it is why generating by hand or with a naive template is a bad idea.

A password that is entirely hexadecimal digits and 64 characters long is interpreted as a raw PSK rather than a passphrase; wrap it in double quotes if it is genuinely a passphrase that happens to look like hex.

Hidden SSIDs

If your network does not broadcast, H:true is required. Without it, the phone searches for a visible network of that name, fails, and reports that it cannot connect — even though every other field is correct.

What does not work

• Enterprise networks (WPA2/WPA3-Enterprise, 802.1X). The WIFI: format has no fields for identity, EAP method or certificates. There is no way to encode a corporate network this way. Use your MDM's provisioning profile instead.
• Captive portals. The code joins the radio network; the user still has to accept the portal terms in a browser.
• Networks with MAC filtering. Joining will still be refused.

Platform support

• iOS 11+: native camera, works from the photo library too.
• Android 10+: native camera; Android also has a built-in share this network screen that produces the same format.
• Windows and macOS: no native handler. Desktop users see the raw string.

The privacy point that matters

Your WiFi password is inside the code in plain text — anyone who scans it, or who photographs the printed card, has your password. That is inherent to the format.

What is not inherent is sending that password to a website. Most online WiFi QR generators post your SSID and password to their server to render the image. UseQR generates the code entirely in your browser, and deliberately keeps the password out of the page URL as well, so it is never in your history, never in a referrer header, and never on anyone's server.

For a shop or café, put the code on a card at the counter rather than in the window, and use a guest network separated from your point-of-sale.

FAQ

Is my WiFi password sent to a server?

Not with UseQR. The code is built in your browser and the password is deliberately excluded from the page URL. Most other online generators do send it to their servers to render the image.

Which security type should I choose for WPA3?

Choose WPA. The WIFI: format has no WPA3 value; phones negotiate WPA3 automatically when both ends support it.

Why does my WiFi QR code connect to the wrong network or fail?

Almost always an escaping problem. Semicolons, colons, commas, backslashes and quotes inside the SSID or password must be backslash-escaped, or the field terminates early. Hidden networks also need H:true.

Can I make a QR code for a corporate 802.1X network?

No. The WIFI: format has no fields for enterprise identity, EAP methods or certificates. Use a device-management provisioning profile instead.

Does it work on iPhone and Android?

Yes — iOS 11 and later, and effectively all current Android versions, connect straight from the camera app. Desktop operating systems have no native handler.