The fridge-magnet question of the decade: "what's the WiFi?" A QR code answers it permanently. The format behind it is small enough to learn in five minutes and strict enough that half the generators online get it wrong — usually at exactly the character your password contains. Here's the whole thing: the string, the escaping rules, the enterprise extension, and what to print it on.
A WiFi QR code is just a short text string in a specific shape:
WIFI:T:WPA;S:BlueHouse 5G;P:correct horse battery staple;;Fields separated by semicolons, the record closed with a doubled semicolon. T is the authentication type (WPA for WPA/WPA2/WPA3 personal, WEP, nopass, or WPA2-EAP for enterprise), S is the network name, P is the password, and H:true appears for hidden networks. The format started in the ZXing barcode project and spread: iPhone camera, Android camera and Google Lens, and Windows all parse it. Scan, confirm, join — no keyboard time, no reading "zero or the letter O" across a noisy cafe.
Five characters are reserved: backslash, semicolon, comma, colon, and double-quote. Any of them in your SSID or password must be preceded by a backslash.
| Your password contains | Encoded as | Why |
|---|---|---|
p@ss;word | P:p@ss\;word | Bare semicolon would end the field |
cafe,guest | P:cafe\,guest | Comma is a reserved list separator |
a:b | P:a\:b | Colon would read as a new key |
back\slash | P:back\\slash | Backslash escapes itself |
say"hi | P:say\"hi | Quote is reserved for future use |
A generator that skips this produces a code that scans, shows a password, and fails to connect — the worst failure mode, because it looks like it should work. The WiFi QR generator shows the exact escaped string under the code as you type, so you can see \; appear the moment your password needs it.
Hidden networks (SSID not broadcast) add H:true: WIFI:T:WPA;S:name;P:pass;H:true;;. The phone joins a network it cannot see in its list. Worth knowing: hiding an SSID is security theater — scanners extract the name from probe traffic anyway — and it makes some clients flakier. But if the network is already hidden, the flag is mandatory.
Open networks use T:nopass and omit P: entirely: WIFI:T:nopass;S:CoffeeShop Open;;. Guests still scan and join without a password prompt. WEP uses T:WEP with a 5- or 13-ASCII-character key (10 or 26 hex). WEP is crackable in minutes with a laptop, so encode it only for doorbells and printers you genuinely cannot upgrade, and start planning their replacement.
Offices and campuses run 802.1X: every user logs in with their own username and password instead of a shared passphrase. The extended format carries that:
WIFI:T:WPA2-EAP;S:CorpWiFi;P:secretpass;E:TTLS;PH2:MSCHAPV2;I:[email protected];A:[email protected];;The fields: E: is the outer EAP method (PEAP and TTLS dominate, TLS where client certificates live on the device, PWD rarely), PH2: is the inner phase-2 authentication (MSCHAPv2 under PEAP/TTLS in most deployments), I: is the username, and A: is the anonymous outer identity — the string sent unencrypted during handshakes so the real username stays private. The full string above is 99 bytes, QR version 6, 41×41 modules: still an easy scan.
The honest caveat: this extension follows the encoding Android's setup tooling accepts, and Android joins from it. iOS camera scanning does not join enterprise networks from QR codes. For mixed fleets, the working pattern is a QR for the personal/guest network plus printed instructions (or an MDM profile) for the corporate one.
WPA, WPA2, WPA3, WEP, open, hidden, and full Enterprise EAP strings — with live escaping and module counts.
WiFi QR Code Generator →WiFi QR payloads are small, which is the good news. A personal network lands around 50–90 bytes: QR version 3 to 5, grids of 29×29 to 37×37 modules. At the standard print floor of 0.33 mm per module, that is a 10–12 mm minimum, so a 4 cm sign has triple margin and a mug decal still works. Enterprise payloads run 90–130 bytes (version 6–7), comfortable at 2 cm. Print black on white, keep the quiet zone clear, and matte beats glossy under restaurant lighting.
T:WPA covers WPA3 personal; the phone negotiates the protocol at join time.QR codes around the shop can pull double duty: a WiFi code at the register, a review QR on the receipt, a vCard code on your business card, all generated in the browser with the general QR generator for everything else. For a deeper look at how these codes behave over time, read do QR codes expire? — the short version: static ones like these never do.
WIFI:T:WPA;S:NetworkName;P:Password;; where T is the security type, S is the SSID and P is the password. It ends with a doubled semicolon. The five characters backslash, semicolon, comma, colon and double-quote are reserved and must be escaped with a backslash wherever they appear in the SSID or password.
iPhone (iOS 11+) via the Camera app, Android via Camera or Google Lens, and Windows 10+ via the camera or Settings network share. For open and WPA personal networks, effectively every phone made in the last decade joins from a scan. The enterprise (WPA2-EAP) extension is Android-only.
As safe as writing it on the sign itself: anyone who scans or photographs the code reads the password in cleartext. For homes that is usually acceptable; for cafes and offices put the code on a guest network with client isolation, on a separate VLAN, and rotate it regularly.
Check escaping first (a semicolon in the password splits the string), then the SSID spelling including spaces and case, then the security type. A password shorter than 8 characters is not a valid WPA passphrase, and an SSID with a trailing space pasted from a router admin page fails silently.
Yes. The T:WPA value covers WPA, WPA2 and WPA3 personal alike; the band is discovered by the phone when it joins. Very old devices (roughly pre-2014) may lack 5 GHz radios, but that is a hardware limit, not a QR limit.