WPA, WPA2, WPA3, hidden, and Enterprise EAP — with the escaping done right
| Key | Means | Example | Notes |
|---|---|---|---|
T: | Authentication | WPA | WPA covers WPA, WPA2 and WPA3-Personal. Also WEP, nopass, or WPA2-EAP for enterprise |
S: | SSID | BlueHouse 5G | Must match the broadcast name exactly, spaces included |
P: | Password | correct horse… | 8–63 chars for WPA; omitted entirely for nopass |
H: | Hidden | true | Only appears when the network doesn't broadcast its SSID |
E: | EAP method | TTLS | Enterprise only: PEAP, TTLS, TLS, PWD |
PH2: | Phase 2 auth | MSCHAPV2 | Enterprise only: inner tunnel method |
I: | Identity | [email protected] | Enterprise username |
A: | Anonymous identity | [email protected] | Outer identity for TTLS/PEAP; protects the real username |
The whole string ends with a doubled semicolon (;;) — one closes the last field, one closes the record. The five reserved characters \ ; , : " must be backslash-escaped wherever they appear in an SSID or password.
| Type | T: value | Use it? | Notes |
|---|---|---|---|
| WPA3-Personal | WPA | Yes | Current standard (SAE); phones join via the same QR string |
| WPA2-Personal | WPA | Yes | Still the compatibility default for guest and IoT networks |
| WPA2/WPA3-Enterprise | WPA2-EAP | Offices, campuses | Per-user login via 802.1X; QR join works on Android |
| WEP | WEP | No | Crackable in minutes; encode only for legacy gear you can't replace yet |
| Open | nopass | Captive portals only | No encryption; anyone in range can read traffic |
Every phone camera understands the WIFI: string format that originated with the ZXing barcode library and is now the de facto standard. The format is simple, but it has teeth: five characters are reserved, and a password containing one of them breaks the join if it isn't escaped. Most free generators handle WPA personal and stop there; this one covers the full format including the enterprise extension.
WIFI:T:WPA;S:ssid;P:password;H:true;; — key/value pairs separated by semicolons, terminated by a doubled semicolon. Reserved characters \ ; , : " take a backslash in both SSID and password. For enterprise networks, T:WPA2-EAP plus the E:, PH2:, I: and A: fields carry the 802.1X settings, following the extended encoding Android accepts.
Type the SSID exactly as devices see it — spaces and capitalization included — pick the security type, and enter the password. The payload preview shows the exact string being encoded, so you can watch a semicolon in your password become \; in real time. For open networks the password field disappears; for hidden networks tick the box. Download a PNG for the guest sign or an SVG for print.
Home network: SSID BlueHouse 5G, WPA2 password correct horse battery staple. The string is WIFI:T:WPA;S:BlueHouse 5G;P:correct horse battery staple;; — 58 bytes, no reserved characters, QR version 4 at error correction M, a 33×33 module grid. At the 0.33 mm per module floor that prints at 10.9 mm, so a 5 cm sign is enormous margin: guests scan it from across the room.
Now a campus network. SSID CorpWiFi, TTLS with MSCHAPv2, username and anonymous identity, password secretpass: WIFI:T:WPA2-EAP;S:CorpWiFi;P:secretpass;E:TTLS;PH2:MSCHAPV2;I:[email protected];A:[email protected];; — 99 bytes, QR version 6, 41×41 modules, 13.5 mm minimum print. Still small. The practical limit isn't the QR capacity (version 40 holds 2,953 bytes); it's that denser codes need bigger prints, and passwords with reserved characters need the escaping this page applies for you.
Encode the string WIFI:T:WPA;S:YourNetwork;P:YourPassword;; into a QR code, where S is the network name and P is the password. Most phone cameras scan it and offer to join instantly. The generator above builds the string with the required escaping for you.
Nine times out of ten it is escaping. The WiFi format treats backslash, semicolon, comma, colon and double-quote as reserved, so a password like p@ss;word must be encoded as p@ss\;word with a backslash in front of the semicolon. Wrong network name (broadcast vs actual), a 5 GHz-only SSID scanned by a 2.4 GHz-only device, and trailing spaces pasted with the password cover most of the rest.
On Android, yes. The extended WIFI: format supports T:WPA2-EAP plus E: (EAP method), PH2: (phase 2), I: (identity) and A: (anonymous identity) fields, following the encoding Android's setup tools accept. iOS camera scanning does not join enterprise networks from QR codes, so for Apple users print the credentials instead.
Yes, to anyone who scans it or photographs the code. The password is inside the QR in readable text, so treat a printed WiFi QR like a post-it with the password on it. Put guests on a guest VLAN, use a separate guest SSID, and rotate the password when you retire the sign.
WPA/WPA2/WPA3 passphrases run 8 to 63 characters. A 63-character passphrase plus a long SSID still fits comfortably in a QR code (a typical personal WiFi payload is 50-90 bytes, QR version 3 to 5), but every character makes the printed code denser, so a 20-30 character passphrase is the sweet spot of strong and scannable.
Yes, add H:true to the string (WIFI:T:WPA;S:name;P:pass;H:true;;). Hidden networks don't broadcast their SSID, so the flag tells the phone to connect even though it can't see the network in its list. Hiding an SSID adds no real security and can make connections flakier, but the code handles it either way.