Sharing a WiFi password has always been more annoying than it should be. You spell out a 16-character string with mixed case and symbols, the guest types it wrong, you do it again on their phone, and both of you have wasted two minutes on something that should be instant. A WiFi QR code eliminates this: one scan and the phone connects automatically, no typing at all. Here's how the format works under the hood, what the security tradeoffs are, and how to display it safely.

How WiFi QR codes work

A WiFi QR code is not a URL, not a file, and not a link to any server. It's a structured text string in a format that iOS and Android both recognise natively as a network credential. When the phone's camera reads the code, the operating system's WiFi manager receives the credential and handles the connection — no browser, no app, no internet connection needed to join the network.

The string inside the QR code looks like this:

WIFI:T:WPA;S:My Home Network;P:SuperSecretPassword123!;H:false;;

What each part means

• WIFI: — The prefix that tells the phone this is a network credential, not a URL or contact. Without this prefix, the camera doesn't know what to do with the string.
• T:WPA; — The encryption type. WPA covers both WPA and WPA2 in this context. Use WPA2 or WPA3 for specificity if your generator supports it. For open networks with no password, use nopass. Legacy WEP networks use WEP, though WEP is a deprecated and insecure standard that should not be used.
• S:My Home Network; — The SSID: the exact, case-sensitive name of your network as it broadcasts. A single wrong character — wrong capitalisation, a space in the wrong position — means the scan appears to succeed but the phone can't find the network to join.
• P:SuperSecretPassword123!; — The password, also case-sensitive. Special characters including semicolons, commas, backslashes, and quotes require escaping if your generator doesn't handle this automatically (more on this below).
• H:false;; — Whether the network is hidden (not broadcasting its SSID). Set to true if your router is configured not to broadcast its name. This tells the phone to actively search for that specific network rather than waiting for it to broadcast. The double semicolon ;; terminates the string.

WPA2 vs WPA3

Most home and small business routers manufactured between 2006 and 2020 use WPA2 (Wi-Fi Protected Access 2). It's a mature, well-supported standard and the WPA type identifier in the WiFi QR string covers it. WPA2 with a strong, unique password provides adequate security for most home and small business contexts.

WPA3, introduced in 2018 and increasingly common on routers from 2020 onwards, improves on WPA2 in several important ways:

• Resistance to offline dictionary attacks: WPA3 uses Simultaneous Authentication of Equals (SAE), making it much harder to brute-force the password from captured data even after the fact.
• Forward secrecy: traffic captured today can't be decrypted later even if the password is compromised in the future.
• Better open network security: WPA3 introduces Opportunistic Wireless Encryption (OWE) for open networks, providing encryption without a password.

For a WiFi QR code on a WPA3 network, use T:WPA3 if your router and all connecting devices support it. Most devices from 2020+ do. If you have a mix of older and newer devices, your router likely runs in "WPA2/WPA3 transition mode" — use T:WPA for maximum compatibility.

Special characters in passwords

The WiFi QR string uses semicolons (;), commas (,), backslashes (\), and double quotes (") as structural delimiters. If your password contains any of these characters, they must be escaped — preceded by a backslash — or the string will be malformed and the code will fail to connect.

GetEasyQR's WiFi QR generator handles escaping automatically. If you're constructing the string manually or using a generator that doesn't, you'll need to escape these characters yourself before encoding.

Is a WiFi QR code secure?

The QR code format itself is safe. When generated client-side — as GetEasyQR does — your password never leaves your device. The generation happens entirely in your browser with no server communication.

The security consideration is different: the password is stored as plain text inside the QR image. The black and white module pattern is just a visual encoding of that text string. Anyone who points a generic barcode reader at the image — rather than the native camera app — will see the raw password on their screen.

Hidden networks

Some routers are configured not to broadcast the network name (SSID), so it doesn't appear in the list of available networks on a scanning device. This is sometimes used as a basic security measure, though network security professionals generally consider SSID hiding ineffective — the network's presence is still detectable with passive monitoring tools.

For a WiFi QR code pointing to a hidden network, set H:true in the string. The phone will then actively probe for that specific network name rather than waiting for the broadcast.

Note that on iOS, hidden network connections initiated via QR code may prompt the user to confirm the network name because the phone can't pre-verify that the network exists from a broadcast scan. This is expected behaviour.

Set up a guest network — don't share your main network

The most important security practice for businesses and anyone who regularly shares WiFi with visitors is to create a dedicated guest network and point the QR code at that, rather than your primary network.

Your main network is where your personal computers, network-attached storage drives, printers, smart home devices, and media servers live. A guest who joins it — or brings a compromised device onto it — can potentially probe and interact with everything else on the local network. A guest network provides internet access while isolating the guest device from the rest of your local network.

For restaurants and public venues

A restaurant or cafe pairing a menu QR code with a WiFi QR code on the same table card is the most effective setup. Guests who scan the menu code need internet access to view it — if your venue has poor cellular coverage, offering instant WiFi access removes the barrier completely. For the full restaurant QR code setup guide, see QR codes for restaurants.

For high-traffic public venues, consider rotating the guest network password monthly and reprinting the QR code inserts. This limits the useful lifespan of any shared credential in case it circulates beyond your intended audience.

When the code doesn't work

Related guides

• Dynamic vs. Static QR Codes
• QR Codes for Restaurants
• How to Scan QR Codes on Any Device
• QR Code Design and Printing Best Practices