WiFi QR Code Generator Guide: The WIFI: Payload, Security Types and Special Characters

A WiFi QR code lets a guest join your network by pointing a phone camera at it, with no typing of long passwords. The code is not a link and needs no app or website: it holds a short text payload that starts with `WIFI:` and contains the network name, the security type and the password. Phones running iOS 11 or later and Android 10 or later read it with the built-in camera. Getting the payload exactly right, especially with special characters in the password, decides whether the scan connects or silently fails.

The WIFI: payload format

The format was proposed by the ZXing barcode project and is now what phone operating systems recognise. Fields are KEY:value pairs separated by semicolons, and the payload ends with two semicolons.

WIFI:T:WPA;S:CafeGuest;P:espresso-2026;;

T   security type: WPA, WEP, nopass (open network); Android also uses SAE for WPA3
S   network name (SSID) - required
P   password - omitted for open networks
H   true if the SSID is hidden (not broadcast)

Most readers accept the fields in any order. T:WPA covers WPA and WPA2-Personal, the security used by almost every home and office router. Android's own "share network" QR codes use T:SAE for WPA3-only networks. For a WPA2/WPA3 transition network, T:WPA works with both old and new phones.

An open network with no password uses T:nopass and leaves out P. WEP is obsolete and easily cracked; if a router still uses it, change the router setting rather than printing a QR code for it.

Special characters in the password or network name

Semicolons, colons, commas, backslashes and double quotes have a meaning in the payload, so they must be escaped with a backslash when they appear in the SSID or password. Unescaped, a password such as p;ss cuts the field short and the phone tries to connect with p.

password:  sun;shine:42\
payload:   WIFI:T:WPA;S:Home;P:sun\;shine\:42\\;;

// JavaScript: build a correct payload
const esc = (s) => s.replace(/([\\;,:"])/g, '\\$1');
const wifiPayload = ({ ssid, password, type = 'WPA', hidden = false }) =>
  `WIFI:T:${type};S:${esc(ssid)};` +
  (type === 'nopass' ? '' : `P:${esc(password)};`) +
  (hidden ? 'H:true;' : '') + ';';

The function escapes all five characters in one pass. If you escape them with several separate replace calls instead, do the backslash first, or the backslashes you add for the other characters get escaped again. Spaces and non-ASCII characters such as é or emoji need no escaping. They are encoded as UTF-8 in the QR code, and current iOS and Android versions read them correctly.

The ZXing specification also suggests wrapping an SSID in double quotes when it could be mistaken for a hex string, for example a network literally called ABCDEF. Most modern readers do not need it, but it does no harm.

Creating a WiFi QR code step by step

Find the exact network name and password. Both are case-sensitive, and a trailing space in the SSID counts. On a computer already connected, the name is shown in the WiFi menu. The password is in the router's admin page or on the label on the router.

Check the security type in the router settings: WPA2-Personal or WPA2/WPA3 mixed mode means T:WPA, WPA3-Personal only means T:SAE, and an open network means T:nopass.

Paste the payload into a QR code generator as plain text, or use a generator with a WiFi mode that builds the payload for you. Generate the code with at least error-correction level M.

Test it before printing: scan it with one iPhone and one Android phone, from a device that is not already connected to the network. A phone that already knows the network joins it silently, so the test proves nothing.

Enterprise networks (WPA2-EAP)

Networks that sign in with a username and password per person, such as eduroam or corporate WiFi, use WPA2-Enterprise. The ZXing format has extra fields for it: T:WPA2-EAP, E for the EAP method such as PEAP or TTLS, A for an anonymous identity, I for the identity and PH2 for the phase-2 method such as MSCHAPV2.

WIFI:T:WPA2-EAP;S:CorpNet;E:PEAP;PH2:MSCHAPV2;I:alice@example.com;P:secret;;

Support for these fields is much weaker than for WPA-Personal, and most enterprise networks also require a server certificate to be trusted. For these networks, a configuration profile from the IT department (an Apple .mobileconfig or an Android managed configuration) is usually the better route.

Security: the password is in the code

A WiFi QR code is not encrypted. Anyone who scans it, or photographs it and decodes it later, learns the password in plain text. That is fine for a guest network in a café or an Airbnb, where giving out the password is the point, and wrong for the network your work laptops and home devices use.

Put guests on a separate guest network where the router supports it, with client isolation so guest devices cannot reach your computers, printers or smart-home devices. Change the guest password and reprint the code occasionally, especially after a busy season, because codes are photographed and shared.

Generate the code in a tool that runs in the browser, so your WiFi password is not sent to a third-party server. Avoid "dynamic" QR services for WiFi. They cannot work anyway, because the payload must be read directly by the phone, not through a web redirect.

Printing and placing the code

Print the network name and a short instruction next to the code, such as "Point your camera here to join CafeGuest", plus the password in text for laptops and older phones. People are more willing to scan a code when they know what it does.

Size it for the distance: about 3 cm is enough on a table card read from 30 cm, and 10 cm or more on a wall sign read from a metre. Keep a white margin of four modules around it. Laminated cards under strong lights reflect and fail to scan, so matte paper works better.

Sources and further reading

The ZXing project's "Barcode Contents" wiki page defines the WIFI: format, its fields and the backslash escaping rules. Apple's iOS 11 release added WiFi QR codes to the Camera app, and Android 10 added QR sharing and joining in WiFi settings; the Android Open Source Project's WifiQrCode class shows the nopass, WEP, WPA and SAE values. ISO/IEC 18004 defines QR codes and the four-module quiet zone.

Frequently asked questions

How do I create a QR code for my WiFi?

Build the text `WIFI:T:WPA;S:YourNetwork;P:YourPassword;;`, replacing the name and password and escaping any `;`, `:`, `,`, `\` or `"` with a backslash, then generate a QR code from that text. Scan it with a phone that is not yet connected to test it.

Can I put the WiFi password in a QR code?

Yes; that is exactly what a WiFi QR code contains. The password is stored in plain text, so anyone who scans or photographs the code can read it. Use it for a guest network, not your private one.

Which phones can join WiFi from a QR code?

iPhones with iOS 11 or later read WiFi QR codes in the Camera app, and Android 10 or later can join from the camera or from WiFi settings. Older Android phones need a QR scanner app.

Why does my WiFi QR code not connect?

Usually a special character in the password was not escaped, the security type is wrong (WPA vs SAE vs nopass), or the SSID or password differs in case or has a hidden space. Test from a phone that has never joined the network.

What does T:WPA mean in a WiFi QR code?

`T` is the security type. `WPA` covers WPA and WPA2-Personal, and WPA2/WPA3 mixed networks; `SAE` is used for WPA3-only networks, `WEP` for old WEP networks and `nopass` for open networks.

Do WiFi QR codes expire?

No. The network details are stored in the code itself, so it works for as long as the network name and password stay the same. Change the password and you must print a new code.