The format, field by field
A Wi-Fi QR code encodes a plain-text string in a specific schema. The schema is sometimes called WIFI:WPA2, the ZXing Wi-Fi format, or simply 'the QR Wi-Fi string'. Every modern phone's camera app recognises it.
WIFI:T:WPA;S:MyNetwork;P:MyPassword;H:false;;Every field is prefixed by a single letter and terminated by a semicolon. The full string is terminated by a double semicolon. Fields can appear in any order, and extra fields are safely ignored by scanners.
- T — security type — WPA, WEP, or nopass. WPA covers WPA, WPA2, and WPA3 — phones negotiate the actual handshake. WEP is deprecated and should never be used on a new network. nopass is for open networks with no password.
- S — SSID — The network name. Required. Backslash-escape any of these characters: ; , " : \
- P — password — The pre-shared key. Required for WPA and WEP, omitted or empty for nopass. Same escape rules as S.
- H — hidden network flag — Optional. true if the SSID does not broadcast, false or omitted otherwise. Phones that honor this flag will add the network as hidden.
Escaping special characters
SSIDs and passwords can contain any character including the reserved delimiters. The format specifies backslash escaping for five characters: semicolon, comma, double quote, colon, and backslash itself. Every other character, including spaces, emoji, and non-ASCII letters, goes through unmodified.
If your password is 'hello;world', the encoded payload is:
WIFI:T:WPA;S:MyNetwork;P:hello\;world;;QRForge's generator handles this escaping automatically — you type the raw password, we escape it correctly. If you're generating the string by hand, be especially careful with passwords containing semicolons (a common visual separator in auto-generated passwords).
A common subtle bug: users see their password as '12345678' but it was actually stored with a trailing space. The QR encodes the space faithfully and the phone submits the space to the router, which rejects it. When Wi-Fi QRs fail silently on a phone that otherwise joined yesterday, trailing whitespace is the first thing to check.
Encryption types in practice
The T field has three legal values, but you should really only use two of them.
- WPA — Correct for WPA, WPA2, and WPA3 networks. If your router is younger than 2004, you want this. The phone handshakes with the router's actual supported version.
- nopass — Open networks with no password. Rare in business contexts (and a security liability), common in airports and coffee shops with captive portals.
- WEP — Legacy encryption from 1997, deprecated since 2004. If your router still uses WEP, the correct answer is 'replace the router'. Do not encode WEP QRs for new deployments.
Phone compatibility
Native camera-app support for Wi-Fi QR codes is now universal across the phone base that matters.
- iOS 11+ (2017 and newer) — Camera app recognizes the code and offers a 'Join Network' banner on lock screen or in the app. No third-party scanner needed.
- Android 10+ (2019 and newer) — Native support in the Camera app and Google Lens. Some older Android devices need the Google Lens app but it comes preinstalled on any Google Play device from 2018 on.
- Older Android and Chromecast / TV — Many scan apps will display the credentials and offer copy-to-clipboard. The user copies and pastes into Wi-Fi settings. Not seamless, but functional.
In 2026, roughly 95% of phones in normal consumer and business contexts support native Wi-Fi QR joining. The remaining 5% will see the credentials and can type them by hand — which is still better than having nothing.
Hidden networks
Networks that don't broadcast their SSID need the H:true flag so the phone adds them as hidden networks in settings rather than assuming they're currently in range. Without H:true, scanning a hidden-network QR sometimes fails silently because the phone tries to connect immediately and sees no matching SSID in the air.
With H:true, the phone adds the network to its saved list with the 'hidden' attribute. The next time the phone is in range — which may be right now or may be later — it attempts to connect. This is the correct behavior for guest networks that are deliberately hidden.
Common failure modes
- Password with a colon or semicolon — If you're copying the QR string by hand, check that you've escaped every reserved character. A single missed escape breaks the whole string.
- SSID with non-ASCII characters — These work correctly on all modern phones because the QR payload is UTF-8. If they fail, the issue is usually the phone's input method for displaying the SSID name, not the QR itself.
- 5GHz-only network on a 2.4GHz-only device — The QR is correct; the phone cannot join because the radio doesn't support the band. Not a QR problem — a hardware compatibility problem.
- Captive portal networks — Many hotel and airport networks require a browser-based sign-in after joining. The QR joins the SSID, but the user still has to open Safari or Chrome to authenticate. Mention this explicitly on the signage next to the QR.
- Phone silently ignores the QR — Usually a malformed string — a missing semicolon or an unescaped character. Paste the raw encoded string into a text editor and count the semicolons. A correct WPA string has exactly four: after T, after S, after P, and the terminating double.
Printing and placement
Wi-Fi QR codes go in places where someone is already holding a phone: the bar, the lobby, the back of the menu, the welcome card in a hotel room. Size them at 2 cm × 2 cm minimum so they scan from arm's length without physically touching the code.
Skip the logo on Wi-Fi QRs. There's no brand benefit — the scanner sees 'Join Network?' and taps yes — and the error-correction headroom is better used for print-quality tolerance. Plain black on white scans most reliably.
If you're a venue rotating the Wi-Fi password monthly for security, a dynamic Wi-Fi QR doesn't really exist — the WIFI: string format is not a URL that can be redirected. The best workaround is to print a dynamic URL that links to a small landing page containing the current Wi-Fi QR, which you regenerate when the password changes.