WiFi QR codes — share without sharing
A WiFi QR code lets a guest connect by scanning instead of typing. The format is older than most QR codes you've used. Here's how it works and where it doesn't.
The fastest way to give a guest your WiFi password is to never tell them the password. Print a QR code. They scan it. Their phone joins the network. You never said the words "uppercase D, lowercase z, dollar sign, the number seven" out loud.
WiFi QR codes have been around since iOS 11 (2017) and have worked on Android for years longer. They're one of the few QR-code use cases where the technology has quietly become a default — the cafés that print their WiFi as a sticker on the table aren't doing something exotic, they're just using a feature their phones came with.
This post covers what a WiFi QR code actually is, how to generate one without a third-party site seeing your password, the gotchas with hidden networks and exotic encryption, and what to do for guest networks at scale.
The format
A WiFi QR code encodes a short text string in a specific format defined by Java's Wi-Fi Alliance specification — adopted by Android first, then iOS. The string looks like:
WIFI:T:WPA;S:NetworkName;P:PasswordValue;;
That's the whole format. Three colon-separated fields, terminated with a double semicolon. The fields are:
T:— security type.WPA(covers WPA2/WPA3),WEP(legacy, don't use), ornopass(open network).S:— SSID (network name).P:— password.
Optional extras:
H:true;— hidden network flag. Add this if your SSID is hidden.;;at the end is required, not optional. Trailing semicolon is the format's terminator.
Special characters in SSID or password need escaping. Backslash, semicolon, comma, colon, and double-quote each need a backslash before them. So a password of My;Pass becomes My\;Pass in the encoded string.
What happens when someone scans it
On iOS:
- Camera detects QR code.
- Banner appears: "Join 'NetworkName' Network?"
- User taps Join.
- Phone connects.
On Android:
- Camera (or Google Lens) detects QR code.
- Same prompt with the network name.
- User taps Connect.
- Phone connects.
No password is shown. No password is stored anywhere visible to the user. The phone joins the network using the credentials encoded in the QR — which the user never sees.
This is the privacy property that's underrated. Reading the password aloud in a café gets it into the room. Writing it on a chalkboard gets it on every camera-roll. A QR code keeps it out of human readability. Anyone with a camera can grab the credentials by scanning, but they have to make that choice; it's not just floating in the air.
A live builder
Generate without trusting a website
A small irony: the easiest way to make a WiFi QR code is to type your password into a free generator website. You've now told a stranger's web server your WiFi password. Most sites are honest. Some aren't. None need to be trusted.
Three ways around it:
1. Generate locally. Build the WiFi string in a text editor, then encode it into a QR with any offline tool — most operating systems have a built-in QR generator now. macOS Sonoma has one. Android has it via "Share WiFi password" in settings. iOS has it in Shortcuts.
2. Use a generator that runs in-browser only. The format is so simple that any honest implementation just uses JavaScript in the page. Open the page, disconnect from the internet, generate the code. If it still works, the generator was local-only. The Linked.Codes WiFi QR generator is local-only by design — your password never reaches our server.
3. Use a guest network with a different password from your main. Even if a generator did capture your password, it's the guest network password, not your main one. Most modern routers support a separate guest SSID with its own credentials and isolation from the main network.
The third option is the strongest defence. The first two reduce the trust surface; a guest network removes the worst-case impact entirely.
Hidden networks need the H flag
A "hidden" WiFi network is one whose SSID isn't broadcast — phones can't see it in the network list until they know the name. People hide them under the assumption that hiding helps with security. It doesn't (the SSID can be sniffed by anyone watching network traffic) but the WiFi-QR-code parser still has to know about it, because the phone won't try to connect to a hidden network unless it's expecting one.
Add H:true to the WiFi string. Without it, the QR scans, the phone shows the join prompt, the user taps Join, and... nothing happens. The phone tries to connect to a network it can't see broadcasting and silently fails.
What goes wrong
Three failure modes worth knowing:
Special characters in the SSID or password. Forgetting to escape semicolons, colons, commas, or backslashes is the most common cause of a code that scans but fails to connect. The format expects escaped values, not raw.
Enterprise WiFi (WPA2-Enterprise / 802.1X). The simple WIFI:T:WPA;... format only handles personal WPA. Office networks that require username + password + certificate (the corporate kind) can't be expressed in the basic format. There's an extension (WIFI:T:WPA;...;E:user;C:cert) but it's poorly supported. For enterprise networks, distribute config profiles instead of QR codes.
Captive portals. Hotel WiFi where you connect first, then have to accept terms in a browser. The QR gets you onto the network. The captive portal is a separate step. The user still has to open a browser and accept whatever terms the hotel demands. WiFi QR codes can't bypass that.
Where it works best
The use cases where WiFi QR codes are an obvious win:
- Cafés and restaurants. A small framed QR on the wall or the menu, eyebrow text "scan to join WiFi". Customers join in three seconds. No staff time spent reciting the password.
- Airbnbs and short-term rentals. A laminated card by the router. Guests join without you having to text them the password (which they then save in their texts forever).
- Conferences and events. A QR on the badge or the event programme. Reduces queries to event staff.
- Office reception areas. Visitor WiFi for guests, separate from staff network.
- Home offices for visiting clients. Same logic, smaller scale.
The pattern: any space where the same password is shared with many people and the social cost of "what's the WiFi" is repetitive.
Where it makes less sense:
- Personal home WiFi. You're sharing it with maybe four people who all already have it.
- Networks that change passwords frequently. Reprinting the QR every month is more friction than just texting it.
- Enterprise environments. Real security policy needs more than a QR.
What about the privacy of guests?
A WiFi QR code is one-directional — it gives the guest credentials, the network sees a device join, that's it. The QR code itself doesn't track who scanned it (unless it's a dynamic QR that fetches the WiFi string from a tracked URL, which is uncommon and a bit silly).
What the network operator sees is the same as without the QR: device MAC address (often randomised by modern phones), IP traffic to whatever sites the device visits. WiFi QR codes don't change that surface area.
If the network is a guest network configured with client isolation, devices on it can't see each other or the rest of the operator's LAN. That's the configuration hotels and good cafés use. If yours doesn't, switch it on — the QR code doesn't matter for that decision either way.
What we ship
The Linked.Codes WiFi QR generator builds the WiFi string client-side (in your browser), renders the QR locally, and never transmits the password. Output is a downloadable PNG/SVG. You can host the resulting file anywhere — there's no online "scan" path that has to stay online.
If you want a hosted WiFi page (e.g., a small landing that says "Welcome to our café — here's the WiFi" with the QR embedded), use a static link to a tiny page you control. The QR still encodes the WiFi string directly; the landing is just a place to put it.
Does this work on every phone?
iOS 11+ (2017) and Android 9+ (2018) handle WiFi QR codes natively. Earlier devices need a third-party QR scanner that recognises the format. The vast majority of devices in active use today work out of the box.
Can someone sniff my password from the QR?
Anyone who scans the printed QR sees the network credentials, yes. That's the point. If you don't want that, don't print the QR — or use a guest network with a separate password from your main WiFi.
What if my password has emoji?
UTF-8 in WiFi passwords is supported by most modern routers and phones. The vCard format passes through emoji unchanged. Older Android (pre-9) sometimes mangles non-ASCII in the WIFI string — test before you laminate.
How do I make a QR for a network with multiple SSIDs?
Each SSID gets its own QR. There's no format for "any of these networks" — each scan triggers a single join prompt for one specific SSID.
Can I make the QR show a custom prompt?
No — the OS controls the prompt text and shows the SSID. You can put context around the QR (a sign saying "Free WiFi for guests, scan to join") but the join prompt itself is OS-controlled.
Does the QR work for 5GHz vs 2.4GHz networks?
Yes. The QR encodes the SSID and password; the phone picks the appropriate band based on what's available. If your 2.4GHz and 5GHz are separate SSIDs, you'd need two QRs.
Why doesn't my hidden network's QR work?
You probably skipped the H:true flag. Hidden networks aren't visible to phones until they know to look for them; the H flag tells the phone to attempt connection rather than waiting to see the SSID broadcast.
Try it on your own domain
Branded short links and dynamic QR codes, on your subdomain or your own domain. One-time purchase, no per-click fees.
