QRBestQR code generatorOpen the generator

What is really inside a WiFi QR code

5 min read

A WiFi QR code is not magic and it is not encrypted. It is a short string of plain text in an agreed format, which phones recognise and offer to act on.

The format

WIFI:T:WPA;S:MyNetwork;P:my-password;H:false;;

Four fields, in any order, each ended by a semicolon:

  • T is the security type: WPA, WEP, or nopass for an open network. Use WPA for WPA2 and WPA3 as well. Scanners treat it as "the encrypted kind".
  • S is the network name, the SSID. It is case sensitive.
  • P is the password. Leave it out for an open network.
  • H is whether the network is hidden. Only set it to true if the network really does not broadcast its name.

The double semicolon at the end is part of the format, not a typo.

Special characters

If your network name or password contains a semicolon, a colon, a comma, or a backslash, each one has to be escaped with a backslash. A password of pa;ss becomes pa\;ss in the code.

A password made only of digits sometimes needs quoting, because some devices read it as a hexadecimal key rather than a passphrase. If a numeric password fails to connect, that is usually why.

The security tradeoff

Here is the part that gets skipped. The password is stored in the code as readable text. Anyone who can see the code can read the password out of it. There is no protection in the QR code itself, and no way to add one.

A photograph of the code taken from across a room is enough. The code does not expire, it cannot be revoked, and you cannot tell who has copied it.

So treat a printed WiFi code as a printed password, because that is what it is:

  • Use the guest network. Most routers have one. It gives internet access without exposing printers, network drives, or cameras on the main network.
  • Do not point it at your main network in a cafe, a shop, or a rental.
  • Change it when the code changes hands, for example when a tenant leaves.
  • Think about where it is visible from. A code in a window can be read from the street.

What phones do with it

Recent iPhones and Android phones both handle WiFi codes from the built-in camera. The phone shows a prompt offering to join the network rather than joining silently. Older devices may need a dedicated QR app, and a few very old ones do not support the format at all, so it is worth keeping the password written somewhere as a fallback.

More guides