Café guest network
A standard WPA2 network for customers, printed on a table card. The most common use of a WiFi QR code by a wide margin.
Encoded as
WIFI:T:WPA;S:Cafe Guest;P:flatwhite2026;;Let guests join your network by pointing a camera at it, no password typing.
Generated on your device. Nothing you type is sent anywhere.
A WiFi QR code stores your network name, password and security type in a single scannable pattern. When someone points their camera at it, the phone offers to join the network directly — nobody reads a password off a wall or mistypes a string of random characters. The code is generated here in your browser and never sent anywhere, which matters more for this payload type than for most: a WiFi code contains your actual password in plain text, so any generator that uploads it to a server has been handed your credentials. The pattern itself is not encrypted, so treat a printed WiFi code exactly as you would treat the password written out in full.
A strong WiFi password is deliberately hard to say out loud. Encoding it removes the entire exchange — no spelling out characters, no confusion between capital I and lowercase l, no repeating it across a noisy room.
A code is harder to read from a photograph taken across the street than a password printed in large type. It is not security, but it does raise the effort required to collect the credential casually.
Both iOS and Android read WiFi codes with the built-in camera app. There is nothing for a guest to download, which matters when the reason they want WiFi is that they have no working data connection.
Print it once and it keeps working until you change the password. For a café or a holiday let that is the difference between explaining the network dozens of times a week and never explaining it at all.
A standard WPA2 network for customers, printed on a table card. The most common use of a WiFi QR code by a wide margin.
Encoded as
WIFI:T:WPA;S:Cafe Guest;P:flatwhite2026;;A password with reserved characters in it. The semicolon is escaped automatically — without that, the payload would be cut short and the phone would try to connect with an incomplete password.
Encoded as
WIFI:T:WPA;S:Studio-5G;P:correct\;horse\:battery;;A public network with no password at all, such as a waiting room or a municipal hotspot. The password field is left empty and the security type is set to Open.
Encoded as
WIFI:T:nopass;S:Clinic Public;P:;;Type the Network name (SSID) precisely as it appears in your phone's WiFi list. Capitalisation and spaces matter — "Cafe Guest" and "cafe guest" are different networks as far as the scanner is concerned, and a mismatch produces a code that silently fails to find anything.
Enter the Password and choose the Security type. Almost every modern router uses WPA2 or WPA3, and both are covered by the WPA2 option. Only pick WEP if you are working with genuinely old equipment, and choose Open for a network with no password at all.
A hidden network does not broadcast its name, so the phone needs to be told to look for it explicitly. Ticking this box for a normal network can prevent some Android devices from connecting, so leave it unticked unless you deliberately disabled SSID broadcast.
Export the code and scan it with at least one iPhone and one Android device before you print it at any volume. This is the single step most people skip, and it catches nearly every problem described further down this page.
The WiFi format uses semicolons and colons as separators, so a password containing those characters must be escaped or the payload ends early. This is the most common failure in hand-built WiFi codes, and the symptom is misleading: the code scans perfectly and the phone offers to join, then fails authentication with a generic error. This generator escapes backslash, semicolon, comma, colon and double-quote automatically, so any password you paste in will survive intact.
The hidden flag tells the device to actively probe for a network that does not announce itself. Setting it on a normal broadcasting network causes some Android builds to fail the connection entirely rather than fall back gracefully. Only tick it if you deliberately turned off SSID broadcast in your router settings.
Network names are case-sensitive and whitespace-sensitive. A trailing space copied from a router admin page, or "Guest_WiFi" typed as "Guest WiFi", produces a code that scans cleanly and then reports that the network cannot be found. Copy the name from your phone's WiFi list rather than from memory.
A WiFi payload is longer than a short URL, so the pattern is denser and needs more physical space to remain readable. Below roughly 2 cm square many phone cameras struggle, particularly in the dim lighting typical of a bar or restaurant. Print at 3 cm or larger for anything that will be scanned at arm's length in imperfect light.
The password is stored inside the pattern itself, so rotating it makes every card, sticker and poster you printed stop working at the same moment. If you rotate credentials on a schedule, plan the reprint into that schedule, or keep the guest network on a separate password that changes less often.
iOS has read WiFi QR codes from the built-in Camera app since iOS 11, and Android since version 10 — earlier Android versions need a dedicated scanner app or the WiFi settings screen. On both platforms the phone shows a confirmation prompt rather than joining silently, which is a deliberate safety measure and cannot be bypassed. Some third-party scanner apps read the code as plain text and display the raw WIFI: string instead of offering to connect; that is a limitation of the app, not the code. Windows and macOS have no built-in support for joining a network from a scanned code, so a laptop user will still need the password typed in manually.
The payload follows the WIFI: scheme with T, S, P and H fields terminated by a double semicolon. WPA3 is encoded as WPA rather than a distinct token, because no scanner implements a separate WPA3 value and WPA is what phones use to join WPA2/WPA3 mixed-mode networks. Open networks still emit an empty password field, since several Android builds drop the final field entirely when it is absent.
The code contains the password in plain text — anyone who scans it, or who decodes a photograph of it, gets the credential. Treat a printed WiFi code exactly as you would treat the password written out in full: fine on a café table, unwise on a poster visible from the street. For a home network it is safer to use a separate guest network so the main password is never encoded at all.
No. The code is built by your own browser using JavaScript, and no request is made while you type. You can verify this by opening your browser's developer tools, switching to the Network tab, and watching it stay empty as you fill in the form. There is no server here to receive it.
Yes. Choose the WPA2 option — the format has no separate WPA3 token, and every scanner treats WPA as covering both. This is also what allows the code to work on mixed-mode networks, where the router accepts WPA2 and WPA3 clients on the same SSID.
Almost always one of three things: the network name does not match exactly, including capitals and spaces; the hidden checkbox is ticked for a network that is not actually hidden; or the password itself is wrong. Copy the network name directly from your phone's WiFi list rather than typing it, and confirm the password by joining manually once first.
At least 3 cm square for anything scanned at arm's length, and larger for dim rooms or codes read from further away. WiFi payloads are denser than short links because they carry the network name and password, so they need more physical space than a code pointing at a URL.
No. The password is encoded inside the pattern, so changing it breaks every printed copy simultaneously. This is a property of static QR codes generally: nothing sits between the code and the network that could be updated later. Plan reprints alongside any credential rotation schedule.
This generator is part of location & venue QR codes — see the whole group, and what to decide before you generate one.