What is inside a WiFi QR code

The grammar

The format is not an internet standard with an RFC behind it. It is a convention that came out of the ZXing barcode library and that every phone camera now implements. A payload for a normal password-protected network looks like this, and this is the real output of the same function that builds ours:

WIFI:T:WPA;S:Northwind Guest;P:roast-2026-summer;;

• T is the security type · WPA covers WPA, WPA2 and WPA3, WEP is the obsolete one, and nopass is an open network.
• S is the network name · the SSID, exactly as broadcast, case included.
• P is the password · in plain text. On an open network it is present and empty, which is why the payload still ends the same way.
• The trailing ;; is not a typo · one semicolon closes the last field and one closes the record. Payloads missing it are a common source of readers that decode the text but refuse to offer the join.

An open network, for comparison:

WIFI:T:nopass;S:Northwind Lobby;P:;;

The escaping rule, which breaks more codes than anything else

Because semicolons and colons separate the fields, a network name or password containing one has to be escaped with a backslash. The characters that need it are the backslash itself, the semicolon, the comma, the colon and the double quote. Here is a network whose name has a colon and whose password has two semicolons, built correctly:

WIFI:T:WPA;S:Cafe\: Northwind;P:pour\;over\;2026;;

Skip the backslashes and the phone reads the password as ending at the first semicolon. The code encodes, prints and scans perfectly while joining nothing, which is the worst failure mode available: it looks correct until somebody tries it. If you have a card already printed and are not sure, our free decoder reads it back and shows you the exact text, escaping included.

The password is the print

Everyone eventually asks whether this is safe. The honest answer is that the code is exactly as secret as the piece of paper it is on. There is no encryption in the format and there cannot be: the whole point is that a phone with no network connection can read the credentials and join, so the credentials have to be sitting there in the pattern.

• Anyone who photographs the card has the password · from across the room, from a photo somebody else posted, from a shot of your window taken from the street.
• Which is what a guest network is for · put the code on a network that reaches the internet and nothing else, and the exposure stops mattering.
• Rotating the password means rotating the print · every table tent, every welcome folder, every laminated card by the kettle. That is the real cost of a static WiFi code, and it is a cost measured in rooms rather than in money.

What a code cannot do for you

• Join a network from a web page · no phone allows it, from any browser, on any operating system. Only a decoded WIFI: payload triggers the join prompt, which is why a code that points at a website can never be the one-tap version.
• Get past a captive portal · the code can join the radio network; the sign-in page still appears. A hotel or airport portal is a separate hurdle the format knows nothing about.
• Reliably reach a hidden network · handling varies between phones, and a printed card is a bad place to discover which ones your guests carry.

If the password changes

This is the one place we have something to sell, so here it is with the limitation stated first. A dynamic WiFi code encodes a short link rather than the credentials, and a scan lands on a page showing the network name and the password with a copy button beside each. That page cannot join the network for the reader, because of the rule above. It is genuinely worse at the one thing a WiFi code is for.

What it buys is that the password becomes an edit rather than a print run. Change it in the morning and every card in the building is correct by lunchtime, on the same printed square. For a cafe with four table tents that is a bad trade. For a co-working floor, a rental portfolio or a serviced office rotating a guest password every quarter, it is often the only version that does not quietly go stale on the wall.

If your network name and password are settled, take the static one and do not pay us anything: the free WiFi generator builds it in your browser, and what you type never leaves the page. Static vs dynamic works through the general form of this decision.

Our numbers, in public

The static generator is free, unmetered and account-free, because a static code has nothing behind it that we could charge for. A dynamic WiFi code costs 1 credit to create, once, and 1 credit per scan, prepaid, with no subscription and no surcharge for the kind. Credits are valid 18 months and any top-up rolls the whole balance forward. At a zero balance scans keep resolving for 14 days or 5% of your last top-up, whichever ends first; after that a scanner sees a paused page saying whose code it is, never an ad. The anti-trap pledge that holds us to this is public.

Questions

What is inside a WiFi QR code?

A single line of text in a fixed format, not a link. It names the security type, the network name and the password, in that order: WIFI:T:WPA;S:Northwind Guest;P:roast-2026-summer;;. The phone reads that text offline and offers to join. Nothing is looked up and no server is involved, which is why a WiFi code works with no internet connection and why nobody can switch it off.

Can someone read my WiFi password from the printed code?

Yes. The password is in the pattern in plain text, and any decoder will read it back, ours included. That is not a flaw in the format, it is the format: the phone has to be handed the password in order to join. Treat the printed card exactly as you would treat the password written out, which is what guest networks exist for.

Why did my WiFi QR code stop working?

Almost always because the password or the network name changed. The old value is in the ink and no generator can edit it after printing, so the honest fix for a static card is a new card. The other common cause is escaping: a password containing a semicolon, comma, colon, quote or backslash has to be backslash-escaped, and a hand-built payload that skips that produces a code the phone reads as truncated.

Can a QR code join a hidden network or a captive-portal network?

A hidden network needs the network name typed in as well, and support for that varies by phone, so a printed code is a poor bet there. A captive portal is a different thing entirely: the code can join the radio network, and the sign-in page still appears afterwards. Neither is something a QR code can carry you past.

Is there a WiFi code I can change without reprinting?

There is, with a real limitation attached. A dynamic WiFi code encodes a short link, and the scan lands on a page showing the network name and password with a copy button. It cannot join the network for the reader, because no phone lets a web page do that. So it is strictly worse at connecting and it is the only version that survives a password rotation. Which of those matters more is your call, not ours.

What does the free WiFi generator cost?

Nothing, with no account and no upload · the payload is built in your browser and the password never reaches us. A dynamic one costs 1 credit to create, once, and 1 credit per scan, with credits valid 18 months.