2026-11-04

Wi-Fi QR Code: Let Guests Join Without Typing a Password

A Wi-Fi QR code is a plain text payload that a phone camera reads and offers to join a network. It does not connect anyone to the internet by itself, and it does not need a server to work: the SSID, the security type and the password are encoded directly in the symbol. That simplicity is the point, and also the limit — anyone who can photograph the code can read the password.

The recipe below is the one every current phone understands. Print it where the guest already is — the table, the counter, the waiting area — and joining shrinks to a single tap.

What a Wi-Fi QR code actually contains

The payload uses the WIFI: scheme with semicolon-separated fields. Only the security type (T), the SSID (S) and the password (P) are required for a protected network; H marks a hidden SSID. The order does not matter, and the payload ends with a double semicolon.

Special characters are escaped with a backslash: \; for a semicolon, \: for a colon, \, for a comma and \\ for a backslash. A password containing a semicolon is the most common reason a Wi-Fi code silently fails. Keep the whole payload well under a thousand characters; shorter payloads produce a coarser module grid that scans from further away.

Generate the code in four steps

• Open the QR generator and choose the QR Code format.
• Paste WIFI:T:WPA;S:Cafe-Guest;P:espresso2026;; into the data field. The trailing double semicolon closes the last field and the payload.
• Set error correction to at least M and keep the four-module quiet zone, so a scuffed table card still scans.
• Export SVG for print, PNG at 4× for a web page, or PDF for a table card.

What iPhone and Android cameras do with it

On iOS 11 and later the built-in Camera app recognises the payload and shows a Join Network banner; the scanner in Control Center behaves the same way. Android 10 and later offers the join prompt from the camera or the Quick Settings tile. Neither route sends the password to a third-party service: the phone parses the symbol locally.

• iPhone: unlock, open Camera, point at the code, then tap the notification.
• Android: open Camera or Quick Settings, choose the QR scanner, and confirm the network.
• Older Android devices may fall back to Google Lens or a third-party scanner.
• A guest network with client isolation is the right place for a code anyone in the room can photograph.

Hidden networks, guest access and password rotation

Hidden networks are supported through H:true, but they are a poor fit for a public code: the phone cannot list the network, the join depends on the exact SSID string, and some Android skins still refuse. Broadcast the guest SSID instead. When you rotate the password the printed code does not update, so plan for a card you can reprint or an insert behind a sleeve.

Limit what the guest can reach. A guest VLAN, a bandwidth cap and a scheduled password change are the controls that matter; the code itself has no permissions to grant. Never publish the code for the network that also carries your point-of-sale or back-office devices.

Size, placement and printing

The symbol must be large enough for a phone held at arm’s length. A 25 mm square is a workable minimum for a table card and 40 mm or more is better on a wall. Keep the quiet zone clear, print dark modules on a light background, and prefer matte lamination: a glossy film reflecting a ceiling light is the second most common failure after a mistyped password.

• Table card: 40–60 mm printed square, matte laminate.
• Wall poster: 80–120 mm, read from one to two metres.
• Avoid glass, acrylic stands and shrink wrap without testing from the guest’s seat.
• Test with both an iPhone and an Android phone before the print run; camera pipelines differ more than the specification suggests.

Frequently asked questions