Can someone steal my WiFi password from the QR code?

Yes, if they can see it. The password is stored in the code as plain text, so anyone who photographs it can read it. Use a guest network isolated from your internal systems, with a password you are happy to treat as semi-public, and keep the code away from windows facing the street.

Does a WiFi QR code work with WPA3?

Yes. Set the security type to WPA — the format has no separate WPA3 value, and phones treat WPA as "secured with a passphrase" then negotiate the actual protocol with your router. Inventing a WPA3 value would only break scanners.

Why does my WiFi code fail to connect?

Usually an unescaped special character in the password. Semicolons, commas, colons, quotes and backslashes end a field in the WiFi payload format and must be escaped with a backslash. The other common cause is a hidden network missing the H:true flag.

Do iPhones and Android phones both support this?

Both, from the built-in camera app. iOS has handled WiFi codes natively since iOS 11 and Android since version 10; older Android phones may need a scanner app. No app is needed on any current phone.

What size should I print a WiFi QR code?

About 4cm across for a table card or counter sticker, which covers a comfortable arm's-length scan. As a general rule a code wants roughly a tenth of its reading distance in width, so increase it for anything read from further away.

WiFi QR code generator

A WiFi code carries your network name and password in a format phones recognise, so a guest points a camera at it and taps Join. Nobody reads a password off a chalkboard or mistypes a capital I for a lowercase l.

The credentials are encoded into the symbol, which is worth understanding before you print one: anyone who can photograph the code can read the password out of it.

What should it do

Join a network without typing the password.

Content

Network name (required)

Password

Security

Hidden network

Design

Module shape

Eye frame

Eye centre

Error correction

Code colour

#111111

Background

#ffffff

Logo in the middle

What is actually inside the code

The payload is a single line in a format Apple and Google both parse: WIFI:T:WPA;S:NetworkName;P:ThePassword;; — the T field is the security type, S is the SSID and P is the password. A trailing double semicolon closes it.

Characters that would otherwise end a field have to be escaped with a backslash, specifically semicolons, commas, colons, double quotes and backslashes themselves. A password like pa;ss"word becomes pa\;ss\"word inside the payload. Get that wrong and the phone reads a truncated password and fails to join, which is the single most common reason a hand-built WiFi code does not work. The generator here does the escaping for you.

WPA2, WPA3 and open networks

Use WPA for anything password-protected, including WPA3. The format predates WPA3 and has no separate value for it; phones treat WPA as "secured with a passphrase" and negotiate the actual protocol with the router. There is no benefit to inventing a WPA3 value, and scanners will not understand it.

For an open network with no password, set the type to none and leave the password empty. WEP exists in the format but should not be used for a new network — it has been broken for two decades, and a code advertising it is a code advertising a vulnerability.

Hidden networks need one extra field

If your SSID is not broadcast, the payload needs H:true. Without it the phone looks for a visible network with that name, finds nothing and reports a failure that tells the guest nothing useful.

Hiding an SSID is not a meaningful security measure — the name is trivially recoverable from traffic — so if you hid it for that reason, consider unhiding it and relying on a strong passphrase instead. It makes the code more reliable and the network no less safe.

Who can read the password

The password is in the code in plain text. A photograph of the sticker is the password, and it cannot be revoked by any means short of changing the network. That is fine for a cafe guest network on the counter. It is not fine for your main office network, and a WiFi code taped to a window facing the street is readable from the pavement with a zoom lens.

The sensible pattern: a separate guest network, isolated from anything internal, with a password you are content to treat as public. Then the code is a convenience rather than a liability, and rotating the password only means reprinting a sticker.

Printing one that survives a cafe

Print at 4cm or more for a table card read at arm's length, and laminate it. A WiFi code lives on a surface where drinks get spilled, and a code with a damaged corner is a code that stops working — error correction covers a scattering of lost modules, not a missing finder pattern.

Download the PDF for anything going to a printer. It is vector, so it stays crisp at any size, and it has no resampling artefacts of the kind that turn a clean edge into a grey smear at small sizes.

Common questions

Can someone steal my WiFi password from the QR code?: Yes, if they can see it. The password is stored in the code as plain text, so anyone who photographs it can read it. Use a guest network isolated from your internal systems, with a password you are happy to treat as semi-public, and keep the code away from windows facing the street.
Does a WiFi QR code work with WPA3?: Yes. Set the security type to WPA — the format has no separate WPA3 value, and phones treat WPA as "secured with a passphrase" then negotiate the actual protocol with your router. Inventing a WPA3 value would only break scanners.
Why does my WiFi code fail to connect?: Usually an unescaped special character in the password. Semicolons, commas, colons, quotes and backslashes end a field in the WiFi payload format and must be escaped with a backslash. The other common cause is a hidden network missing the H:true flag.
Do iPhones and Android phones both support this?: Both, from the built-in camera app. iOS has handled WiFi codes natively since iOS 11 and Android since version 10; older Android phones may need a scanner app. No app is needed on any current phone.
What size should I print a WiFi QR code?: About 4cm across for a table card or counter sticker, which covers a comfortable arm's-length scan. As a general rule a code wants roughly a tenth of its reading distance in width, so increase it for anything read from further away.