# WiFi QR codes — how they work

> A WiFi QR code stores your network name, security type and password in a WIFI: string. Scanning it joins the network with no typing. The password is inside the code in plain text, so generate it locally — UseQR builds it in your browser and never sends it anywhere.

Source: https://useqr.app/wifi-qr-code · Last reviewed 2026-08-21 · UseQR is free forever, MIT licensed, no signup.

---

## The payload, field by field

```
WIFI:T:WPA;S:CafeGuest;P:espresso1234;H:false;;
```

| Field | Meaning | Values |
|---|---|---|
| `T` | Security type | `WPA`, `WEP`, `nopass` |
| `S` | SSID (network name) | any string |
| `P` | Password | omitted for `nopass` |
| `H` | Hidden network | `true` / `false` |

The trailing double semicolon is part of the format. Note there is no separate WPA3
value — WPA3 networks use `T:WPA`, and phones negotiate the actual protocol when they
connect.

## The escaping rule that breaks most hand-made codes

Four characters are structural and must be backslash-escaped inside `S` and `P`:

```
\   ;   ,   :   and the double quote "
```

A password of `p@ss;word` written literally terminates the password field early, and
the phone tries to join with `p@ss`. A network named `Bob's Café; Guest` is worse. This
is the single most common cause of "the QR code connects to the wrong thing" and it is
why generating by hand or with a naive template is a bad idea.

A password that is entirely hexadecimal digits and 64 characters long is interpreted as
a raw PSK rather than a passphrase; wrap it in double quotes if it is genuinely a
passphrase that happens to look like hex.

## Hidden SSIDs

If your network does not broadcast, `H:true` is required. Without it, the phone
searches for a visible network of that name, fails, and reports that it cannot connect
— even though every other field is correct.

## What does not work

- **Enterprise networks (WPA2/WPA3-Enterprise, 802.1X).** The `WIFI:` format has no
  fields for identity, EAP method or certificates. There is no way to encode a
  corporate network this way. Use your MDM's provisioning profile instead.
- **Captive portals.** The code joins the radio network; the user still has to accept
  the portal terms in a browser.
- **Networks with MAC filtering.** Joining will still be refused.

## Platform support

- **iOS 11+**: native camera, works from the photo library too.
- **Android 10+**: native camera; Android also has a built-in *share this network*
  screen that produces the same format.
- **Windows and macOS**: no native handler. Desktop users see the raw string.

## The privacy point that matters

Your WiFi password is inside the code in plain text — anyone who scans it, or who
photographs the printed card, has your password. That is inherent to the format.

What is *not* inherent is sending that password to a website. Most online WiFi QR
generators post your SSID and password to their server to render the image. UseQR
generates the code entirely in your browser, and deliberately keeps the password out of
the page URL as well, so it is never in your history, never in a referrer header, and
never on anyone's server.

For a shop or café, put the code on a card at the counter rather than in the window, and
use a guest network separated from your point-of-sale.

## FAQ

### Is my WiFi password sent to a server?
Not with UseQR. The code is built in your browser and the password is deliberately excluded from the page URL. Most other online generators do send it to their servers to render the image.

### Which security type should I choose for WPA3?
Choose WPA. The WIFI: format has no WPA3 value; phones negotiate WPA3 automatically when both ends support it.

### Why does my WiFi QR code connect to the wrong network or fail?
Almost always an escaping problem. Semicolons, colons, commas, backslashes and quotes inside the SSID or password must be backslash-escaped, or the field terminates early. Hidden networks also need H:true.

### Can I make a QR code for a corporate 802.1X network?
No. The WIFI: format has no fields for enterprise identity, EAP methods or certificates. Use a device-management provisioning profile instead.

### Does it work on iPhone and Android?
Yes — iOS 11 and later, and effectively all current Android versions, connect straight from the camera app. Desktop operating systems have no native handler.

## Try it

- https://useqr.app/wifi
- https://useqr.app/wifi-card
- https://useqr.app/validate