glunty A WiFi QR code is a small square that a phone camera reads to join a network without anyone typing a password. It is convenient for a cafe counter, a guest room, or an office lobby. Under the surface there is no magic: the code holds a short, structured text string that describes your network, and the phone parses it. Once you understand that string, you can make one in seconds and avoid the mistakes that quietly break the scan.
The WIFI: string format
Every WiFi QR code encodes one plain-text line in a documented format. The shape is:
WIFI:T:WPA;S:MyNetwork;P:s3cr3tpass;;Read it field by field. T is the security type. S is the SSID (the network name). P is the password. Each field ends with a semicolon, and the whole record ends with a second semicolon, which is why you see the double ;; at the end. When your phone camera recognizes this prefix, it offers a “Join network” prompt instead of opening a web page.
There are a few optional fields. H:true; marks a hidden network so the phone still connects when the SSID is not broadcast. Some newer devices accept T:WPA3; explicitly. If you leave a field empty, keep its delimiter: an open network with no password is written as WIFI:T:nopass;S:MyNetwork;;.
How encryption types work
The T value tells the phone how to authenticate. There are three practical choices.
WPA covers WPA and WPA2, and in practice it also works for WPA3 personal networks on most modern phones. This is the value you want for almost every home or business router.
WEP is the ancient, broken standard. You will only see it on very old hardware, and you should replace that hardware rather than rely on it.
nopass means an open network with no password at all. When you use nopass, the P field is empty or omitted entirely. A guest network with no key uses this.
A common failure is setting T:WPA; while leaving the password blank, or setting T:nopass; while still supplying a password. The phone trusts the T value, so a mismatch produces a failed join with no useful error. Match the type to reality.
Escaping special characters
This is where hand-typed strings go wrong. The characters \, ;, ,, ", and : have meaning inside the format, so if your SSID or password contains one, you must escape it with a backslash.
Say your password is p;a:ss. Written raw, the semicolon ends the password field early and the join breaks. Escaped correctly it becomes P:p\;a\:ss;. The same rule applies to a network name like Joe's Cafe, Downtown: the comma needs a backslash, giving S:Joe's Cafe\, Downtown;.
One more rule: if an SSID is purely hexadecimal digits, some parsers guess it is hex-encoded rather than literal. To force literal text, you can add H handling on the parser side, but the safest move is to let a tool build the string for you. The QR code generator escapes these characters automatically, so a password full of symbols encodes correctly the first time.
Static versus dynamic codes
A WiFi QR code is static. The password is baked into the image itself. There is no server call, no redirect, and nothing to expire. That is a feature: it works offline and forever, which is exactly what a printed sign needs.
Some commercial services sell “dynamic” WiFi codes that actually encode a URL pointing at their server, which then shows the credentials. That adds a tracker, a point of failure, and a company between your guest and your network. For a real WiFi join code you want the static WIFI: string, not a redirect.
Privacy: the password is in the picture
Here is the part most guides skip. A WiFi QR code stores your password as readable plaintext inside the image. Anyone who photographs the sign, or opens the image file, can decode the string and read the password directly. The QR code is not encryption; it is just a compact way to write text a camera can read.
So treat a printed code like a printed password. Do not post your main network’s code in a public window if that network also reaches your files or devices. The clean pattern is a separate guest network with its own password, isolated from everything private, and only that code goes on the wall.
Building one
To make yours, generate the QR from the WIFI: string above using the QR code generator. If you also need to share a login page or a captive-portal link, the URL encoder helps you build a safe, escaped web address to encode instead. Both run in your browser, so the password never leaves your device.