Guides

WiFi QR codes: what a scan actually shares

A WiFi QR code is a note that says “join this network, here is the password.” Phones that understand the note offer a Join button. Anyone who photographs the note has the password, whether or not they join.

Updated 28 October 2026

The string QRazyQR writes

Open the generator, choose the WiFi tab, and fill in the network name, the password, and the encryption. The page does not upload those fields. It builds a single line of text and draws that line as a QR symbol. For a typical home router the line looks like this:

WIFI:T:WPA;S:HarborGuest;P:correct-horse;;

T is the authentication type. S is the network name, the SSID. P is the password. The record ends with two semicolons. That shape is the one Android and iOS have recognized for years. It is not a link, and it does not come back to qrazyqr.com when someone scans it.

The encryption menu has three choices, and they map straight into T:

• WPA/WPA2. This is the right choice for almost every router sold in the last decade, including networks that say WPA2-Personal or WPA2/WPA3 mixed. The string uses T:WPA. There is no separate WPA3 item. The phone still negotiates with the router. The code only hands over the password. If a network is locked to WPA3-only and a phone refuses to join, that is a mismatch between the phone and the router, not a missing checkbox. Mixed WPA2/WPA3 mode on the router is the usual fix.
• WEP. Old and weak. Only pick it when the access point truly is WEP. A WPA password written as WEP will not join.
• None. An open network. The tool writes WIFI:T:nopass;S:HarborGuest;; and leaves the password out on purpose. If you typed a password and then switched the menu to None, the password is not included. That is deliberate. An open network has nothing to encode.

Characters that break a careless string

Semicolons, commas, colons, double quotes, and backslashes are reserved, because they are the punctuation of the record itself. A password typed as a;b would split the record in half if it were inserted raw: the scanner would see a password of a and then a stray field. QRazyQR escapes those characters with a backslash before it draws the code, which is what the common phone parsers expect. a;b is written as a\;b. A backslash already in the password is doubled.

Spaces at the start or end of the name or password are trimmed. Spaces in the middle are kept. Harbor Guest and HarborGuest are different networks, and the code will follow whatever you typed. Emoji and unusual scripts are legal in an SSID and legal in a QR payload, but a few older phones render them badly. If the network name is decorative, test the phone your guests actually carry before you print a stack of cards.

The tool does not add the hidden-network flag (H:true). Hidden SSIDs are a poor guest experience anyway: the name is still easy to observe, and some phones will not join from a code unless the network is broadcasting. Make the guest network visible.

Put it on the guest network

The code is the password. Treat the print the way you would treat a sticky note on the fridge. A visitor can join, and they can also AirDrop the photo to someone who is not in the house. That is fine for a guest network that only reaches the internet. It is a bad idea for the network your laptops, printers, and file shares trust.

Practical placements:

• Inside a rental, on the welcome card, not in the listing photos. A photo in the listing is a public copy of the password.
• In an office kitchen or a conference room, for the guest SSID. Rotate that password when someone leaves who should not keep it, and replace the card the same day. The old card keeps working until you do. There is no remote off switch, because the password is in the ink.
• Not in a street-facing window, unless the network is meant to be public.

Paper fades, and thermal receipts fade faster. A laminated card or a small frame lasts longer than a scrap taped to the router. When you change the password, throw the old card away. Do not stack the new sticker on top of the old one and hope. People peel stickers. The safety guide explains why a layered sticker is also how QR phishing works, and you do not want your own card to look like one.

How phones behave

On an iPhone, the Camera app is enough. Point it at the code, wait for the banner with the network name, and tap join. The join is a separate confirmation. The code does not silently attach the phone to the network.

On Android, the camera or the quick-settings scanner usually offers to join. Some skins copy the password to the clipboard instead and leave you to paste it into WiFi settings. Both are normal. A laptop webcam is a bad test. These codes are for phones.

If the phone shows the raw WIFI: line instead of a join button, that camera app does not understand the format. Try the built-in camera rather than a third-party scanner. The string can still be correct.

Test before you print

Make the code, scan it with a phone that is not already joined to that network, and load an ordinary web page. Forget the network and scan again if you want a clean test. Then download. PNG is enough for a screen or a slide. SVG is the file to send a printer, because it stays sharp at any size. The preview on the page is shrunk to fit. Do not photograph your monitor.

Leave a pale margin around the symbol when you place it. The download is the modules only. The print guide covers the quiet zone and which error-correction level to pick if the card will live in a pocket. For a card that stays indoors and clean, the default level M is enough. Dark modules on a white field scan more reliably than a stylish low-contrast print. See color and contrast.

QRazyQR never receives the SSID or the password. Closing the tab drops them. There is no history on our side to delete later. That also means we cannot remind you what you encoded. The card in the kitchen is the record. If a code misbehaves in a way the steps above do not explain, write to contact@qrazyqr.com and describe the phone and the encryption type. Leave the live password out of the email.