Wi-Fi QR code generator

The payload looks like `WIFI:T:WPA;S:name;P:password;;`. Fields are separated by semicolons and keys from values by colons, so a password containing `;` or `:` ends the field early and everything after it is read as the next key. The de-facto rule — not a published standard, just what Android established and everything copied — is a backslash before `\`, `;`, `,`, `:` and `"`.

Generated passwords contain those characters routinely, and a generator that skips the escaping produces a code that fails with no diagnosis at all: the phone joins, the handshake rejects a truncated password, and the message says the password is wrong. This page escapes all five. If you have been given a code that does not work with a punctuation-heavy password, that is almost certainly why.

An SSID is a byte string, not a name, so `CafeWiFi` and `cafewifi` are different networks as far as the radio is concerned. Copying it from the router’s label rather than from the phone’s list is where this goes wrong, because printed labels are not always faithful about capitalisation.

A trailing space is the other one, and it is invisible. Some routers ship with one, and a code built from a name with a space at the end simply finds no network. If the code does nothing at all when scanned — no error, no prompt — the name is the first thing to check.

The format defines three security values: `WPA`, `WEP` and `nopass`. WPA2 and WPA3 both use `WPA`, and there is no `WPA2` or `WPA3` token — inventing one produces a code that nothing joins, which is a mistake several generators have made.

WEP appears only because the format is old. If your network actually uses WEP, the QR code is not your most urgent problem: it has been broken since 2001 and the key can be recovered from a few minutes of captured traffic. The right fix is the router’s settings page, not a nicer way to distribute the key.

A network that does not broadcast its name needs `H:true` in the payload, or the phone will look for a visible network of that name and never find it. That is what the checkbox sets.

Worth saying plainly: hiding the name provides no security. The name is transmitted in the clear whenever a device that knows it goes looking, so it is trivially discoverable — and it makes your devices broadcast that name everywhere else they go, which is worse for the people carrying them. It is a setting people turn on believing it hardens the network; it does the opposite.

iOS has read these from the camera since iOS 11, and Android since 10 — on both, scanning offers a prompt rather than joining silently. Older Android needs the Google Lens or a QR app, which most phones have anyway.

What generally does not work is a laptop. Windows and macOS have no built-in path from a scanned code to a Wi-Fi join, so a code taped to the wall of a co-working space serves phones and tablets and leaves laptop users reading the password off the card. That is an argument for printing the password underneath the code, not for skipping the code.

A card with only a code is a card that fails for the laptop, the old phone, and the guest whose camera app has been replaced by something unhelpful. The code should save the typing, not be the only route.

It also removes the trust problem: a guest who can read the password can verify that the code goes where it claims. A code alone asks people to scan something unverifiable on a wall, which is a habit worth not encouraging in a public space.

Anyone who photographs the card has the password permanently, and QR codes photograph well from across a room. For a home network that is worth thinking about; for a café it is the intended behaviour.

If a router supports a guest network, that is the one this code should carry. A guest network isolates clients from each other and from the printer, the NAS and the cameras, and it can have its password rotated without re-pairing everything in the house. The QR code then makes rotation cheap: print a new card instead of telling forty people a new string.

The payload is assembled and encoded in your browser. No request carries the network name or the password, and the network panel will show that while you use it — which is worth doing here more than almost anywhere else on this site, because this is a page you are typing a live credential into.

The practical reading: this is safe to use for a real network. A generator that renders the image on a server has received your SSID and your password in plain text and has them in its logs, and it is a credential you cannot easily rotate — every device that has joined has to be told the new one.