How to Make a Wi-Fi QR Code - and Which Network You Should Never Use

A Wi-Fi QR code saves your guests from typing a 20-character password. It also stores that password as readable text, which decides for you which network it should point at.

Reading a Wi-Fi password out loud is a small, recurring humiliation. It is always Tr0ub4dor&3xK! and it is always taped to the back of a router in a cupboard. A QR code on the table solves it: phone camera, tap, connected.

It is genuinely one of the better uses of a QR code. It is also the one with a security property most people do not know about, and that property should decide which network you point it at.

What is actually inside the code

A Wi-Fi QR code is not magic and it is not a link. It is a short piece of structured text that phones know how to interpret, and it looks like this:

WIFI:T:WPA;S:MyNetwork;P:hunter2;;

T is the security type, S is the network name, P is the password. Scan it and your phone offers to join that network with those credentials.

Which brings us to the part that matters.

The password is stored as plain text

The password is not encrypted. It is not hashed. It is written into the code as readable text, and anything that can read a QR code can read it back out.

That is not a flaw in any particular generator - it is how the format works. It has to be plain text, because the phone needs the actual password to join the network.

The practical consequences:

• Anyone who photographs your sign has your password, permanently, whether or not they ever connect.
• Anyone who walks past and scans it has it too. They do not need to be a customer, a guest, or in the building for more than a second.
• Once a code is printed and put on a wall, you have effectively published that password. Taking the sign down does not unpublish it.

None of that is a reason to avoid Wi-Fi QR codes. It is a reason to be deliberate about which network the code points at.

Use the guest network. Only the guest network.

The rule is short: a Wi-Fi QR code should point at a network that reaches the internet and nothing else.

Not the network your NAS is on. Not the one with the network printer, the security cameras, the smart locks, or the laptop with your accounts on it. Not the office network. A password on a wall is a password everyone has, and the only safe assumption is that everyone does.

Most consumer routers have had a guest network feature for a decade. Turn it on, give it its own password, and make sure client isolation is enabled if the router offers it - that stops devices on the guest network from seeing each other, which matters in a café or a waiting room where strangers share the same network.

If your router genuinely cannot do a separate guest network, that is your answer: do not print the code. Read the password out.

Two more habits worth having:

• Rotate it. A guest password that has been on a wall for three years has been collected by a lot of phones. Change it when you reprint the sign, and reprint the sign periodically.
• Do not reuse it. The guest password should exist nowhere else. Not on another network, not on an account, not as a variation of something else you use.

Generating one

The Wi-Fi QR code generator takes the network name, the password, and the security type, and builds the code in your browser. Nothing is uploaded, which for this particular tool is not a nice-to-have - you are typing a password into a form, and it should not travel anywhere.

A few fields people get wrong:

Network name has to match exactly. SSIDs are case-sensitive, spaces count, and a trailing space you cannot see will break it. Copy it from your router's admin page rather than typing it from memory.

Security type is almost always WPA. The WPA option covers WPA, WPA2, and WPA3, which is everything modern. Choose "no password" only for a genuinely open network - and be aware that an open network is a different security conversation, not a simpler one. WEP exists in the list for old hardware and should be treated as equivalent to open.

Hidden networks need the hidden flag set. If your network does not broadcast its name, the code has to say so or the phone will look for a visible network and fail to find it. Hiding an SSID is not a meaningful security measure, incidentally - it just makes the code slightly more annoying to get right.

Printing it so it actually scans

A Wi-Fi code holds more data than a short link does, which makes it denser, which makes it less forgiving in print. A few things follow from that.

Size it for the distance. The rough rule of thumb is that a QR code should be about a tenth of the distance it will be scanned from. A code on a café table read from 30 cm away can be 3 cm across. A code on a wall people scan from two meters needs to be 20 cm. Being generous costs nothing.

Leave the quiet zone alone. The blank margin around the code is part of the code - scanners use it to find the edges. Designers crop it constantly, and it is one of the most common reasons a code that worked on screen fails in print. Keep a border at least four modules wide.

Keep it dark on light. Many scanners will not read an inverted code, and a low-contrast color scheme that looks elegant on a mockup fails under a dim restaurant light. Dark code, light background, high contrast.

Download the SVG for print. The generator will give you a PNG or an SVG. SVG is vector, so it stays crisp at any size - use it for anything going to a printer, and use the PNG for screens. If you need a large PNG, the size goes up to 2048px.

If you add a logo, test it. The generator supports dropping a logo in the middle and automatically switches to the highest error-correction level to compensate, which is what makes it work at all. It still adds risk. Scan the printed piece with more than one phone before you order five hundred of them.

That last point generalizes: test-scan the printed thing, not the file on your screen. Paper, ink bleed, lamination glare, and lighting all differ from a monitor, and the failure mode is discovering it after the print run.

The short version

• A Wi-Fi QR code stores the password in readable text. Assume it is public.
• Point it at a guest network with client isolation, never your main one.
• Match the SSID exactly, pick WPA, flag hidden networks.
• Size it to a tenth of the scanning distance, keep the quiet zone, keep it dark on light.
• Export SVG for print, and test-scan the printed copy.

Do that and you get the good version of this: guests connect in two seconds, and the worst case is that a stranger uses your guest bandwidth.