Scanning a QR code to join a WiFi network — printed on a card at a coffee shop, taped to a router, shown on a conference registration screen — feels like a built-in phone feature, but it's actually a simple, informally-standardized text format that any camera app chooses to recognize and act on. This post covers exactly how that format works, where it came from, and what it can't do.
A de facto standard, not an official one
There's no IEEE, IETF, or Wi-Fi Alliance specification defining the WiFi QR code format — it originated with ZXing ("Zebra Crossing"), an open-source barcode-processing library, and its companion Barcode Scanner Android app. Google's own Android camera later adopted the same format for native WiFi-joining support, and Apple followed with iOS's built-in camera. Because the two dominant mobile platforms both implemented the same informal format independently, it became a working universal standard in practice, without ever going through a formal standardization process.
The format itself
WIFI:T:<type>;S:<ssid>;P:<password>;H:<hidden>;;Four fields, each optional except the type and SSID:
- T — security type:
WPA(covers WPA, WPA2, and WPA3 personal/pre-shared-key networks — the format doesn't distinguish between them),WEP(legacy, rarely relevant today), ornopassfor an open network with no password at all. - S — the SSID (network name), required in every case.
- P — the password, omitted entirely for
nopassnetworks. - H —
trueif the network is hidden (doesn't broadcast its SSID), omitted otherwise.
The string starts with the literal WIFI: prefix (which is how a scanner recognizes this specific format rather than treating the code as plain text or a URL) and ends with a double semicolon, terminating the field list.
Why escaping matters here specifically
Semicolons separate fields and colons separate each field's label from its value — which means a literal semicolon, comma, colon, or backslash inside an actual SSID or password has to be distinguished from the format's own structural characters. The convention is a backslash before each of those four characters:
Raw password: Joe's;Cafe:2026
Escaped for the QR string: Joe's\;Cafe\:2026Skipping this for a password that happens to contain one of those characters produces a QR code that scans successfully but fails to actually join the network — the scanner reads a truncated or misparsed password, and the failure looks like a wrong password rather than a formatting bug, which makes it a frustrating one to diagnose without knowing the format's escaping rule exists.
What the format deliberately can't do
It only covers personal networks authenticated with a single shared password. Enterprise (802.1X) networks — the kind that ask for a username and sometimes a certificate rather than just a shared password — have no representation in this format at all; joining one still requires manual configuration, since there's no standardized way to encode a username, certificate, or EAP method choice into this string.
OS-native alternatives that skip QR codes entirely
Both major mobile platforms also offer a QR-free path for a narrower case: sharing a network with someone already nearby. iOS lets one iPhone share its saved WiFi password directly with another Apple device over a proximity-based exchange (built on the same underlying mechanism as AirDrop), and Android offers an equivalent nearby-share flow for passing a saved network's credentials device-to-device. Neither replaces the QR format's actual advantage — working across platforms, printable on physical media, and scannable by a device that has no prior relationship with the sharer at all — which is exactly the scenario a printed guest-WiFi card or a conference registration screen needs.
A related but different mechanism: WPS
WiFi Protected Setup (WPS) solves a similar "make joining easier" problem through a completely different mechanism — a physical PIN or button-press on the router itself, rather than a scannable code. WPS has a well-documented history of security weaknesses in its PIN-based mode (a limited PIN keyspace made brute-forcing practical on many implementations), which is unrelated to the WiFi QR code format covered here; QR-based sharing doesn't inherit any of WPS's specific vulnerabilities, since it's simply transmitting the same information a person would otherwise type in by hand.
The security question: does a QR code change anything?
Not fundamentally — a QR code encoding a WiFi password grants exactly the same access as the password itself, whether it's scanned, typed, or read aloud. What changes is convenience and, correspondingly, exposure: a QR code printed on a physical sign in a semi-public space (a cafe, a shared office) is scannable by anyone who can see it, the same way a written password would be — the format itself adds no new risk beyond however visible the code is placed.
Where this shows up in practice
Guest WiFi cards at businesses, onboarding cards for IoT devices that need initial network credentials, conference and event WiFi shared with attendees at scale, and simply sharing a home network with a visitor without reading a long random passphrase aloud character by character — all common, legitimate uses of the same underlying string format.
Common mistakes
- Forgetting to escape special characters in a password. Produces a code that scans but fails to actually join the network, in a way that looks like a wrong password.
- Assuming the format supports enterprise/802.1X networks. It only covers personal, shared-password authentication.
- Treating a printed QR code as inherently more private than a written password. Both expose exactly the same access to anyone who can see them.
FAQ
Is the WIFI: format documented in an official specification?
Not through a standards body like the IEEE or IETF — it's a de facto standard that emerged from the ZXing open-source barcode library's Barcode Scanner app. It became universal in practice because Android and iOS's built-in camera apps both independently adopted the same format, which is what actually made it a working standard regardless of its informal origins.
What happens if a QR scanner doesn't recognize the WIFI: prefix?
It falls back to treating the code as a plain text or URL QR code, showing the raw decoded string rather than offering to join the network automatically. This is rare with any modern phone's built-in camera, but can happen with older or very minimal third-party QR scanner apps that don't implement the WiFi-specific handling.
Can a WiFi QR code specify enterprise (802.1X) authentication?
No — the format only supports personal/pre-shared-key networks (WPA, WEP, or open). Enterprise networks require a username, and often a certificate, that the simple SSID/password/type structure has no fields for; joining one still requires manual configuration.
Does the QR code itself need to be kept secret?
Treat it exactly like the password it contains — anyone who scans the code gets the same access as anyone who's told the password directly. A QR code printed on a sign in a public space is exactly as exposed as a password written on that same sign; the QR format doesn't add or remove any protection on its own.
Why does the hidden network flag exist if hidden SSIDs aren't actually more secure?
It's there for functional correctness, not security — a device joining a network via a scanned code needs to know whether to actively probe for a non-broadcasting SSID rather than just listening for its beacon, regardless of whether hiding the SSID provides any real security benefit (it doesn't meaningfully; the SSID is still visible in other 802.11 management frames to anyone actually monitoring the network).
Try it yourself
WiFi QR Code String Generator builds the correctly escaped string for any SSID, password, and security type, entirely in your browser.