What is the WiFi QR code format?

WiFi QR codes use the WIFI mecard format, which encodes credentials as a structured string: WIFI:T:WPA;S:NetworkName;P:Password;H:false;; where T specifies the security type (WPA, WEP, or nopass for open networks), S is the SSID, P is the password, and H indicates whether the network is hidden. The double semicolon terminates the record. This format was popularised by Android's native QR scanner and is also supported by iOS 11 and later via the Camera app. Special characters in the SSID or password — including backslash, semicolon, comma, double-quote, and colon — must be escaped with a preceding backslash.

Which security types are supported?

The WiFi QR format supports WPA/WPA2/WPA3 (specified as WPA), WEP (specified as WEP), and open networks with no password (specified as nopass). WEP is considered cryptographically weak and has been formally deprecated by the Wi-Fi Alliance; it is supported in the QR format for legacy compatibility but should not be used for new network deployments. WPA3 networks use the same WPA designator in the QR string. Enterprise networks using 802.1X authentication (EAP) cannot be fully represented in the standard WIFI mecard format and require more complex provisioning methods.

Can the password be recovered from a WiFi QR code?

Yes — the password is encoded in plain text within the QR code data. Anyone who scans the code or reads the decoded string can see the password. WiFi QR codes are therefore intended for semi-public or trusted-visitor distribution, not for securing a network against determined adversaries. For guest networks in hospitality settings, using a dedicated guest SSID with a regularly rotated password, displayed via QR code, is a good security practice that limits exposure of the primary network credentials.

What happens when someone scans a WiFi QR code?

On iOS 11 and later, the Camera app recognises the WIFI mecard format and displays a Join Network banner; tapping it connects the device without the user entering the password. On Android, the built-in camera or Google Lens handles the same process on most devices running Android 10 and later. Older devices may require a third-party QR scanner that explicitly supports the WiFi format, and some corporate devices with MDM profiles may restrict automatic network joining. The connection behaviour is identical to manually joining the network from the WiFi settings screen.

Should I use a high error-correction level for a WiFi QR code?

Level M or Q is recommended for printed WiFi codes because they will be scanned repeatedly over their operational lifetime and may accumulate small amounts of wear or soiling. Level H allows a decorative logo or venue branding to be overlaid while still maintaining decodability, which is useful for hospitality contexts where aesthetic presentation matters. Given that a WiFi code typically encodes only 30–80 characters, the higher error-correction level adds only one or two version steps, keeping the code compact even at Level H.