A WiFi QR code is a short piece of text in a format phones understand — WIFI:T:WPA;S:MyNetwork;P:hunter2;; — drawn as a pattern. Scan it and the phone offers to join. Nothing is stored anywhere, there is no account behind it, and it works for as long as the password does.
This is worth knowing before you print anything, because it fails silently. Several QR libraries in wide use prepend a UTF-8 byte-order mark to any string containing a non-ASCII character. The pattern looks perfect. The phone reads it, tries to join, and reports the wrong password — because the password it received begins with three invisible bytes that you never typed.
We found this in the library this site itself used to run on. Its own source does exactly this:
if (parsedData.length != data.length) { unshift(191); unshift(187); unshift(239); }
Any password with é, ü, ñ, ß or a non-Latin script is affected. So is any network name with one. We replaced the library, and now every code this tool makes is decoded and compared to what you typed before you are offered a download — if a character did not survive, you find out here rather than at the door of a café.
The WiFi format uses ; to separate fields and : to separate a field from its value, so a password containing either would truncate the code at that point — the phone would receive half a password and refuse to connect. The characters \ ; , : " all have to be escaped with a backslash. A password of pa;ss,word must be written pa\;ss\,word.
You do not have to think about that here: type the password as it is and the escaping is done for you. It is worth knowing because a generator that skips it will hand you a code that fails only for people whose passwords contain punctuation — which is to say, the good ones.
If the network does not broadcast its name, the code needs H:true as well. Without it a phone will look for a visible network of that name, not find one, and give up. There is a Hidden switch in the tool; set it and the flag is written in.
Two measurements matter more than anything else on this page, and both come from generating real codes and reading them back with two independent decoders.
The white margin is part of the code. The standard calls for four clear modules around the pattern. On a white page you cannot tell whether a generator included it. Put the same code on a dark background and the difference is total:
| The code sits on… | With the standard margin | With none |
|---|---|---|
| a white card | scans | scans |
| a coloured panel | scans | scans |
| a dark background | scans | does not scan |
Guest WiFi cards are very often printed dark. If you take a code from a generator that trims the margin to make the image tidier, that is exactly where it stops working.
Contrast has a floor. Stepping a grey foreground against white, everything at a ratio of 4.06:1 and above decoded, and everything at 4.00:1 and below failed. Printing a WiFi card in a soft brand colour is a common way to ruin it. This tool refuses anything under 4:1 rather than letting you find out from a guest.
A WiFi code is usually longer than a link, because it carries the network name and the password. A typical one comes out around 33 modules across. The working rule is that a module should not fall below about 0.4 mm, and that a code scans from roughly ten times its own width away:
| Printed width | Module size | Comfortable to scan from |
|---|---|---|
| 20 mm | 0.49 mm | 20 cm — a table tent |
| 30 mm | 0.73 mm | 30 cm — a card by the till |
| 50 mm | 1.22 mm | 50 cm — a framed notice |
| 80 mm | 1.95 mm | 80 cm — a wall sign |
The tool works this out for the code you actually made, since the module count depends on how long your network name and password are. For anything going to a printer, take the PDF or EPS — both are real vectors, so the print shop can scale them without softening a single edge.
The code carries three things — the security type, the network name and one shared password — plus a flag for a hidden network. That is the whole format, and it is why this works beautifully for a home or a café and not at all for a corporate network.
If your office WiFi asks every employee for their own username and password, that is WPA-Enterprise (802.1X), and it authenticates each person separately against a RADIUS server, often with a certificate as well. There is nowhere in those three fields to put an individual identity, and there should not be: a code carrying one person’s login would be handing out their account to everyone who scans it. No generator can encode that, ours included, and one claiming to is either writing a personal credential into a poster or quietly making an ordinary shared-password code that will not connect.
The supported route for enterprise networks is a configuration profile pushed by whoever administers the devices, not a printed square. If you want the convenience of a scannable code in an office, the realistic answer is a separate guest network with its own shared password — which is what the code is for, and which keeps visitors off the network your file server is on.
Worth planning for before the codes go to a printer. The password is inside the pattern, so rotating it turns every card, sticker and table tent into a square that fails to connect — and the failure is silent and confusing, because the phone simply says it could not join rather than explaining why.
Two habits make this painless. Give the guest network a password you are willing to leave alone for a year, separate from anything else, so a routine rotation elsewhere does not reach it. And if you print more than a handful, keep the codes somewhere replaceable — a slip in a stand beats something laminated onto the furniture.
It is exactly as safe as writing it on the wall, because that is what it is. Anyone who can photograph the code has the password, and a QR code is not encryption — the text is readable by any scanner. That is fine for a guest network and a bad idea for the one your accounts are on.
The sensible pattern is a separate guest network, which most routers can create in a couple of minutes, with the code pointing at that. Then a printed card is a convenience rather than a key to everything.
Making the code is a different question, and the answer there is better: nothing leaves your browser. The password is turned into a pattern by code running on your own machine, so it is never sent to us or to anyone else. You can watch the network tab while you type it.