How Wi-Fi QR Codes Work: The WIFI Format, Encryption Types, and Auto-Connect

Have you ever seen a QR code labeled "Wi-Fi here" at a cafe, a shop, or in someone\'s living room? It is the mechanism that lets you join a network just by pointing your phone\'s camera at it, without typing a single character of a complicated password. It looks like magic, but in reality it is simply "text that lists the information needed to connect, written in a fixed format," turned into a QR code. This article walks through how to read that text format, how the encryption type is specified, the auto-connect flow, and the easily overlooked security cautions.

What a Wi-Fi QR Code Is

A Wi-Fi QR code embeds a full set of "information needed to connect"—the network name (SSID), password, and encryption type—into a single QR code. A user only has to scan it with a phone camera or QR reader to join the network. Because it removes the hassle of reading out a password or writing it on paper, it is widely used at shops, hotels, and offices with many visitors.

The key point is that the QR code itself is nothing more than a container for text. What is inside is neither a cipher nor special data, but a short string in the fixed format described below. In other words, as long as you follow that format, anyone can create a QR code for their own Wi-Fi. To see what it looks like, it helps to enter an SSID and password in the Wi-Fi QR Code Generator and generate one.

Reading the Format: WIFI:S:...;P:...;;

The text stored in a Wi-Fi QR code follows a fixed format like the one below. Popularized by Android, it is now a de facto standard that many devices, including iOS, can interpret.

WIFI:S:MyHomeNetwork;T:WPA;P:password1234;;

The leading WIFI: declares "this is Wi-Fi connection information." What follows is a series of key:value; pairs separated by semicolons. Each one means the following.

Ending with two semicolons (;;) is a convention that marks the end of the format. The semicolon after the last key and the semicolon that marks the overall end run together, resulting in ";;". The order of keys is not strictly fixed, but they are commonly written as S, then T, then P.

In short, a Wi-Fi QR code is really just "text that lists the network name, encryption type, and password, separated by fixed symbols." You can even paste that string directly into the QR Code Generator to make the same thing in principle. However, because typos and missed escaping happen easily, using a dedicated tool is more reliable.

Specifying Encryption: WPA / WEP / none

Among the fields, the T (encryption type) is especially important. If it does not match your actual router setting, you will fail to connect even with the correct password. There are three main values.

• WPA: the most common value. WPA, WPA2, and WPA3 are all conventionally specified with this single "WPA." Almost all current home and business routers use this scheme.
• WEP: an older encryption method. It has known vulnerabilities and is no longer recommended, but it remains for compatibility with old equipment. You should not use it for anything new.
• nopass (none): represents an open network with no password. In this case the P (password) value is unnecessary, or left empty. Because anyone can connect, it is not recommended outside of intentionally open public networks.

For an open network with no password, the text becomes something like "WIFI:S:FreeSpot;T:nopass;;", with the P field omitted entirely. Conversely, if you set T to "nopass" on a password-protected network, the device will not prompt for a password and will fail to connect, so always match the encryption type to your router\'s actual setting.

If the encryption type (T) disagrees with the actual router setting, you cannot connect even with the correct password. As a rule, write WPA2/WPA3 simply as "WPA."

Hidden SSIDs and Escaping Special Characters

If you use a hidden SSID (stealth SSID)—one that is not broadcast, so only people who know the name can connect manually—you must convey that in the QR code format as well. Specifically, add H:true near the end.

WIFI:S:SecretNet;T:WPA;P:password1234;H:true;;

Without this H field, a device may not find a hidden-SSID network even when it scans, and may fail to connect even after scanning the QR code. For a normal (broadcast) SSID, omit H or set it to "false."

Escaping special characters

Be careful if the SSID or password contains characters used as the format\'s delimiters—namely semicolon (;), comma (,), colon (:), backslash (\), and double quote ("). Writing them as-is breaks the format and prevents correct interpretation, so you must escape each one by placing a backslash (\) in front of it.

For example, if the password is "p:ss;word," it must be written as "p\:ss\;word" inside the format. This kind of processing is easy to get wrong by hand, so it is safer to use a dedicated tool such as the Wi-Fi QR Code Generator that escapes your input automatically. Even with symbols in the password, simply typing it into the field yields a correct QR code.

From Scanning to Auto-Connecting

So what actually happens inside the device between holding up the QR code and actually joining the network? The flow has roughly four stages.

The key point is that on most devices, a final confirmation to the user is involved. Scanning the QR code does not complete the connection on its own; you look at the network name shown on screen and only connect after you choose "Connect" yourself. This is a safeguard to prevent being auto-connected to an unintended network. Once connected, the network information is saved on the device, so from then on it reconnects automatically whenever you are in range.

Note that this entire process is completed inside the device (your smartphone). Scanning a QR code does not send your connection information to any external server. The QR code merely plays the role of "handing over text in place of manual entry."

Security Cautions

Convenient as Wi-Fi QR codes are, do not forget that their essence is "connection information, including the password, left in a readable state." Keep the following in mind when using them.

• A QR code is the password itself: anyone who can scan it can connect to that network. With a reader app, the embedded password can even be displayed in plain text. Treat showing a QR code as essentially the same as telling someone the password.
• Mind where you post or print it: sticking it in a limited spot inside a shop is very different in risk from publishing it to the public on social media or a flyer. It can also spread unintentionally by appearing in a photo.
• Separate the network for guests: where possible, isolate a guest SSID from your real home or office network (use a guest network) and put only that connection info into the QR code. Even if it leaks, the network with important devices stays protected.
• Change the password periodically: if you keep the same QR code posted for a long time, change the password periodically and regenerate the QR code to prevent unauthorized access using previously scanned information.

With these risks in mind, to safely create a QR code that fits your purpose, it is convenient to use the Wi-Fi QR Code Generator, where the information you enter never leaves your browser. Just choose the SSID, password, and encryption type, and it generates a correct QR code—escaping included—on the spot. If you want to turn a generic string or URL into a QR code, use the QR Code Generator as well.

Please note that this article is intended to provide general information. The best approach to actual network settings and security measures varies with your equipment, line, and environment. Make your decision after checking the latest official information and your router\'s manual.