Wi-Fi QR codes for guests, not the whole office

Phone cameras already know what to do with a Wi-Fi code. Point an iPhone or a recent Android at it and the prompt is some version of “join this network”. No browser, no captive page, no one typing a password that contains three ambiguous symbols. That is the whole product. The rest is deciding which network you are willing to hand to a stranger, and accepting that the password is now a printed object.

The string the phone is reading

There is no official “Wi-Fi QR” type inside the QR spec. The symbol just holds text. Android’s format, which iOS also honours, looks like this:

WIFI:T:WPA;S:CafeGuest;P:correct-horse;;

The fields that matter:

• T is the security. Use WPA for WPA2 and WPA3 personal networks. Use WEP only if you are stuck with ancient kit, which is its own conversation. Use nopass for an open network and omit the password.
• S is the SSID, exactly as the router broadcasts it. Cafe Guest and CafeGuest are different networks. Trailing spaces have ruined more of these cards than wrong passwords.
• P is the password. It is case-sensitive.
• H:true marks a hidden network. Leave it off unless the SSID really is hidden. Hiding the name is not a security control, and it makes phones worse at rejoining.

The line ends with ;;. If you are editing the string by hand, do not drop the last semicolon. Generators, including the one on this site, assemble it for you when you use the Wi-Fi fields. Hand-editing is how a password like a;b quietly terminates the field early.

Characters you have to escape

In this format, these characters are special: \ ; , : and ". Escape them with a backslash. A password of a;b:c has to travel as a\;b\:c. An SSID called Guest, 2.4 needs the comma escaped too. If a phone says the password is wrong and you can type it successfully, look at escaping before you reset the router.

Print the guest network

A café, clinic, showroom, or Airbnb should have a guest SSID that cannot see the till, the printer, the NAS, or the staff laptops. Client isolation on, bandwidth cap if the line is small, and a password you can rotate without locking the card machines out. The QR code joins that network and no other.

If you only have one SSID, fix that before you design the tent card. A code on the counter is convenient for customers and equally convenient for anyone who photographs it. People do photograph it. Sometimes to help a friend at the next table, sometimes because the password is the same one used for the admin interface. Split the networks. Then print.

Placement follows from that. On the table, at the counter, on the welcome sheet in the rental, inside the meeting room. Not on the front window facing the pavement, and not on a poster you are about to put on Instagram. The moment it is in a photo that leaves the building, treat the password as public and rotate it.

Rotating the password means reprinting

This is the part that surprises people who just read a pitch for “dynamic QR codes”. A Wi-Fi symbol does not point at a URL. The password is the payload. There is nothing to redirect. Change the password on the router and every printed card is wrong until you replace it.

You can instead encode a link to a page that shows the current password. Update the page when you rotate it. That works, and it is worse in one specific way: the page is now a public notice, indexable if you slip, and forwardable. Anyone with the link has the password, including people who are not in the building. A static Wi-Fi code at least requires someone to be close enough to scan the card. Pick the failure mode you prefer. For a busy café, reprinting a stack of cards each quarter is usually cheaper than explaining a shared webpage.

Write the SSID in plain text next to the code. When the scan fails, staff can still read it out. A code with no human-readable fallback is how a Tuesday lunch becomes a support ticket.

Test both platforms before you laminate fifty

Generate the code, print it at the size you will use (a 30 mm mark on a tent card is comfortable; the size notes cover tighter jobs), and join from an iPhone and an Android you did not use to create it. Forget the network afterwards and scan again. Check you landed on the guest SSID, not the staff one that happens to start with the same word.

Then try the awkward cases you already know are in the password: a semicolon, an emoji if someone was being cute, a space at the end of the SSID copied from a spreadsheet. Emoji in SSIDs are legal and a bad idea. Spaces at the end are a clipboard problem. Retype the SSID rather than pasting it from the router admin if the first scan misbehaves.

Laminate is fine. Glare is not. Matte pouches beat glossy ones under downlights. Same rule as any other code, covered properly in the design piece.

What this site does with the password

The generator builds the symbol locally. The SSID and password are not sent to an account, because there is not one. That still leaves the printed card, the photo someone posts, and the analytics on your website if you used a link instead of a Wi-Fi payload. The code is the easy part. The network design is the actual security work.

Practical questions