How to Create a WiFi QR Code (And When Not To)

A WiFi QR code stores your network name and password inside the printed pattern, so a guest's camera can join the network without anyone reading a password aloud. That convenience has a cost: the credentials are in the square, permanently, for anyone who photographs it. Use a guest network, never your main one.

At a glance

A standard WiFi QR code is static by nature. The password is encoded in the pattern, so changing the password means a new code and a reprint.
Pick WPA even if your router says WPA2 or WPA3. The WiFi payload format only recognises WPA, WEP and nopass. We normalise the others for you.
Semicolons and backslashes in a password will break a badly built code. PixlQR escapes them; not every generator does.
Anyone who photographs the card keeps that password until you change it — including former staff and the stranger who photographed your counter. Changing it is the only thing that ends their access.
A dynamic code saves reprinting when you rotate the password — it does not revoke anyone. The page it opens is public, so old cards still show the new password.

How does a WiFi QR code actually work?

There is no website involved. The code encodes a short text string in a format phone cameras recognise:

WIFI:T:WPA;S:CafeNero-Guest;P:flatwhite2026;;

T is the encryption type, S is the network name, P is the password. When a camera reads that, the phone offers to join the network directly. No server of ours is contacted, so PixlQR records nothing — your router still logs the connection like any other — and the code works with no internet on the scanning device.

That is the whole appeal, and also the whole limitation. A static WiFi code cannot be edited and cannot be tracked, because there is no server in the middle to edit or track. Every scan is invisible to you.

Which encryption type should you choose?

This is where most people get stuck, because the router says one thing and the QR form says another.

The WiFi payload format only recognises three values: WPA, WEP and nopass. It has no separate entry for WPA2 or WPA3, even though those are what modern routers actually run. The format is a widely implemented convention rather than a formal ISO standard, which is why scanner behaviour varies at the edges.

Router says WPA2, WPA3, WPA2/WPA3 mixed, or just "WPA"? Choose WPA. PixlQR normalises all of these to WPA when it builds the code, which is what the spec expects and what phones handle correctly.
Open network with no password? Choose nopass. The password field is dropped entirely rather than left empty, which matters — some scanners choke on an empty P: field.
WEP? Your network is roughly twenty years out of date and trivially breakable. Fix that before printing anything.

Which password characters break a WiFi QR code?

Five characters are structural in the format and must be escaped, because they otherwise look like field separators to the scanner: backslash, semicolon, comma, double quote and colon.

A password of flat;white naively becomes:

WIFI:T:WPA;S:CafeNero-Guest;P:flat;white;;

The scanner reads the password as flat, hits the semicolon, and treats white as a new field. The phone then fails to connect with no useful error — it simply says the password is wrong, which sends you hunting for a problem in the router.

PixlQR escapes all five before generating the code, so a password containing them works. Not every generator does, and it is not something you can see by looking at the QR. If you are using a different tool, test with the real password before printing anything.

How to create a WiFi QR code, step by step

Choose the WiFi type, not URL. What the printed code then carries depends on step 5: a static WiFi code encodes the credentials themselves, while a dynamic one encodes a short link to a page that displays them.
Enter the network name exactly as the router broadcasts it. SSIDs are case-sensitive and space-sensitive: Cafe Nero Guest and CafeNeroGuest are different networks, and a trailing space you cannot see will fail silently. Copy it from the router admin page rather than typing it from memory.
Pick the encryption type — WPA for anything modern, nopass for a genuinely open network. See the section above if your router says WPA2 or WPA3.
Enter the password, then read it back character by character. This is the step people rush, and a wrong character produces exactly the same symptom as a wrong encryption type.
Choose static or dynamic using the next section. Static is the right default; dynamic is for people who rotate the password often enough that reprinting is a chore.
Design it if you like, keeping the code dark on light. A logo in the middle is a Plus feature and eats into the error-correction budget, so keep it small.
Test before you print, then test the print. Scan from the screen first, then from the actual printed card at its actual size, on a phone that is not the one you made it on. A code that works at 10 cm on a monitor can fail at 2 cm on matte card.

The whole thing takes about a minute. Step 7 is the one that saves you a reprint.

Static or dynamic — which should you use for WiFi?

Genuinely different trade-offs here, unlike most QR types where dynamic simply wins.

A static WiFi code encodes the credentials directly. One scan, phone joins, done. No internet needed on the guest's phone before connecting — which matters, because a guest without data cannot load a web page to get onto your WiFi. This is the smoother experience and the right default for most cafés and waiting rooms.

A dynamic WiFi code points at a short link, which opens a page showing the network name and a copy-password button. You can change the password later without reprinting, and you get scan numbers. The costs are real: the guest needs a working connection to load the page before they can join your network, and joining is no longer one tap — they copy the password, open WiFi settings, pick the network and paste.

It also works differently from every other dynamic code. You are not changing where it points — it always points at the same PixlQR page. You are changing the credentials that page displays. So changing a destination is a useful read for the general idea, but the WiFi mechanics are their own thing.

The thing to understand before you rely on this for security

A dynamic WiFi code saves you a reprint. It does not revoke anybody.

That page is public by necessity — a guest has to read it without an account. So anyone who photographed your card still has the short link, and after you rotate the password they can open that link and read the new one. Rotating credentials behind a dynamic code keeps your printed card valid; it does not remove access from the people who already had it.

If your actual goal is to cut off former guests or departed staff, the only thing that does that is changing the network password and issuing a code they have never seen — which means a reprint on either kind of code, or deleting the dynamic code and creating a fresh one with a new short link.

So the deciding question is not security, it is convenience: how often does the password change, and how much is reprinting worth to you? Rotate monthly and dynamic saves real effort. Set it once and leave it for three years, and static is the better experience for the guest.

The part most WiFi QR articles skip

A printed WiFi QR code is a password written on the wall in a font only phones can read.

Everything that follows from that is worth thinking about before you print:

Anyone who photographs the card keeps the password, and can hand it on. A card on a café counter is photographed by strangers constantly.
Staff who leave keep it too, unless you rotate the password, which means a reprint on a static code.
A guest on your main network can usually see other devices on it — the office printer, the NAS, the till system, the security cameras.

The fix is not complicated, and many modern routers support it: put the QR code on a guest network. A guest network hands out internet access while keeping visitors off your internal devices. Whether it also stops guests seeing each other depends on a separate setting, usually called client or AP isolation — worth turning on while you are in there. Then a photographed card costs you bandwidth rather than your network.

For a home, an Airbnb or a small office, this is the single highest-value thing in this article. Print the guest network, never the one your own devices sit on.

Where the card actually goes

Café or bar: table tents and the counter. Not the window, where passers-by scan it from outside.
Holiday rental: the welcome folder and beside the router. Guests look for it in both.
Office reception: the visitor signing-in area, not the open floor.
Meeting rooms: on the table. Visiting clients should not have to ask.

Keep it 2.5 to 3 cm square or larger, dark on light, and matte rather than glossy — a laminated card under a downlight is one of the more common reasons a code will not scan.

The five-minute version

If you take nothing else from this:

Put it on your guest network. Not the one your printer, till or cameras sit on. This is the whole article in one line.

Choose WPA whatever your router calls it, unless the network is genuinely open, in which case choose nopass.

Test with the real password before printing, especially if it contains a semicolon, colon, comma, backslash or quote mark.

Go static if the password is stable — it works with no internet on the guest's phone. Go dynamic if you rotate the password and would rather edit than reprint.

Print it 2.5 cm or larger, dark on light, matte not glossy.

The builder below makes a link QR rather than a WiFi one, because it has a single URL field — WiFi needs a network name, a password and an encryption type. Use it to see how the editor behaves, then build the WiFi code in your account, where the full form lives. Free, no card, and the guest-network version takes about a minute.

Frequently asked questions

Does this work on both iPhone and Android? Yes on current phones, with a wrinkle. iPhones have handled WiFi QR codes from the camera since iOS 11. Most current Android phones do too, but the camera app varies by manufacturer, so a minority of guests will need Google Lens or the QR shortcut in their notification shade.

Can I see how many people connected? Not with a static code — there is no server involved, so there is nothing to count. A dynamic WiFi code gives you scan numbers, though it counts people who opened the page rather than people who successfully joined. If scan data is what you are after, how to track QR code scans covers what the numbers do and do not tell you.

What happens to the printed card when I change the WiFi password? On a static code it stops working and needs reprinting — the old password is baked into the pattern. On a dynamic code you update the password in your dashboard and the printed card keeps working. That is the argument for dynamic if you rotate often. Remember what it does not do: anyone holding an old card can open the same link and read the new password, so this is a convenience feature, not a way to lock people out.

Is a hidden network supported? Not in PixlQR — our WiFi form takes network name, password and encryption, and does not expose the hidden-network flag. The payload format does define an H:true field, but scanner support for it is inconsistent enough that we would not rely on it in a public space anyway. And if the network is hidden for security reasons, a printed card broadcasting its name and password rather defeats the point.

Can I put my logo in the middle? Yes, though it is a Plus feature on PixlQR — free accounts see it during the 7-day trial and then it locks. PixlQR encodes at the highest error-correction level, which is what lets a code survive a logo at all. Keep it small either way: a WiFi code carrying a long password is already a dense grid, and every module the logo covers is one the scanner wanted.