What a Wi-Fi tag contains
A tag that a phone can join from doesn't hold the WIFI: text a QR code holds. It holds an NDEF record of type application/vnd.wfa.wsc, with the network name, security type and password packed as binary Wi-Fi Simple Configuration fields (format reference). Writing the QR code's text onto a tag as a plain text record just gives phones some text to show; it doesn't join anything.
Either way, the password on a tag is readable by anyone who taps it with an NFC reader app, just as a QR code is readable by anyone who scans it.
Which phones join from a tag
- Android: many Android phones recognise a correctly written Wi-Fi configuration record and offer to connect. Support varies by maker and version, so test the phones you care about.
- iPhone: iPhones read NFC tags, but we haven't found Apple documentation saying they join Wi-Fi from a configuration tag. Plan on iPhone guests using the QR code.
Writing a tag
You need a writable NTAG sticker or card with enough memory (NTAG215 or larger is comfortable) and an app that can write a Wi-Fi configuration record specifically, not just text or a link. After writing, test it with phones that have never joined the network. Lock the tag only once you're happy, because a locked tag can't be changed when the password changes.
Web NFC and its limits
Websites can write NFC tags through Web NFC, but only in Chrome on Android (version 89 and later), on phones with NFC switched on, over HTTPS, and after a tap from you. Safari, iOS and Firefox don't support it (MDN compatibility). Even where a browser can write a tag, that says nothing about whether a guest's iPhone will join from it.
We haven't added a tag writer to this site yet. We'd rather test it on real phones first than ship something that works for some guests and silently fails for others.
What we recommend
- Use a printed QR code as the main way in. Every recent iPhone and Android phone can read one from the camera.
- If you'd like a tag too, put it next to the code as an extra, and label it.
- Be wary of “tap to join” products that work through a web link. A web page can't add Wi-Fi to a phone that isn't online yet, and putting a password in a link exposes it in browser history and server logs.