Here is a typical code's contents:
WIFI:T:WPA;S:Guest Network;P:correct-horse-battery;;It's plain text. Anyone who scans it can read the password; the format organises it, it doesn't encrypt it.
The fields
The common format comes from the open-source ZXing barcode library (documentation). Fields are KEY:value pairs separated by semicolons, in any order, and the whole thing ends with ;;.
| Field | Meaning | Values |
|---|---|---|
S | Network name (SSID). Required. | Exactly as the router broadcasts it, up to 32 bytes. |
T | Authentication type. | WPA for WPA/WPA2/WPA3 Personal, WEP, or nopass. Missing means no password. |
P | Password. | Omitted for open networks. |
H | Hidden network. | true if the router doesn't broadcast the name; otherwise leave it out. |
T:WPA is the conventional value for every password-protected personal network, WPA2 and WPA3 included. There is no T:WPA2 in the original format, although some readers accept it.
Escaping special characters
Because ; ends a field and : separates a key from its value, five characters inside a name or password must be written with a backslash in front: \ ; , : ". Do it in a single pass (or backslashes first), never URL-encode the text, and never trim spaces: a space at the end of a password is part of the password.
Worked examples
These are generated by the same code this site uses to make every sign:
| Network and password | Contents of the code |
|---|---|
Guest Networkcorrect-horse-batteryNothing to escape. | WIFI:T:WPA;S:Guest Network;P:correct-horse-battery;; |
Cafe;Westa\b,c:d"eThe documented example: every special character gets a backslash. | WIFI:T:WPA;S:Cafe\;West;P:a\\b\,c\:d\"e;; |
Café;West "5G"p@ss:w\,rdAccents are fine as they are; @ needs no escape. | WIFI:T:WPA;S:Café\;West \"5G\";P:p@ss\:w\\\,rd;; |
Back Officehunter2hunter2Hidden network. | WIFI:T:WPA;S:Back Office;P:hunter2hunter2;H:true;; |
Open Lobbyno password Open network: no password field. | WIFI:T:nopass;S:Open Lobby;; |
ModernlongenoughpassWPA3-only, as this site writes it. | WIFI:T:WPA;S:Modern;P:longenoughpass;R:1;; |
The WPA3 version of the format
The Wi-Fi Alliance later wrote its own definition of the WIFI: scheme in section 7 of the WPA3 specification, now registered with IANA. It looks similar but isn't the same:
- It still uses
T:WPAfor password networks, and addsR:, a “transition disable” value.R:1asks phones that understand it to connect with WPA3 only. - It adds
I:for an SAE password identifier andK:for an SAE-PK public key. In the older ZXing format,I:meant an Enterprise identity, so the two disagree. - It escapes special characters with percent-encoding (
%3Bfor a semicolon) instead of backslashes, and doesn't define WEP.
Mixing the two can produce a code that one phone reads correctly and another reads with the wrong password. An independent analysis walks through the differences in detail.
What phones actually do
- Android's parser (AOSP source) reads the backslash format, accepts
WPA,SAE,WEPand open networks, sets the hidden flag fromH:true, and treatsR:1as WPA3-only. It doesn't percent-decode passwords. - Older Android versions check only the single character before a semicolon, so an escaped backslash at the very end of a password can be misread. Newer code counts escapes properly, but not every phone has it.
- iPhones read the backslash format from the Camera app. Apple doesn't publish a field-by-field compatibility list, so treat WPA3-only and hidden networks as “test before you rely on it”.
- Wi-Fi Easy Connect codes start with
DPP:instead. They carry a device's public key for a different provisioning process and are not interchangeable with password codes.
What this site writes
We use the backslash (ZXing) format, because it's what phone cameras have read for years. For the “WPA3 Personal only” choice we write T:WPA plus R:1, so phones that ignore R still join with the password. We never write percent-encoding, and we leave H out unless the network is hidden. Every sign is decoded again in your browser to confirm the text matches what you typed before you download it.