WiFi QR

Overview

WiFi QR is a plain-text data format encoded inside a standard qr-code symbol that carries the credentials needed to join a wireless network. When a phone camera decodes the payload, the operating system recognizes the WIFI: prefix and offers a one-tap "join network" action instead of requiring the user to type an SSID and password by hand [6].

The payload is a single line of key:value; pairs of the form WIFI:T:WPA;S:mynetwork;P:mypass;;, where S is the SSID, T the authentication type, and P the password [1]. It is not an official IETF or ISO standard; rather it is a de facto convention documented by the ZXing project that camera apps on Android and iOS implement [1].

History

The WIFI: format derives its grammar directly from NTT DoCoMo's mecard contact syntax — the same TAG:value; structure, the same backslash-escaping rules, and the same terminating double semicolon [1]. ZXing documented it in its "Barcode Contents" wiki page as part of the conventions the library encodes and decodes [1].

Apple's iOS 11 (released September 2017) made the system Camera app decode QR codes natively, including WiFi-configuration codes: pointing the camera at a WIFI: code surfaces a "Join [Network Name]" banner [7]. Android gained an analogous capability, and Android 10 (Q) added a system "Share" QR feature in the Wi-Fi settings that both generates and scans network QR codes; that release also introduced support for the Wi-Fi Alliance's separate Wi-Fi Easy Connect / Device Provisioning Protocol (DPP) as a WPS replacement, which uses a different QR payload than the ZXing WIFI: convention [8].

A divergence later emerged around WPA3: the WPA3 specification requires characters outside the printable set and semicolons to be percent-encoded, whereas the original ZXing convention (and Android's implementation) escapes them with a backslash instead, which means many WPA3-era codes do not strictly follow the Wi-Fi Alliance text [2].

Technical specification

A WiFi QR payload is a single text string. The canonical example is [1]:

WIFI:T:WPA;S:mynetwork;P:mypass;;

Fields are KEY:value; pairs; field order is not fixed; the record ends with an extra ; (a double semicolon overall). The documented fields are [1]:

Field	Meaning	Notes
S	SSID (network name)	Required. Enclose in double quotes if the name is ASCII but could be read as hex [1]
T	Authentication type	WEP, WPA, WPA2-EAP, or nopass for an open network [1]
P	Password	Ignored when T:nopass; quoting rule as for S [1]
H	Hidden network	true if the SSID is not broadcast [1]
E	EAP method	WPA2-EAP only, e.g. TTLS, PWD [1]
A	Anonymous identity	WPA2-EAP only [1]
I	Identity	WPA2-EAP only [1]
PH2	Phase-2 method	WPA2-EAP only, e.g. MSCHAPV2 [1]

Escaping. The special characters \, ;, ,, " and : must each be escaped with a leading backslash, exactly as in mecard encoding [1]. For instance, an SSID that is literally "foo;bar\baz" (double quotes included in the name) is encoded as WIFI:S:\"foo\;bar\\baz\";; [2].

Open networks use T:nopass (or omit the password); a trailing literal newline in the payload causes the join to fail on both iOS and Android [2]. Under WPA3, the Wi-Fi Alliance mandates percent-encoding of non-printable characters and semicolons, a rule Android does not follow in practice [2].

Use cases

• Venue / guest Wi-Fi posters. Cafés, hotels, offices and rentals print a WiFi QR so guests join without being told a password. Both iOS and Android trigger a system-level "connect" action on scan [1] [6].
• Phone-to-phone sharing. Android 10's Wi-Fi settings can display a QR for the currently connected network so a second device joins by scanning it [8]; iPhones surface the same flow [7].
• Bulk provisioning. Printed codes let staff onboard many devices to a network without typing long WPA2/WPA3 passphrases [6].

Implementations

Project	Lang	Stars	Last active	Notes
zxing/zxing	Java	~34k	2025	Reference library; its "Barcode Contents" wiki defines the WIFI: convention [1] [5]
evgeni/qifi (QiFi, qifi.org)	JavaScript	~700	2025	Pure-browser generator; credentials never leave the device [3]
Android WifiDppQrCode (AOSP)	Java	—	2025	System scanner/generator in Wi-Fi settings; also handles DPP codes [8]

Comparison

• WiFi QR vs manual entry. A scan eliminates transcription of long WPA2/WPA3 passphrases and the SSID, which is the format's whole reason to exist [6].
• ZXing WIFI: vs Wi-Fi Easy Connect (DPP). The WIFI: convention simply hands over a plaintext passphrase. DPP, introduced with Android 10, performs a public-key onboarding handshake and is a WPS replacement; it uses a distinct QR payload and supports WPA2 and WPA3 [8].
• WPA3 percent-encoding vs ZXing backslash-escaping. The two escaping schemes disagree, so a payload generated to the strict WPA3 rule and one generated to the ZXing/Android rule can differ for the same credentials [2].

Fun facts

• The WIFI: grammar is a direct descendant of a Japanese mobile-phone contact format: it borrows the TAG:value;; structure and backslash escaping from NTT DoCoMo's mecard [1].
• QiFi deliberately runs entirely client-side so that "WiFi stays as secure as it was before" — the password is never sent to a server to render the code [3].

Status

Active and ubiquitous. Both major mobile OSes decode WIFI: codes through the system camera (iOS since iOS 11; Android natively, with a dedicated generator/scanner in Wi-Fi settings since Android 10) [7] [8]. The format remains a community convention rather than a ratified standard, with an unresolved escaping mismatch around WPA3 [2].

Sources

1 Barcode Contents — ZXing Wiki 2 Most WPA3 WiFi QR Codes are broken — Steve's Blog, 2024 3 QiFi — pure JS WiFi QR Code Generator — Evgeni Golov 5 zxing/zxing — ZXing project, GitHub 6 QR code mobile OS breakdown: iOS vs Android in 2026 — QRCodeKit, 2026 7 How to make a QR code to connect guests to your Wi-Fi — AppleInsider, 2021 8 Wi-Fi Easy Connect — Android Open Source Project

Deployments

No country reports mention this standard by name.

Regions / aggregations not mapped to a single country

• Universal