Skip to content
barcoder

Standards/wi-fi-easy-connect-qr

Wi-Fi Easy Connect QR

TypeQR Data Format
Completeness83%high

Overview

A Wi-Fi Easy Connect QR code is a QR Code symbol carrying a DPP: URI, the bootstrapping format of the Wi-Fi Alliance's Device Provisioning Protocol (DPP) 1. Scanning it gives a Configurator, often a phone or a network controller, the public key of a device that wants to join a network. The two then authenticate and exchange credentials over Wi-Fi 3.

The code holds a public key, not a password, which is the main difference from the WiFi QR WIFI: format 1 10. It usually sits on the new device, its packing list or its display, and is scanned by whoever is admitting the device 3.

History

  • Origin. The Wi-Fi Alliance credits Dan Harkins, a Fellow at Hewlett Packard Enterprise, as the inventor of DPP 3. A DPP QR helper script in the wpa_supplicant tree carries a 2017 Qualcomm Atheros copyright 13.
  • 9 April 2018. Revision history dates version 1.0 of the specification to this day 1.
  • 28 June 2018. Japanese trade press reported the Wi-Fi Alliance announcing a Wi-Fi CERTIFIED Easy Connect program alongside WPA3 24. The original Alliance release was not retrieved.
  • December 2018. A column in INTERNET Watch counted only 2 certified products, no Configurator app for phones, and NFC and Bluetooth defined but left out of certification, so only QR counted in practice 23.
  • Android 10. Android added DPP as the replacement for WPS, which Android 9 had deprecated 7.
  • 14 December 2020. Version 2.0 added Release 2 features, including new bootstrapping mechanisms, presence announcement, reconfiguration, enterprise provisioning and DPP over TCP/IP 1. A February 2021 Alliance release announced zero-touch cloud provisioning and NFC tags, adding that QR onboarding "is still available" 5.
  • 22 November 2022. Version 3.0 was issued 1.

Technical specification

Carrier. An ordinary QR Code. Section 5.3 of the specification sets no required error-correction level. It tells manufacturers to weigh label area, key size and how much extra data they include 1. The same URI can also travel in an NFC URI record, a BLE frame or a cloud service, so the format is not tied to QR 1 2 3.

Syntax. The format is defined by the dpp-qr ABNF rule and is an RFC 3986 URI: the prefix DPP:, optional fields each ending in ;, then the key field, then a closing ;; 1.

Token Meaning Status
C: IEEE 802.11 global operating class and channel list, e.g. 81/1,115/36. The device promises to listen on one of them Optional; a short list, ideally one channel, is recommended
M: MAC address as 12 hex digits with no separators Optional, recommended
I: Free text in printable ASCII, no semicolon. Often a serial number Optional
V: Highest DPP version supported; 1, 2 or 3 are assigned Required for version 2 and up
H: IP address and optional port, for an Enrollee using DPP over TCP/IP Optional
B: Hex bitmap of supported curves, e.g. B:1 for P-256 only Optional
K: Base64 of the DER-encoded ASN.1 SubjectPublicKeyInfo Required; last in the grammar

All of the above are from sections 5.2, 5.2.1 and 8.1.1.18 1. Each reserved token may appear at most once, and parsers should ignore unknown components so that later extensions stay compatible 1.

Official examples. Both come from section 5.3 and are printed as QR codes in the specification 1:

DPP:C:81/1,115/36;K:MDkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDIgADM2206avxHJaHXgLMkq/24e0rsrfMP9K1Tm8gx+ovP0I=;;
DPP:I:SN=4774LH2b4044;M:010203040506;V:2;K:MDkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDIgADURzxmttZoIRIPWGoQMV00XHWCAQIhXruVWOz0NjlkIA=;;

Decoding the two printed symbols from page 60 of the PDF with zxing-wasm returned exactly these strings.

Keys. Devices must use a distinct key pair for each bootstrapping method 1. All devices on cryptographic suite 1 must support NIST P-256, and the specification carries test vectors for P-256, P-384, P-521 and Brainpool P-256r1, P-384r1 and P-512r1 1. With compressed points, the encoded key is 80 characters for P-256, 96 for P-384 and 120 for P-521 1. Peers later refer to the key by its SHA-256 hash 1.

Recognising one. A valid code starts with DPP:. A P-256 key also has a fixed prefix, because the DER header does not vary: both official samples and the specification's P-256 test vector begin MDkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDIgA 1.

Symbol size. The length is dominated by the Base64 key, which uses lowercase letters, so encoders fall back to byte mode. Computed with segno 1.6.6, without error-level boost:

Payload Characters L M Q H
First official sample 102 5 (37 × 37) 6 8 10
Second official sample 125 6 (41 × 41) 8 9 11

Byte-mode capacity at level L is 78 for version 4, 106 for version 5 and 134 for version 6 28.

Parser behaviour. An AOSP mirror of hostap's dpp.c, an older revision that handles only C, M, I, K and V, is more lenient than the grammar. It reads fields in any order, skips empty and unknown tokens, and rejects a URI with no K: 11. Its generator writes them in the order C, M, I, V, K 11.

After the scan. The protocol has three phases: authentication, configuration and network introduction 12. The Initiator must hold the Responder's bootstrapping key, and the authentication is mutual only if each side holds the other's key 1. A scan gives only one-way authentication, so the scanned device has to trust the first Configurator that proves it knows its key 1. Exchanges use 802.11 action frames before association, with no SSID and no soft-AP 18. An unprovisioned device can announce itself by "chirping", and only a Configurator holding its key can start the protocol 3.

Use cases

  • Headless smart-home devices. The Alliance's stated target is equipment with little or no display, such as smart doorbells, lightbulbs and smoke detectors 5 6. The code goes on the device or its packing list 3.
  • Enterprise bulk onboarding. Purchase-order data moves DPP URIs from a vendor cloud to the customer's network equipment, so identified devices are authenticated automatically when they power up and chirp 18. Controllers acting as Configurator can onboard hundreds of devices this way 3. No QR is scanned here, but the same URI is used.
  • Factory provisioning and reference designs. NIST SP 1800-36 Build 1 (Aruba/HPE) implements Wi-Fi Easy Connect 2.0. It includes a factory build in which Raspberry Pis with a SEALSQ secure element are provisioned with a DPP URI 20. A 2025 NCCoE deck lists an automatically generated URI and QR code for a factory-generated key pair 19.
  • Home gateways. OpenSync describes QR-code authentication as one of its enrolment methods. Version 3.0 supports DPP 1.0 on Qualcomm platforms, and 3.2 adds fuller DPP 1.2 support on Broadcom 21.
  • Microcontroller products. Espressif's ESP-IDF generates the URI for an ESP device enrolling over the QR method. Its example prints the code to the serial console for a phone to scan 15 16.
  • Visitor access. The specification's own scenario is a badge printer acting as Configurator that issues a one-time dynamic QR code with each visitor badge. This is an illustration, not a reported deployment 1.

On Android, apps pass a scanned URI to the ACTION_PROCESS_WIFI_EASY_CONNECT_URI intent after checking WifiManager.isEasyConnectSupported(). No Location or Wi-Fi permission is needed 8.

Security

  • Sticker substitution. The specification's threat model describes an attacker covering a device's QR sticker with their own, swapping a packing list, or replacing the scanning app. No proof of possession accompanies the key, which it says makes such subversion "impossible to discover". A code shown on the device's own screen is much harder to attack 1.
  • Knowing the key matters. The design assumes only valid Configurators know an Enrollee's bootstrapping key, so the specification calls a database of these keys sensitive 1. A printed QR code exposes that key to anyone who can see the label.
  • Public code, no secret. Unlike a WIFI: code, the symbol reveals no network credential. Provisioning keys travel only in encrypted DPP messages after authentication 1.
  • Academic analysis. Chatzisofroniou and Kotzanikolaou (International Journal of Information Security, February 2025) assessed version 3.0 and argued that some design choices may widen the attack surface compared with WPS. They describe no QR-specific attack. Their concern is that a device can fall back to QR's single-factor, non-mutual authentication if it is enabled alongside a mutual method. They also report PKEX and introduction-protocol downgrades, and a hostapd PKEX flaw, CVE-2022-37660 25. The Wi-Fi Alliance called the mode choice a policy decision for the deployed Enrollee 25. The same work was presented at DEF CON 33 in August 2025 27.
  • Tracking. Slides from an NDSS 2026 paper list static bootstrapping-key exposure and MAC address leakage for Easy Connect, both enabling device tracking. They report testing on 19 commercial devices and acknowledgement by the Wi-Fi Alliance 26.

Implementations

No dedicated library for this format was found: an implementation builds the URI, then any QR encoder renders it. Likewise any QR decoder reads it, and the protocol stack parses the string.

Project Lang Stars Last active Notes
hostap / wpa_supplicant (Zephyr tracking repo) C 7 2026-10 Reference open implementation. dpp_bootstrap_gen and dpp_bootstrap_get_uri produce a URI, and dpp_qr_code imports one, with CONFIG_DPP=y 12. Upstream is at w1.fi, so the star count of this mirror says little. DPP release 3 arrived in v2.11, 20 July 2024 14
espressif/esp-idf C ~19.4k 2026-10 Enrollee support; only the QR method at present 15
HewlettPackard/dpp C 30 2024-02 Code linked from Harkins's NCCoE slides 18
zxing/zxing Java ~34.2k 2026-10 General QR encoder and decoder; carrier only

Intel's IWD daemon was reported gaining initial DPP support in December 2021 17. dpp-qrcode.py in the wpa_supplicant tree renders the URI with the Python qrcode library at error level M 13.

Comparison

  • DPP: vs WiFi QR WIFI:. WIFI: is a ZXing plain-text convention whose fields include the SSID and the password 10. Anyone who reads it has the password. DPP: holds a public key and no network credential, so a device can be admitted individually, given a per-device Connector credential, and keep its configuration when the SSID changes 3 4. But DPP: needs chipset, driver and firmware support, as well as a Configurator 7, whereas WIFI: needs only a phone that reads the string. Choose WIFI: for guests on a home network, and DPP for fleets of devices or for per-device credentials.
  • Direction of the scan. With WIFI: the joining device scans the network's code. In DPP the usual flow has an existing device scan the newcomer's code, which is how something with no camera or screen can join 23. Android 10 supports both: it scans a device's code as Initiator-Configurator, or a network's code as Initiator-Enrollee 7.
  • QR vs other DPP bootstraps. QR suits a person with a phone and a device in hand. Cloud lookup suits bulk orders, NFC suits a tap, and PKEX replaces the public key with a shared code 3.
  • DPP vs WPS. Android treats it as the WPS replacement 7. It uses public-key cryptography, and each device can be authenticated and given its own policy 5.

Fun facts

  • The specification's worked examples do not match its own printed codes. The text says the two samples are 103 and 126 characters and fit QR versions 4 and 5 1. The strings are 102 and 125 characters, and the printed symbols measure 37 and 41 modules wide, which are versions 5 and 6. The text quotes alphanumeric capacities (114 at version 4-L), though the lowercase Base64 forces byte mode, where version 4-L holds only 78 1 28.
  • The NFC example has a stray byte. Table 13 spells the second sample in hex with a space (0x20) before V:2, which makes it the stated 126 bytes, and gives the payload length as 0x7A (122) beside a label reading 127 1.
  • Android's Wi-Fi sharing code lives in a package named wifi.dpp, yet the code it displays is the older format: WifiNetworkConfig.getQrCode() builds a WIFI: string. The parser class accepts both schemes 9 10.

Status

Active. Version 3.0 (22 November 2022) is the latest version found; a search for a newer one found none, which does not prove none exists 1. The certification program remained in commercial use in 2022, when TÜV Rheinland Japan began offering it 22. Support continues in Android's platform documentation 7, in hostap's release 3 work 14 and in ESP-IDF, whose repository was active in October 2026. Researchers were still publishing on it in 2026 26.

The URI scheme is registered at IANA as dpp, with provisional status and the Wi-Fi Alliance as change controller. The entry names QR codes, BLE frames and NFC tags as carriers, and cites a "Device Provisioning Protocol Specification" title 2.

No Apple or Microsoft documentation on Easy Connect support was found, so this page makes no claim about iOS or Windows.

Sources

1 Wi-Fi Easy Connect Specification v3.0 — Wi-Fi Alliance, 2022 2 dpp URI scheme registration (provisional) — IANA, accessed 2026 3 Wi-Fi Easy Connect: Simple and secure onboarding for IoT — Dan Harkins, Wi-Fi Alliance blog, 2023 4 Wi-Fi Easy Connect — Wi-Fi Alliance, accessed 2026 5 Wi-Fi Alliance connects and expands home Wi-Fi — Wi-Fi Alliance, 2021 6 Wi-Fi CERTIFIED Easy Connect Technology Overview (2022) — Wi-Fi Alliance, 2022 7 Wi-Fi Easy Connect — Android Open Source Project, accessed 2026 8 Wi-Fi Easy Connect — Android Developers, accessed 2026 9 WifiQrCode.java — AOSP Settings, accessed 2026 10 WifiNetworkConfig.java — AOSP Settings, accessed 2026 11 dpp.c — AOSP mirror of hostap, accessed 2026 12 README-DPP — AOSP mirror of hostap, accessed 2026 13 dpp-qrcode.py — AOSP mirror of hostap, accessed 2026 14 hostapd/wpa_supplicant - new release v2.11 — Hostap mailing list, 2024 15 Wi-Fi Easy Connect (DPP) — Espressif ESP-IDF, accessed 2026 16 dpp-enrollee example — Espressif, accessed 2026 17 Intel's IWD Wireless Daemon Preparing WiFi DPP Support — Phoronix, 2021 18 IoT Onboarding with DPP — Dan Harkins, NIST NCCoE, 2021 19 Build 1: Enterprise IoT Onboarding — NIST NCCoE, 2025 20 NIST SP 1800-36B, Trusted IoT Device Network-Layer Onboarding and Lifecycle Management — NIST, 2025 21 WiFi Easy Connect - DPP 1.1 — OpenSync, accessed 2026 22 Wi-Fi CERTIFIED Easy Connect certification service launch — TÜV Rheinland Japan, 2022 23 Wi-Fi Easy Connect (column, in Japanese) — Yusuke Ohara, INTERNET Watch, 2018 24 New standards WPA3 and Easy Connect (in Japanese) — BUSINESS NETWORK, 2018 25 Security analysis of the Wi-Fi Easy Connect — G. Chatzisofroniou and P. Kotzanikolaou, International Journal of Information Security, 2025 26 WCDCAnalyzer: Scalable Security Analysis of Wi-Fi Certified Device Connectivity Protocols — Z. Shen, I. Karim and E. Bertino, NDSS 2026 27 Breaking Wi-Fi Easy Connect: A Security Analysis of DPP — DEF CON 33, 2025 28 Character Capacities by Version and Error Correction Level — Thonky.com, accessed 2026

Deployments

No country reports mention this standard by name.

Regions / aggregations not mapped to a single country

  • Universal
source · content/standards/wi-fi-easy-connect-qr/index.md