Standards/wifi-qr
WiFi QR
Overview
WiFi QR is a plain-text data format encoded inside a standard QR Code symbol that carries the credentials needed to join a wireless network. When a phone camera decodes the payload, the operating system recognizes the WIFI: prefix and offers a one-tap "join network" action instead of requiring the user to type an SSID and password by hand 6.
The payload is a single line of key:value; pairs of the form WIFI:T:WPA;S:mynetwork;P:mypass;;, where S is the SSID, T the authentication type, and P the password 1. It is not an official IETF or ISO standard; rather it is a de facto convention documented by the ZXing project that camera apps on Android and iOS implement 1.
History
The WIFI: format derives its grammar directly from NTT DoCoMo's MeCard contact syntax — the same TAG:value; structure, the same backslash-escaping rules, and the same terminating double semicolon 1. ZXing documented it in its "Barcode Contents" wiki page as part of the conventions the library encodes and decodes 1.
Apple's iOS 11 (released September 2017) made the system Camera app decode QR codes natively, including WiFi-configuration codes: pointing the camera at a WIFI: code surfaces a "Join [Network Name]" banner 7. Android gained an analogous capability, and Android 10 (Q) added a system "Share" QR feature in the Wi-Fi settings that both generates and scans network QR codes; that release also introduced support for the Wi-Fi Alliance's separate Wi-Fi Easy Connect / Device Provisioning Protocol (DPP) as a WPS replacement, which uses a different QR payload than the ZXing WIFI: convention 8.
A divergence later emerged around WPA3: the WPA3 specification requires characters outside the printable set and semicolons to be percent-encoded, whereas the original ZXing convention (and Android's implementation) escapes them with a backslash instead, which means many WPA3-era codes do not strictly follow the Wi-Fi Alliance text 2.
Technical specification
A WiFi QR payload is a single text string. The canonical example is 1:
WIFI:T:WPA;S:mynetwork;P:mypass;;
Fields are KEY:value; pairs; field order is not fixed; the record ends with an extra ; (a double semicolon overall). The documented fields are 1:
| Field | Meaning | Notes |
|---|---|---|
S |
SSID (network name) | Required. Enclose in double quotes if the name is ASCII but could be read as hex 1 |
T |
Authentication type | WEP, WPA, WPA2-EAP, or nopass for an open network 1 |
P |
Password | Ignored when T:nopass; quoting rule as for S 1 |
H |
Hidden network | true if the SSID is not broadcast 1 |
E |
EAP method | WPA2-EAP only, e.g. TTLS, PWD 1 |
A |
Anonymous identity | WPA2-EAP only 1 |
I |
Identity | WPA2-EAP only 1 |
PH2 |
Phase-2 method | WPA2-EAP only, e.g. MSCHAPV2 1 |
Escaping. The special characters \, ;, ,, " and : must each be escaped with a leading backslash, exactly as in MeCard encoding 1. For instance, an SSID that is literally "foo;bar\baz" (double quotes included in the name) is encoded as WIFI:S:\"foo\;bar\\baz\";; 2.
Open networks use T:nopass (or omit the password); a trailing literal newline in the payload causes the join to fail on both iOS and Android 2. Under WPA3, the Wi-Fi Alliance mandates percent-encoding of non-printable characters and semicolons, a rule Android does not follow in practice 2.
Use cases
- Venue / guest Wi-Fi posters. Cafés, hotels, offices and rentals print a WiFi QR so guests join without being told a password. Both iOS and Android trigger a system-level "connect" action on scan 1 6.
- Phone-to-phone sharing. Android 10's Wi-Fi settings can display a QR for the currently connected network so a second device joins by scanning it 8; iPhones surface the same flow 7.
- Bulk provisioning. Printed codes let staff onboard many devices to a network without typing long WPA2/WPA3 passphrases 6.
Implementations
| Project | Lang | Stars | Last active | Notes |
|---|---|---|---|---|
| zxing/zxing | Java | ~34k | 2025 | Reference library; its "Barcode Contents" wiki defines the WIFI: convention 1 5 |
| evgeni/qifi (QiFi, qifi.org) | JavaScript | ~700 | 2025 | Pure-browser generator; credentials never leave the device 3 |
Android WifiDppQrCode (AOSP) |
Java | — | 2025 | System scanner/generator in Wi-Fi settings; also handles DPP codes 8 |
Comparison
- WiFi QR vs manual entry. A scan eliminates transcription of long WPA2/WPA3 passphrases and the SSID, which is the format's whole reason to exist 6.
- ZXing
WIFI:vs Wi-Fi Easy Connect (DPP). TheWIFI:convention simply hands over a plaintext passphrase. DPP, introduced with Android 10, performs a public-key onboarding handshake and is a WPS replacement; it uses a distinct QR payload and supports WPA2 and WPA3 8. - WPA3 percent-encoding vs ZXing backslash-escaping. The two escaping schemes disagree, so a payload generated to the strict WPA3 rule and one generated to the ZXing/Android rule can differ for the same credentials 2.
Fun facts
- The
WIFI:grammar is a direct descendant of a Japanese mobile-phone contact format: it borrows theTAG:value;;structure and backslash escaping from NTT DoCoMo's MeCard 1. - QiFi deliberately runs entirely client-side so that "WiFi stays as secure as it was before" — the password is never sent to a server to render the code 3.
Status
Active and ubiquitous. Both major mobile OSes decode WIFI: codes through the system camera (iOS since iOS 11; Android natively, with a dedicated generator/scanner in Wi-Fi settings since Android 10) 7 8. The format remains a community convention rather than a ratified standard, with an unresolved escaping mismatch around WPA3 2.
Sources
1 Barcode Contents — ZXing Wiki 2 Most WPA3 WiFi QR Codes are broken — Steve's Blog, 2024 3 QiFi — pure JS WiFi QR Code Generator — Evgeni Golov 5 zxing/zxing — ZXing project, GitHub 6 QR code mobile OS breakdown: iOS vs Android in 2026 — QRCodeKit, 2026 7 How to make a QR code to connect guests to your Wi-Fi — AppleInsider, 2021 8 Wi-Fi Easy Connect — Android Open Source Project
Deployments
No country reports mention this standard by name.
Regions / aggregations not mapped to a single country
- Universal