Put the guidance into practice: open the related free tool. Examples use stated inputs and are not measured performance claims.
| Field | Meaning | Practical check |
|---|---|---|
| S | Network name | Match spelling and case |
| T | Security type | Match the network configuration |
| P | Password | Treat the printed code as access information |
| H | Hidden-network flag | Set only when the network is hidden |
A convenience format, not password protection
The image contains the settings needed for the intended join action. Anyone who can photograph or decode it may be able to read the password. A QR pattern is not encryption, so do not put a private administrative network on a sign meant for visitors.
Use a guest network when your router and organization support one. The network's own configuration determines what guests can reach. The QR image does not create isolation, impose access controls or decide when access ends.
Keep a human-readable support instruction nearby. Visitors may use a device whose scanner displays the payload without offering a join action. They may also need help if the network is unavailable even though the code decodes correctly.
Match the security token to the network
The WiFi payload uses named fields for the network name, authentication type, password and hidden status. Tidy QR exposes WPA/WPA2, WPA3 and open-network choices. The WPA3 selection uses the SAE token recognized in the current Android parser source cited below.
The chosen token must describe the actual network. Selecting a stronger-sounding label does not reconfigure the router or upgrade its security. If the router uses a compatibility mode, test the intended client devices instead of assuming every camera interprets the payload identically.
For an open network, no password is required by the payload. That does not mean the connection has the same privacy properties as a protected network. The QR tool creates the configuration string; the network remains responsible for its own security and access behavior.
Special characters need escaping
WiFi strings use punctuation to separate fields. A network name or password containing that punctuation must be encoded so it is treated as data rather than a new field. Tidy QR applies the relevant escaping when building the payload.
This is why entering the network name into a structured WiFi form is preferable to manually assembling a string without understanding its separators. A semicolon in the password should remain part of the password, not prematurely end it.
Inspect the decoded content after generation. It may show escape characters used by the format. Compare the interpreted values and test an actual join rather than assuming the visible string should look exactly like ordinary prose.
A worked guest-network example
Choose a guest network named Cedar Guest with an illustrative password containing punctuation. Select the security mode that matches the router and leave the hidden option off unless the network is actually hidden. Generate the code and inspect its payload before printing.
Test with a device that is not already connected. A phone that automatically rejoins a saved network can make an incorrect QR code appear successful. Confirm that the scan offers or performs the intended join and that the resulting connection reaches the expected guest service.
Print the code with a clear label identifying the network. Keep the sign in the space where guest access is intended. If the password changes, generate and replace the code because the old password is stored directly in the existing pattern.
Hidden networks need deliberate testing
The hidden flag describes a network whose name is not normally advertised. It is not a privacy switch for the printed code. The SSID remains in the payload and can be read by anyone with the image.
Client behavior can differ across operating systems and scanning applications. The cited Android source shows how its parser recognizes the fields, while general camera support pages establish only the broader scanning workflow. They do not promise identical WiFi handling everywhere.
Test the actual hidden-network setup with the devices your guests are likely to use. If the QR route is inconsistent, provide manual joining instructions through an appropriate channel instead of relying on the image as the only path.
Plan updates as physical maintenance
A static WiFi code cannot learn that the router password changed. Updating a file in the generator does not update signs already printed. Keep an inventory of the places where the guest code is displayed so replacement is manageable.
Store the approved artwork securely because it contains access information. Avoid putting it in a public asset folder if the network is intended for a limited audience. A logo or decorative frame does not alter the sensitivity of the underlying password.
When access should be removed, change the network's credentials or controls through the router or network management system. Deleting the design file alone does not revoke information already distributed on paper.
Check the print and the connection separately
First verify that the image decodes to the intended settings. Then verify that a receiving device can join. Finally, check that the guest network provides the service visitors need. A failure at any of those layers calls for a different fix.
Preserve the quiet zone and use a clear dark-on-light pattern. A small sign placed behind reflective glass can fail at image recognition before the WiFi settings are even considered. Test the actual placement, not only a large screen preview.
A successful guest workflow should be understandable without technical knowledge. Label the action, provide a support route and maintain the sign when the network changes. The QR code removes typing, but it does not remove network administration.
Avoid misleading saved-network tests
A phone that already knows the network may reconnect using credentials stored earlier. To test the code itself, use a suitable device without that saved configuration or deliberately review the joining prompt through the device's normal network controls. Do not disrupt another person's connection merely to run a proof.
Verify the actual network identity after joining. Similar SSIDs can exist in nearby rooms or buildings, and a typo may be difficult to notice in a small label. The QR code should match the intended guest network exactly, including case and punctuation.
Keep passwords out of unrelated screenshots, shared design previews and public documentation. A proof image containing the live guest credential has the same sensitivity as the final sign. Use clearly illustrative values when documenting the workflow for a wider audience, then replace them only in the authorized production artwork. Verify that no illustrative credential remains before distributing the finished sign.
Frequently asked questions
Is the password hidden inside the QR image?
It is encoded, not encrypted. A reader can reveal it. Treat the image as access information.
Will changing my router password update the code?
No. Generate and distribute a replacement image containing the new settings.
Does every phone support WPA3 QR joining?
Support varies by device and app. The payload uses the documented SAE token, but the actual join behavior needs testing.
Sources
Last checked: . Examples are illustrative inputs, not measured results.
- Barcode Contents, ZXing project. Checked 2026-10-29.
- WifiUriParser.java, Android Open Source Project. Checked 2026-10-29.
- Scan a QR code with your iPhone or iPad, Apple. Checked 2026-10-29.
- Scan QR codes with your Pixel phone, Google. Checked 2026-10-29.
- Implementation specifications, checked against source code, Tidy QR. Checked 2026-10-29.