Wi-Fi QR Code Generator

Free Wi-Fi QR code generator

Here is the short version: a Wi-Fi QR code generator turns a guest SSID and password into a picture a phone can scan. This one runs in the browser. The password never leaves the tab. Print it for the guest network. Do not encode the staff SSID and tape it to the espresso machine.

Most “free QR” sites want an account, a logo upload, and your PSK on their server. That is a strange place to put the keys to the lobby. Here the payload is built locally, drawn on a canvas, and downloaded as PNG. Scan it with a phone that is not already saved to the network before you laminate anything.

What the code actually stores

Android documented the WIFI: format years ago. iPhone Camera joined later. The string looks like this:

WIFI:T:WPA;S:Guest-Lobby;P:change-me-now;H:false;;

T is WPA (which covers WPA2-Personal and WPA3-Personal in practice), WEP, or nopass. S is the SSID. P is the password. H marks a hidden network. Semicolons, commas, colons, quotes, and backslashes inside the name or password get a backslash. The ZXing project still hosts the barcode contents note that popularized this payload. This page follows that grammar. It does not speak CAPWAP to your access point.

A QR code is not encryption. Anyone who photographs the sign has the password. That is fine for a guest VLAN that only reaches the internet. It is a problem if the same PSK opens file shares.

Worked example

Defaults on this page are a demo: Guest-Lobby / change-me-now. Replace both before you print. WPA/WPA2/WPA3 passphrases must be at least eight characters or the access point will reject the join. Generate a 20-character random passphrase with the password generator if the current guest key is the street number. The generator will not draw a code until that eight-character floor is met.

Then do the join test we use on site:

1. Phone is not already joined
2. Scan the code from the waiting room
3. Confirm internet
4. Confirm the phone cannot ping a printer, a POS, or a NAS

If step 4 fails, you printed a convenience sticker for a flat network. Fix the VLAN first. The longer argument is in guest Wi-Fi security for offices. A restaurant version of that test is guest Wi-Fi that stopped at the register.

Guest vs staff, every time

CISA’s wireless guidance is not subtle: segment guest access from the internal network. A second SSID without a second VLAN is a name change. The firewall has to deny guest to staff. Client isolation on the guest SSID stops visitor-to-visitor worms on a busy Saturday.

WPA3-Personal is the current Wi-Fi Alliance baseline for a PSK network. The Alliance’s security overview is the vendor-neutral page. WEP belongs in a museum. Open guest Wi-Fi is a last resort for a park kiosk, not a law firm waiting room.

The payload still says T:WPA for WPA2-Personal and WPA3-Personal. Phones treat that as “PSK network.” You configure WPA3 on the access point. The QR code does not negotiate the cipher. If a 2016 phone cannot join a WPA3-only SSID, that is an AP setting, not a broken PNG.

SAE (the WPA3 handshake) resists offline dictionary attacks better than WPA2’s 4-way handshake. That matters if someone photographs the sign and later tries to crack a weak passphrase. It does not matter if the passphrase is 20 random characters. Use both: WPA3 on the AP, a long PSK in the code.

Hidden SSID is not a security control. Phones still broadcast the name when they probe. Hidden plus a QR code is extra friction for honest guests and zero friction for anyone who already scanned the sign. Leave the guest SSID visible.

How to print without creating a second incident

Download the PNG. Print at a size a camera can resolve from chest height, not a postage stamp on a menu. If you reprint after a password rotation, take the old sign down the same hour. A drawer of last year’s codes is how a former vendor still joins.

Do not drop a logo in the middle of the modules unless you retest. This generator draws a clean code with a quiet zone. Decorate the paper around it, not the pixels. A smudged inkjet print at 2 cm wide will fail in a dark lobby. Print larger than you think, on matte paper, and test from the actual chair a guest sits in.

Rotate the guest PSK when staff turn over, after an event, and when you suspect the sign was photographed into a group chat. Regeneration here takes seconds. The VLAN design is the part that takes an engineer.

Hospitality, offices, and the password on the wall

Hotels and restaurants want the join to take five seconds. Offices want the same thing in the waiting room. Both still need the register, the EHR, and the file share off that SSID. A QR code speeds the join. It does not decide where the packet is allowed to go.

If the guest password has not changed since the last manager left, change it, then reprint. The old PNG in a Google Drive folder is still a live key. Same for a photo in a vendor group chat. After you rotate, walk the floor and pull yesterday’s table tents.

Phones cache networks. A guest who joined last year may never scan the new code. That is why the SSID name on the sign should match the AP exactly, including spaces, and why you should not rename Guest to Guest-2 without changing the print.

What this generator is not

It is not a site survey. It will not place access points or promise coverage in the patio. It is not WPA2-Enterprise. 802.1X does not live in a WIFI: string. It is not a substitute for network security work: firewall policy, SSID design, and monitoring.

It will not save you if the guest SSID is bridged onto VLAN 1. The QR code only types faster.

If you want the join test run in your lobby, contact Secure Techies. Bring the current guest password. We will try to reach the register before we talk about laminating a new sign.