Wi-Fi QR code not working: why it says “incorrect password” and how to fix it

The short answer

If your phone scans the code, shows the right network name and then says the password is incorrect, the QR code contains a different password from the one you typed into the generator. Nine times out of ten the culprit is one of these characters in the password: ; : , " \. The rest of the time it is an accented or non-English character, or a phone that is still holding on to an old saved password. Each one is explained below, with the exact strings, so you can see which one bit you.

What a Wi-Fi QR code actually contains

There is nothing magic in a Wi-Fi QR code. It is a single line of text in a fixed format that phones recognise because it starts with WIFI::

WIFI:T:WPA;S:MyNetwork;P:MyPassword;H:true;;

• T: security type: WPA (covers WPA, WPA2 and most WPA3 networks), WEP, or nopass for an open network.
• S: the network name (SSID), exactly as it appears in the Wi-Fi list, case included.
• P: the password. Leave it out entirely for an open network.
• H:true only if the network is hidden. Otherwise omit it.
• Every field ends with ;, and the whole string ends with one more, hence the ;; at the end.

Field order does not matter to common readers. What does matter is that ; and : are delimiters, and that is where most broken codes come from.

Why the password is “incorrect” when it is not

Say your password is Coffee;Shop:2024. A careless generator outputs:

WIFI:T:WPA;S:Main_St_Cafe;P:Coffee;Shop:2024;;

The reader sees P:Coffee, hits the semicolon and decides the field is over. Shop:2024 looks like an unknown field and is silently dropped. Your phone tries to join with the password Coffee, the router refuses, and the only error you get is “incorrect password”. Typing the password by hand works, which makes it look like the QR code is cursed.

The de facto spec (written by the ZXing project and followed by Android and iOS) says five characters must be preceded by a backslash when they appear in the SSID or the password: \ ; , : ". Done properly:

WIFI:T:WPA;S:Main_St_Cafe;P:Coffee\;Shop\:2024;;

The Utiliobox QR code generator escapes all five characters for you, in both the network name and the password. You do not have to take that on trust: open “What it carries” under the preview and you will see the exact string encoded in the code.

Accented letters, non-Latin scripts and emoji

This one is harder to spot because the text looks fine. A QR code stores bytes, not letters. The QR standard says that, unless told otherwise, those bytes are ISO-8859-1 (Latin-1), but every current phone reads them as UTF-8. In Latin-1, é is one byte (E9); in UTF-8 it is two (C3 A9). If the generator writes Latin-1 and the phone reads UTF-8, a password like Café2024 arrives as something else, and to the router different bytes mean a different password.

Utiliobox converts the content to UTF-8 bytes before drawing the code, for exactly this reason; plain ASCII text is unaffected. But the better fix is upstream: keep Wi-Fi passwords to plain ASCII. WPA2 defines a passphrase as 8 to 63 printable ASCII characters, and anything outside that range is handled differently by different routers, laptops, smart TVs and printers. A code that works on your phone may still fail on a guest's laptop.

Other failures that look like a bad QR code

• The phone already knows the network with an old password. Especially common on iPhone. Tap “Forget This Network” and scan again.
• Smart quotes. Copy a password out of Word, Notes or an email and " may have become “ or ”, which are entirely different characters. Same with apostrophes.
• An invisible trailing space. Easy to pick up when pasting, and it counts as part of the password. Utiliobox trims leading and trailing spaces from the network name but leaves the password alone, because a space there could be deliberate.
• Wrong case in the SSID. home_wifi and Home_WiFi are different networks to a phone.
• The password changed after you printed. The code holds the password itself, not a link, so it never updates.
• Mismatched security type. A WPA2 network with T:WEP in the code makes the phone try the wrong method.

Hidden networks, WEP, open networks and WPA3

Hidden SSID

A hidden network does not broadcast its name, so the phone cannot find it by listening. H:true tells it to probe for the network actively. Android handles this well; iPhone support has been less consistent across versions. If you plan to share a hidden network by QR code, consider unhiding it. Hiding the SSID adds no real security, because the name still travels in the clear whenever a known device connects.

WEP

T:WEP is valid, but WEP can be cracked in minutes with free tools and many newer devices refuse to join it. If your router still runs WEP, the QR code is the least of your problems: switch to WPA2 or WPA3.

Open networks

Use T:nopass with no P: field, for example WIFI:T:nopass;S:Library_Free;;. Handy for networks with a captive portal, where users accept terms on a web page after joining.

WPA3

For WPA3 or mixed WPA2/WPA3 networks, use T:WPA. The field just says “there is a shared password”; the phone negotiates the actual protocol with the router. When Android shares a WPA3-only network it writes T:SAE, but not every reader understands that value, while T:WPA is universally recognised. On Utiliobox the option is labelled “WPA/WPA2/WPA3” and writes T:WPA.

What this format cannot do is enterprise Wi-Fi with per-user logins (WPA2-Enterprise, 802.1X). Some readers accept extensions for it, but none works across all phones.

iPhone vs Android: what happens when you scan

On iPhone, the built-in Camera app has recognised Wi-Fi QR codes since iOS 11. Point it at the code and a banner offers to join the named network. No app needed. If the banner appears but joining fails, the code was read fine and the problem is its content, so go back to the causes above.

On Android it depends on the manufacturer. Since Android 10, the Wi-Fi settings screen has a QR icon next to “Add network” that opens a scanner, and most camera apps (or Google Lens) recognise the code too. Some phones only display the raw text instead of offering to connect; if so, use the scanner in Wi-Fi settings.

A useful diagnostic: Android can show a QR code for any saved network (tap the network, then Share), and since iOS 18 the Passwords app on iPhone can do the same. If the code your phone generates works and the one you made online does not, decode both and compare the strings. The difference points straight at the badly escaped character.

How to make a Wi-Fi QR code that works first time

1. Copy the exact network name and password from your router's settings or the sticker on it.
2. In the QR code generator, pick the Wi-Fi type, paste both, and choose the encryption. Tick “The network is hidden” only if it is.
3. Expand “What it carries” and check every ;, :, ,, " and \ in your password has a backslash in front of it.
4. Keep it dark on light. The tool calculates the contrast ratio and warns you: below 3:1 nothing will read it, and above 7:1 is the comfortable zone.
5. Skip the logo unless you need it. Adding one makes the tool raise error correction to level H to compensate, but a Wi-Fi code's job is to work, not to look clever.
6. Download SVG for a print shop (it scales without losing quality) or PNG at 1024 or 2048 px for a home printer.

Test it before you print a hundred copies

Scanning it off your monitor proves very little: a screen is backlit and has contrast that paper will not. Do this instead:

• Verify the content. Upload the downloaded PNG to the Read tab of the same tool. It decodes the image in your browser and shows the full text, so you can confirm the password is what you think it is.
• Test on two different phones, ideally one iPhone and one Android, neither of which has the network saved.
• Print one copy at final size and scan it from the distance people will actually stand. Rule of thumb: the code's side should be about a tenth of the scanning distance, so roughly 3 cm (just over an inch) for 30 cm away, and never under 2 cm.
• Leave a white border. The standard asks for a quiet zone about four modules wide around the code. The image you download from Utiliobox already carries those four modules of white. Don’t crop them off in your design, and if the code sits on a coloured background or a photo, keep that white box around it.
• Avoid glossy lamination. A ceiling-light reflection right across the code makes it unreadable. Matte is far more forgiving.

Is it safe to put your Wi-Fi password in a QR code?

The password sits in the code as plain text. It is not encrypted or hashed: anyone who scans it, or just photographs it, can read it with any QR reader. The Utiliobox reader flags this whenever it decodes a Wi-Fi code. And because the password is baked in, you cannot revoke a printed code. The only way to cut off access is to change the password.

So for an Airbnb, a café or an office with visitors, put the code on a guest network: its own password, separate from the network your computers, NAS and cameras live on, and with client isolation turned on if your router supports it. The code on the wall then gives internet access and nothing else.

The other risk is where you generate it. Many QR websites render the image on their server, which means your SSID and password are sent to someone else's machine and may sit in their logs. Be wary of “dynamic QR codes” for Wi-Fi as well: a Wi-Fi code cannot be dynamic, because the phone needs the WIFI: string itself, not a redirect.

On Utiliobox the code is generated in your browser: the drawing library is served from the site itself and the form data is not sent anywhere. You can check this on any generator: load the page, generate one code, switch on airplane mode, then type your real details. If the code still updates with no connection, the site cannot be sending your password anywhere.

Checklist: Wi-Fi QR code won't connect

1. Does the phone show the correct network name? If not, the SSID is mistyped or contains an unescaped character.
2. Does the password contain ; : , " or \? Read the encoded string and look for a backslash before each one.
3. Does it contain accented letters, non-Latin characters or emoji? Change it to plain ASCII.
4. Was the network already saved on the phone? Forget it and scan again.
5. Did smart quotes or a trailing space sneak in when you copied the password?
6. Is the network hidden? Add H:true or unhide it.
7. Has the router's password or security type changed since you printed the code?