Are WiFi QR codes secure?
Short answer: a WiFi QR code is exactly as secure as the password it contains, displayed in the place you put it. The QR itself adds no encryption and removes none. This guide covers what that means in practice, the three real risks worth thinking about, and how prettywifi.co handles your password.
What is actually inside
A WiFi QR code contains your network name and password as plain text. There is no encryption between the printed image and the phone scanning it. Anyone with a QR scanner can read the password by pointing a camera at the poster. This is by design: phones need to read it the same way.
In practice, this is no different from writing the password on an index card and pinning it to the wall. The code is convenient, but it is not a security upgrade.
The three real risks
Most concerns about WiFi QR security fall into one of three buckets. They are worth understanding so you can decide where a printed poster makes sense.
1. Someone walks past and scans it
If your printed poster is visible to people you do not want on the network, they can join. This is the same risk as keeping the password on a sticky note. The fix is the same: do not display the poster where people you do not trust can see it. A poster in your kitchen is fine. A poster taped to the inside of a window facing the street is not.
2. Someone photographs it from a distance
A modern phone camera at a couple of meters can capture enough detail to scan a QR code later. This matters for cafes, gyms, and waiting rooms more than for a private home. The defence is to use a guest network for any code that lives in a public-facing space, and treat the password as semi-public.
3. Long-term displays without rotation
A WiFi password that has been on a wall for three years has been seen by a lot of people. If any of them ever needed network access for a reason you would not have approved, they have it. For shared spaces, rotate the wifi password annually and reprint the poster. Takes ten minutes once a year.
What prettywifi.co does and does not do
Your password is encoded into the QR code entirely in your browser. Nothing about your network leaves the page. We never see, log, or store the SSID or the password. The only thing our server receives is your email address (if you choose to receive the PDF by email) and a finished PDF generated client-side.
This means prettywifi.co adds no third party to the chain of trust between you and your network. The QR code is yours, the poster is yours, the password is yours.
Best practices for printed wifi codes
The simplest rules cover most of the risk:
- Use a guest network for any QR that lives in a public or semi-public space.
- Do not display the poster in a window or any spot visible from outside the building.
- Rotate the password annually for shared spaces (cafes, offices, clinics).
- Do not include the QR code in social media photos of your home.
- Keep your main household network on a different password from the printed guest one.
Bottom line
A WiFi QR code is a convenience layer over a password you have already decided to share. If you would happily tell the people in the room what the password is, a printed QR is fine. If you would not, a QR does not solve that.
Common questions.
- Can someone scan my QR code from across the room?
- Yes, with a modern phone camera. Treat any printed wifi code as visible to everyone who can see the poster. Use a guest network for codes in public-facing spaces.
- Should I use a WiFi QR code in a public space?
- Only if you are comfortable with the password being seen by everyone who passes through. For cafes, gyms, and waiting rooms, use a dedicated guest network and rotate the password periodically.
- Is a QR code more secure than telling someone the password?
- No. The QR is a convenient way to share the password. The security is identical to telling the person directly. The convenience is real; the security upgrade is not.
- Does prettywifi.co see or store my password?
- No. The password is encoded into the QR code entirely in your browser. The only thing our server sees is your email address (if you choose to receive the PDF by email).