Why you should not upload a WiFi password to a website

What a WiFi QR code contains

The payload is a plain-text string in a well-known format:

WIFI:T:WPA;S:CafeGuest;P:the-actual-password;;

Network name, security type, password — readable by anything that decodes the code. That is the point: your guests scan it and join without typing. It also means the password exists in cleartext wherever that string travels.

What happens on a server-side generator

Most QR websites render the image on their server. Fill in their WiFi form and your SSID and password are transmitted, in that string, to hardware you do not control. From there:

• Default logging captures it. Standard access-log configurations record full request URLs and bodies pass through application logs; nobody had to decide to keep your password for it to be kept.
• Retention is unknowable. Log rotation policies, backups, third-party log platforms — none of it is visible from outside, whatever the marketing page says.
• Breaches inherit it. If that provider is compromised in two years, your network credentials are part of the spill.

The broader inventory of what generators observe is in what your QR provider can see.

Why this matters more than a URL

Uploading a public URL to a generator leaks nothing — the URL was public anyway. A WiFi password is a credential. It grants join access to your network, and for a small business the guest network often sits one misconfiguration away from the till, the printer and the CCTV. Credentials deserve a stricter rule than content: they should never transit infrastructure you cannot audit.

The architectural fix

The QR encoder is a few kilobytes of code that runs happily in a browser, so nothing about this problem is necessary. A safe WiFi generator has three verifiable properties:

1. Client-side encoding — the code is built on your device. Full comparison in client-side vs server-side generation.
2. Offline capable — the proof ritual: load the page, switch on airplane mode (flight mode on Android), then enter the password and generate. A tool that still works provably sent nothing.
3. Open source — so property 1 is inspectable, not a promise.

This is UseQR's exact design. The WiFi generator encodes in your browser, keeps the password out of the shareable page URL, and works with the network off — you can start from a prefilled link and add the password only on your own device. For a printable table-top version, the WiFi card maker works the same way.

If you have already uploaded it

Treat the password as disclosed, in proportion to what it protects:

1. Change the WiFi password on the router.
2. Regenerate the code client-side with the new password.
3. Reprint. A scan with your scanner confirms the new code carries the new credentials before it goes on the wall.

Remember the printed code itself is also cleartext — anyone who can photograph it can read the password. Put it where guests sit, not in the front window.

FAQ

Is it safe to make a WiFi QR code online?

Only with a tool that generates the code in your browser. A server-side generator receives your network name and password in plain text, and you cannot verify what its logs retain. The airplane-mode test distinguishes the two in ten seconds.

Can someone get my WiFi password from the QR code?

Yes — anyone who scans or photographs the code can read the password, because the payload is plain text by design. Display the code only where you would happily display the password itself.

Does UseQR see my WiFi password?

No. The WiFi code is generated entirely in your browser, the password never crosses the network, and it is excluded from the page URL so it cannot leak through history or referrer headers. The code is open source, so this is checkable.

What should I do if I typed my WiFi password into a QR website?

Change the password on your router, then regenerate the code with a client-side tool. There is no way to confirm deletion from someone else's logs, so rotation is the only reliable remedy.