WiFi QR code has the wrong security type

The three legal values

The WIFI: format has one security field, T:, and it accepts exactly three values:

T: value	Use for	Password field
WPA	WPA, WPA2, WPA3 (any home/small-office passphrase network)	Required
WEP	Legacy WEP networks (1999-era; retire the router if you can)	Required
nopass	Open networks with no password	Must be absent

A complete, correct payload looks like this:

WIFI:T:WPA;S:CafeGuest;P:beans1234;;

That is the entire menu. Everything that goes wrong with this field is a value that is not on it, or the right value on the wrong network.

There is no WPA2 or WPA3 token

The single most common mistake is writing T:WPA2 or T:WPA3 because that is what the router's admin page says. Those tokens are not part of the format. Behaviour with an unknown token is undefined: some phones shrug and treat it as WPA, others silently fail to join, and you get the classic "works on my phone" report — a close cousin of codes that scan on Android but not iPhone.

For every passphrase-protected network — WPA, WPA2, WPA2/WPA3 mixed, WPA3 — the correct value is plain WPA. The phone joins the network and negotiates the strongest protocol both ends support. The QR code never specifies the protocol version; it only says "this network takes a passphrase, here it is".

WPA3-only networks and older phones

If the router is set to WPA3-only (SAE, no transition mode), a device that lacks WPA3 support cannot join that network at all — from a QR code, from settings, from anywhere. The code is correct with T:WPA; the handset simply does not speak the protocol. If guests with older phones matter to you, enable WPA2/WPA3 transition mode on the router rather than fighting the QR code.

The nopass rules

nopass means an open network, and it means it strictly: an open network cannot take a password. UseQR's WiFi generator refuses a password with nopass and refuses WPA/WEP without one, because both combinations produce codes that fail silently on some handsets. Two mismatches to check for:

• nopass on a secured network — the phone joins nothing, or joins and immediately drops with an authentication error.
• WPA on an open network — the phone waits for a passphrase exchange that never comes.

One honest edge case: a network with a captive portal is still nopass if the radio layer is open. The QR code joins the radio network; the portal is a separate, later step.

Diagnose in ten seconds

Decode your own code with our scanner and read the string. Check three things in order: the T: value is one of the three legal tokens, it matches what the router actually runs, and P: is present exactly when it should be. If the network is hidden, H:true must also be there — that and the escaping of special characters are covered in WiFi QR code not connecting and special-character escaping.

Then regenerate: prefill the generator with your SSID, pick the security type from the three real options, and print a fresh WiFi card. Generation is client-side, so the password never leaves your browser.

FAQ

What security type should I choose for a WPA2 network?

WPA. The WIFI: format has one token for all passphrase networks — WPA covers WPA2 and WPA3, and the phone negotiates the actual protocol during the join. WPA2 is not a valid token and behaves unpredictably across handsets.

Why does my WiFi QR code fail only on some phones?

An invalid T: value — such as WPA2 or WPA3 — is handled leniently by some handsets and rejected silently by others. A WPA3-only router produces the same symptom for a different reason: older devices cannot join regardless of the code.

What do I use for a network with no password?

T:nopass, with no P: field at all. An open network cannot take a password, and including one produces undefined behaviour. If the network has a captive portal, it is still nopass — the portal happens after joining.

Can a QR code specify WPA3 explicitly?

No. The format predates WPA3 and was never extended with a token for it. T:WPA is correct for WPA3 networks; devices that support WPA3 will use it automatically, and devices that do not cannot be helped by any payload.