# WiFi QR code has the wrong security type

> The WIFI: format accepts exactly three T: values — WPA, WEP, and nopass. WPA covers WPA2 and WPA3; there is no WPA2 or WPA3 token, and nopass is only for open networks. A mismatched T: field fails silently, so decode the code and check the field, then regenerate.

Source: https://useqr.app/docs/troubleshooting/wifi-qr-code-wrong-security-type · Last reviewed 2026-08-21 · UseQR is free forever, MIT licensed, no signup.

---

## The three legal values

The `WIFI:` format has one security field, `T:`, and it accepts exactly three values:

| `T:` value | Use for | Password field |
|---|---|---|
| `WPA` | WPA, WPA2, WPA3 (any home/small-office passphrase network) | Required |
| `WEP` | Legacy WEP networks (1999-era; retire the router if you can) | Required |
| `nopass` | Open networks with no password | Must be absent |

A complete, correct payload looks like this:

```
WIFI:T:WPA;S:CafeGuest;P:beans1234;;
```

That is the entire menu. Everything that goes wrong with this field is a value that is not
on it, or the right value on the wrong network.

## There is no WPA2 or WPA3 token

The single most common mistake is writing `T:WPA2` or `T:WPA3` because that is what the
router's admin page says. Those tokens are **not part of the format**. Behaviour with an
unknown token is undefined: some phones shrug and treat it as `WPA`, others silently fail
to join, and you get the classic "works on my phone" report — a close cousin of
[codes that scan on Android but not iPhone](/docs/troubleshooting/qr-code-scans-on-android-but-not-iphone).

For every passphrase-protected network — WPA, WPA2, WPA2/WPA3 mixed, WPA3 — the correct
value is plain `WPA`. The phone joins the network and negotiates the strongest protocol
both ends support. The QR code never specifies the protocol version; it only says "this
network takes a passphrase, here it is".

## WPA3-only networks and older phones

If the router is set to WPA3-only (SAE, no transition mode), a device that lacks WPA3
support cannot join that network **at all** — from a QR code, from settings, from anywhere.
The code is correct with `T:WPA`; the handset simply does not speak the protocol. If guests
with older phones matter to you, enable WPA2/WPA3 transition mode on the router rather than
fighting the QR code.

## The nopass rules

`nopass` means an open network, and it means it strictly: an open network cannot take a
password. UseQR's [WiFi generator](/wifi-qr-code) refuses a password with `nopass` and
refuses `WPA`/`WEP` without one, because both combinations produce codes that fail
silently on some handsets. Two mismatches to check for:

- **`nopass` on a secured network** — the phone joins nothing, or joins and immediately
  drops with an authentication error.
- **`WPA` on an open network** — the phone waits for a passphrase exchange that never
  comes.

One honest edge case: a network with a captive portal is still `nopass` if the radio layer
is open. The QR code joins the radio network; the portal is a separate, later step.

## Diagnose in ten seconds

Decode your own code with our [scanner](/scan) and read the string. Check three things in
order: the `T:` value is one of the three legal tokens, it matches what the router actually
runs, and `P:` is present exactly when it should be. If the network is hidden, `H:true`
must also be there — that and the escaping of special characters are covered in
[WiFi QR code not connecting](/docs/troubleshooting/wifi-qr-code-not-connecting) and
[special-character escaping](/docs/troubleshooting/wifi-qr-special-characters-escaping).

Then regenerate: [prefill the generator](/wifi?ssid=CafeGuest&sec=WPA) with your SSID, pick
the security type from the three real options, and print a fresh
[WiFi card](/wifi-card). Generation is client-side, so the password never leaves your
browser.

## FAQ

### What security type should I choose for a WPA2 network?
WPA. The WIFI: format has one token for all passphrase networks — WPA covers WPA2 and WPA3, and the phone negotiates the actual protocol during the join. WPA2 is not a valid token and behaves unpredictably across handsets.

### Why does my WiFi QR code fail only on some phones?
An invalid T: value — such as WPA2 or WPA3 — is handled leniently by some handsets and rejected silently by others. A WPA3-only router produces the same symptom for a different reason: older devices cannot join regardless of the code.

### What do I use for a network with no password?
T:nopass, with no P: field at all. An open network cannot take a password, and including one produces undefined behaviour. If the network has a captive portal, it is still nopass — the portal happens after joining.

### Can a QR code specify WPA3 explicitly?
No. The format predates WPA3 and was never extended with a token for it. T:WPA is correct for WPA3 networks; devices that support WPA3 will use it automatically, and devices that do not cannot be helped by any payload.

## Try it

- https://useqr.app/wifi
- https://useqr.app/wifi-card
- https://useqr.app/scan
- https://useqr.app/validate