# WiFi QR code special characters — the escaping rules

> Five characters are structural in the WIFI: format and must be backslash-escaped inside the SSID and password: backslash, semicolon, comma, colon, and double quote. Unescaped, they terminate the field early and the phone tries a truncated password. Values made entirely of hex digits should also be wrapped in double quotes.

Source: https://useqr.app/docs/troubleshooting/wifi-qr-special-characters-escaping · Last reviewed 2026-08-21 · UseQR is free forever, MIT licensed, no signup.

---

## The five characters

The `WIFI:` format is structured by punctuation: fields end at semicolons and keys end at
colons. Five characters are therefore reserved, and each must be preceded by a backslash
wherever it appears inside an SSID or password:

```
\   ;   ,   :   "
```

The backslash itself is escaped first (`\` becomes `\\`), then the other four. That
ordering matters when you write the escaping yourself: escape backslashes before adding
new ones, or you double-escape.

Nothing else needs escaping. Apostrophes, `@`, `#`, `$`, `%`, `&`, spaces, and every other
symbol pass through literally — over-escaping is its own bug, because the phone then tries
a password containing literal backslashes.

## Broken and fixed, side by side

Password `p@ss;word`:

```
WIFI:T:WPA;S:CafeGuest;P:p@ss;word;;      broken — phone tries "p@ss"
WIFI:T:WPA;S:CafeGuest;P:p@ss\;word;;     correct
```

The unescaped semicolon terminates `P:` early. The phone attempts to join with `p@ss`,
fails authentication, and reports a wrong password — which sends everyone off to retype a
password that was never the problem.

SSID `Bob's "Blue" Café, Bar` with password `pass:word\1`:

```
WIFI:T:WPA;S:Bob's "Blue" Café, Bar;P:pass:word\1;;                broken twice
WIFI:T:WPA;S:Bob's \"Blue\" Café\, Bar;P:pass\:word\\1;;           correct
```

Note what changed and what did not: the apostrophe and the `é` are untouched; the quotes,
comma, colon and backslash each gained a backslash.

## The hex rule

A quirk inherited from the format's scanner-side conventions: a value consisting
**entirely of hexadecimal digits** (like `1A2B3C4D`) can be interpreted as a raw hex key
rather than a literal passphrase. If your SSID or password genuinely is all hex characters,
wrap the whole value in double quotes — `P:"DEADBEEF12";` — to force literal
interpretation. This is also why the double quote is on the reserved list. Related but
different: a 64-character all-hex password is a raw WPA PSK by definition, covered in
[WiFi QR code not connecting](/docs/troubleshooting/wifi-qr-code-not-connecting).

## Emoji and non-ASCII SSIDs

SSIDs are byte strings, and plenty of routers happily broadcast `☕ Café Wifi`. In a QR
payload these are encoded as UTF-8, and current iPhone and Android cameras handle them.
Older scanner apps are less reliable — some decode the bytes with the wrong character set
and search for a mangled SSID that does not exist. If a network name uses emoji and guests
report failures on older devices, the pragmatic fix is renaming the network; no payload
trick repairs a scanner-side decoding assumption.

## Where this really bites

Hand-built payloads, spreadsheet formulas and naive templates — anywhere the string is
assembled by concatenation. UseQR's [WiFi generator](/wifi-qr-code) applies exactly the
escaping above automatically (backslash first, then `; , " :`), and the
[printable WiFi card](/wifi-card) uses the same builder. Generation runs client-side, so
the password never leaves your browser — worth knowing before typing credentials into
[any online tool](/docs/security/client-side-vs-server-side-qr-generation).

## The ten-second check

Decode your own code with our [scanner](/scan) and read the raw string. If the password in
the payload stops at a punctuation mark, you have found the bug. Fields out of order or a
missing `T:` value are the neighbouring failure, covered in
[wrong security type](/docs/troubleshooting/wifi-qr-code-wrong-security-type).

## FAQ

### Which characters need escaping in a WiFi QR code?
Exactly five: backslash, semicolon, comma, colon, and double quote — each preceded by a backslash inside the SSID or password. Everything else, including spaces, apostrophes and symbols like @ or #, passes through literally with no escaping.

### Why does my WiFi QR code say incorrect password?
Most often an unescaped semicolon or colon in the password terminated the field early, so the phone tried a truncated password. Decode the code and read the string — if the password stops at punctuation, that is the bug.

### Do spaces in an SSID or password need escaping?
No. Spaces are literal in the WIFI: format and need no treatment. Only backslash, semicolon, comma, colon and double quote are reserved. Escaping characters that do not need it inserts literal backslashes into the password and breaks it differently.

### Why is my all-hex password treated strangely?
Values made entirely of hex digits can be read as a raw hex key instead of a passphrase. Wrap the value in double quotes to force literal interpretation. A 64-character hex string, though, is by definition a raw WPA PSK.

## Try it

- https://useqr.app/wifi
- https://useqr.app/wifi-card
- https://useqr.app/scan
- https://useqr.app/validate