Wi-Fi and vCard QR Codes: Beyond Plain Links

A Wi-Fi QR code encodes a compact string in the form WIFI:T:WPA;S:my-network;P:my-password;H:false;;. The T field is the security type — WPA (which also covers WPA2 and WPA3), WEP, or nopass for an open network. When a phone recognises this pattern it offers to join the network directly, so a guest never has to read a long password off a sticker and type it by hand.

This is ideal for cafes, offices and holiday rentals. Print the code near the entrance, and visitors are online in seconds. Because QRForge builds the code locally, the password never leaves your device — a real advantage over websites that generate Wi-Fi codes on a server.

The syntax has sharp edges. Semicolons, commas, colons, double quotes and backslashes all carry meaning inside the string, so any of them appearing in your network name or password must be escaped with a backslash — a password of pa;ss is written P:pa\;ss. A hidden network needs H:true, and the whole string ends with two semicolons rather than one. Get any of that wrong and the phone will either try the wrong credentials or silently show you the raw text instead.

Native support is broad: iOS has handled these codes since iOS 11 and Android since version 10, and both can generate one for a network you are already connected to. The real gap is enterprise Wi-Fi. Networks that authenticate each user individually with 802.1X cannot be described by this string at all, because there is no single shared password to encode. And on WPA3-only networks some platforms expect T:SAE rather than T:WPA, so scan a test print before you order a hundred stickers.

A vCard code holds a small block of text in the vCard standard, framed by BEGIN:VCARD and END:VCARD with lines for the full name (FN), phone (TEL), email (EMAIL) and website (URL). Scanning it opens a prefilled new-contact screen, so the details land in the address book correctly instead of being retyped. It is the natural upgrade to a paper business card.

Which vCard version you use matters for compatibility. Version 3.0 is the safest choice for scanning: every mainstream phone parses it, and it is what most generators emit. Version 4.0 is cleaner and better specified, but a handful of older readers still stumble on it. There is also MeCard, a far terser format from Denso Wave — MECARD:N:Doe,John;TEL:+37255512345;EMAIL:john@example.com;; — which carries the same essentials in roughly half the characters.

Size is the practical constraint. A name, one phone number, one email and a website fit comfortably in a version 5 or 6 code. Add a postal address, a job title, a company name and a second number and you are at version 10 or beyond — a dense square that needs to be printed at 3 cm or larger to scan cleanly. Embedding a portrait through the PHOTO field is technically legal and almost always a mistake: even a heavily compressed JPEG runs past the format's entire capacity.

The same idea powers three more types. A tel: code opens the dialer with your number ready to call; an sms: code opens the messaging app with the recipient — and optionally a draft message — filled in; and a mailto: code starts a new email with the address and subject prepared. Each is just a short URI scheme that phones have understood for years, wrapped in a QR code so it can be scanned rather than typed.

In the generator, pick the content type first and the fields adapt to match. Fill them in, and QRForge assembles the correct string automatically — you never have to remember the exact syntax.

Everything in this family lands in byte mode, which spends eight bits per character — and more than that for anything outside plain Latin. A name written in Cyrillic or Greek costs two bytes per letter in UTF-8, and an emoji costs four. A contact card that looks short in the form can therefore produce a surprisingly large code, and a subject line with an em dash in it can be what pushes the version up a step.

Three habits keep them manageable. Encode only the fields someone actually needs, not every field the form offers. Prefer the shortest correct form of each value — a phone number as +37255512345, with no spaces or brackets. And for a long link inside a vCard, use a short path on your own domain rather than a campaign URL with a forty-character query string trailing behind it.

A structured code is static text, so it is only as current as the day you made it. Rotate the Wi-Fi password and every printed sticker is dead. Change jobs and every business card points at an address that bounces. That is less a flaw than a planning question: decide up front how long the code is meant to live, and who will notice when it stops being true.

Two mitigations work well. For Wi-Fi, put guests on a separate network with a password you rotate on a schedule you control, and reprint on that same schedule rather than in a panic. For contacts, encode a short URL to a page you maintain that offers the vCard as a download: the printed square never changes, while the details behind it can be corrected any time.