There Is No T:WPA3 — The WiFi QR Code Format, and Why Yours Won't Scan

If you have tried to hand-write a WiFi QR code for a WPA3 network, you have probably written this:

WIFI:T:WPA3;S:MyNetwork;P:hunter2;;

And it did not work. Neither did T:WPA2, T:WPA2-WPA3, or T:WPA23. There is no error, no message. The phone reads the code, shrugs, and offers to do nothing.

The reason is simple and badly documented: the format has no WPA3 value. It has three, and two of them are not what you would guess.

The three values

A WiFi QR code is one line of text in a format that came out of the ZXing barcode library:

WIFI:T:<security>;S:<ssid>;P:<password>;H:<hidden>;;

T takes one of:

Value	Means
WPA	WPA, WPA2 or WPA3. All of them
WEP	WEP
nopass	Open network, no password

There is a fourth, WPA2-EAP, for enterprise networks that authenticate per user. It takes extra fields and is not what a café or an office guest network uses.

That is the whole list. WPA2 is not a value. WPA3 is not a value. Open is not a value — an open network is nopass.

So a WPA3 network is written exactly the same way a WPA2 network is:

WIFI:T:WPA;S:MyNetwork;P:hunter2;;

Why T:WPA is right for WPA3

The security field is not an instruction. It is a hint about what kind of credential follows.

When your phone joins a network it negotiates the actual protocol with the access point. The access point announces what it supports, and the two agree on the strongest option both can do. A WPA3-only router and a WPA3-capable phone will use WPA3 whether or not the QR code mentions it, because that negotiation has nothing to do with the QR code. The code's job ended when it handed over an SSID and a passphrase.

T:WPA means "this is a passphrase network, not WEP and not open". That is all the phone needs.

WPA3's own specification does add a QR field, but it is not a T: value: R:1 marks transition-disable, telling a client not to fall back to WPA2 on that network afterwards. It is an extra field beside the others, and most people never need it.

Why so many generators get this wrong

Search for a WiFi QR generator and you will find security dropdowns offering WPA2 and WPA3 as separate options. Some of those tools map both to T:WPA behind the scenes and the code works despite the label. Others write the label straight into the field, and produce a code no phone will accept.

You cannot tell which kind you used by looking at the QR code. They look identical. The only difference is inside.

That is the real problem here. A QR code is opaque by design, and a wrong one fails in the least helpful way available — silently, on someone else's phone, usually after it has been printed and laminated and put on a table.

Check the code, not the generator

Decode it and read the string.

Point the WiFi QR Scanner at the code with your phone, or upload the image to the QR Code Decoder on a desktop. Both show you what is actually in there.

What you want to see:

WIFI:T:WPA;S:MyNetwork;P:hunter2;;

What tells you the generator is broken:

• T:WPA3 or T:WPA2 — a phone will not accept either.
• T:Open where you expected an open network. It should be nopass.
• A missing P: on a network that has a password.
• A password with a ; or : in it that has not been escaped with a backslash. This one is easy to miss and breaks the parse at exactly that character.

Two other things that break these codes

The hidden flag. H:true is only for a network that does not broadcast its SSID. Setting it on a normal network makes some phones fail to find the network at all, because they go looking for something hidden and give up when it is not.

The SSID is case-sensitive and space-sensitive. Cafe WiFi and Cafe Wifi are different networks as far as the code is concerned. If the printed card has been retyped by anyone at any point, decode it again.

If you write one by hand

This is a perfectly reasonable thing to do, and it avoids the generator problem entirely. Take the line, put it in any QR generator that accepts plain text, and you are done:

WIFI:T:WPA;S:Your Network Name;P:your password;;

Note the two semicolons at the end. One closes the last field, one closes the record. Leaving off the second is the other common way these fail.

Escape \, ;, ,, " and : inside the SSID or password with a backslash. If your WiFi password is pa;ssword, write pa\;ssword.

Then decode it before you print it.