Guest WiFi on a card, password not uploaded

The job

Visitors should point a camera at a card and join “Cafe-Guest” without asking the staff to spell the password over the espresso machine. The card will be photographed. Anyone with the photo has the password. That is acceptable for a guest VLAN. It is not acceptable for the point-of-sale network.

Encode it here

Open the WiFi generator. SSID is the network name exactly as the access point broadcasts it, including spaces and capital letters. Security is almost always WPA (WPA2/WPA3 in practice still use the WPA type in the WIFI: string). Password is the PSK. Hidden is only for networks that do not broadcast the SSID — most guest networks are not hidden.

Mark escapes ; , : and \ inside the SSID and password so the phone parser does not split the fields. The payload looks like WIFI:T:WPA;S:Cafe-Guest;P:the-secret;; — you can confirm it in a decoder after download. We do not send that string to a server.

Print size

A 512-pixel PNG at about 5–7 cm on the card is enough for a phone at arm’s length. Keep four modules of quiet zone. Do not put the code on a window in direct sun behind half-silvered film. Test with an Android camera and an iPhone; they disagree more often than marketing sites admit.

When the password changes

Static codes do not update. Reprint the tent. If you change the password monthly, a dynamic QR vendor might be cheaper than card stock — and then you are back to a server holding the secret. Choose deliberately.