Is It Safe to Put Your WiFi Password in a QR Code?
The code is the password written in a form a camera reads quickly, not encryption of any kind: any scanner can display the network name and password without joining anything. Assume that anyone who can see the card has the credential, including from across a room or out of a photograph. Whether that matters depends on where the card goes, and separating a guest network from the one your own devices use does most of the work.
The card is designed, the printer is warm, and the finger hovers over the print button. It is a rental, the code goes on the kitchen wall, and the thought arrives late: am I about to publish my WiFi password to every person who books this place?
Yes. That is exactly what you are about to do. The useful question is not whether the code exposes the password but whether that matters where the card is going.
The code is the password, in a costume
A WiFi QR code contains the network name, the security type, and the password as text. The pattern of squares is a way of writing characters that a camera can read quickly. It is not a lock, not a key exchange, and not encryption of any kind.
Point any scanner at one and it can show you the raw payload without joining anything. Nothing exotic is required and nothing is being defeated. Reading the contents is the intended behavior, which is a general property of the format and part of what scanning actually does.
So the honest comparison is not "code versus password on a card." It is "password written in a font your phone reads faster." Anyone who could have copied the written password can copy the code, with less effort and less chance of a typo.
Who can read it, and from how far
Assume anyone who can see the card has the password. Not anyone who scans it: anyone who sees it.
A phone camera at moderate zoom can capture a wall card from across a room, and the image only needs enough resolution for the pattern, not for the human eye. Decoding can happen later, elsewhere, at leisure. There is no scan event, no log entry, and nothing on your side that would ever indicate it happened.
That sounds alarming until you notice it describes an ordinary sign. Signs are readable from across rooms. The security model for a WiFi card is the same as for a whiteboard: control the room, or accept that the room is public.
A cafe wall and a kitchen drawer are different problems
A card in a cafe, a lobby, a waiting room, or a co-working space is public by design. Its whole purpose is that strangers use it without asking. Treat the credential on it as published, because it is, and put nothing behind it that you would not put behind a published password. That means the card points at a guest network and never at the network carrying the payment terminal, the office file server, the security cameras, or the back-office printer.
A card in a private home is exposed to whoever enters the home. Guests, a cleaner, a repair technician, a babysitter, a delivery driver who steps into the hallway. For most households that population is fine, and a card on the fridge is a reasonable thing to have. The exposure is not zero, but it is the same exposure as your spare keys in the bowl next to it.
A card in a rental sits in the middle. Every guest for the life of that card gets a credential that keeps working after they leave, along with anyone they showed it to.
The mistake is almost always a photograph
Physical proximity is rarely how these leak. Photos are.
The listing photo of a tidy kitchen with the card visible on the counter. The unboxing video where a new router sits next to its label. The video call where a home office wall is in frame behind you. The holiday post from a rental with the info card on the table. A vacation photo of a cafe interior that happens to include the counter sign.
Codes survive this better than text does. A pattern that is small, angled, or slightly blurred in a photo can still be readable, and screenshots and re-uploads keep enough detail more often than people assume. A password written in cursive on the same card would probably be illegible at that size; the code will not be.
The fix is to check images before posting, and to obscure the code when it is in frame. Covering part of the pattern is not always enough on its own, since the format is built to survive damage, so proper removal or blurring is worth doing correctly rather than casually.
Guest network separation does most of the work
The single change that makes all of this manageable is separating the network the card points at from the network your own devices live on.
Almost every current router can run a second network with its own name and its own password. Enable it, give it a password used nowhere else, and generate the card from that one with a WiFi generator. If the router offers client isolation on the guest network, turn it on, so devices connected to it cannot reach each other or browse what is on the main network.
The effect is that the printed credential stops being a skeleton key. It becomes a ticket to the internet and nothing else, and losing control of it costs you bandwidth rather than access to your files, your cameras, and your work laptop. This is the same layered thinking behind general code security practice, applied to a credential you are deliberately handing out.
Rotation, and the reprint it costs
A guest network password should change on some schedule. Quarterly is a reasonable default for a business; for a rental, after any stay that felt off; for a home, when it stops feeling like the same set of people has it.
There is a real cost, and pretending otherwise helps nobody. A WiFi code is fixed at the moment it is created. It carries the password inside it, so it cannot be repointed later the way a redirect can. Change the password and every printed card in the building is now wrong.
Plan for that instead of discovering it. Keep the design simple enough to reprint in five minutes, keep the file where the next person can find it, and keep the number of posted copies small enough to count. Cheap paper you replace beats expensive acrylic you never update.
This is not the same as a code someone plants on you
Two problems get filed under one heading. Your own card exposes a credential you chose to share, and the countermeasures are the ones above.
The other problem runs in the opposite direction: someone else's code, placed where you will scan it, designed to send you somewhere you did not intend. A sticker over a parking meter, a fake network card taped in a lobby. That threat is about what happens after you scan, and it is covered in the write-up on fake and tampered codes. Keep them separate in your head, because the defenses share nothing.
Open your router settings tonight and check whether the guest network is on. If it is off, turn it on, give it a password that appears nowhere else, and print the card from that one before you print anything else.