WiFi QR Code Generator: Business Guest Network Setup Guide

A WiFi QR code on the counter ends the "what's the password?" question, but in a business it also puts that password in plain text on a wall where anyone can photograph it. This guide covers the part that matters before you print: setting up a guest network that is safe to share this way, deciding what the sign says, rotating the password without breaking every sign, and generating codes for several locations at once. For the mechanics of the code itself, the fields it contains and which phones scan it, read the WiFi QR code tutorial first.

Why a separate guest network

A WiFi QR code is not a login. It contains the network name and password as text, and any scanner app can display them. Whatever network you put on a public sign, assume the password is public. That rules out the network your card terminal, back-office PC, printers and cameras sit on. A guest network fixes this in three ways:

• Staff password stays private. The staff or operations network keeps its own password, which is never printed anywhere. Rotating the guest password does not disturb the till.
• Client isolation. Most business access points offer a setting called client isolation, guest isolation or AP isolation. It stops one guest device from seeing another, and stops all guest devices from reaching the wired side of the network. Turn it on. Without it, a laptop on the guest network can browse to your printer's admin page.
• Bandwidth limits. A per-client cap of 5 to 10 Mbps down and 2 to 5 Mbps up keeps one person's video upload from slowing the card terminal. Most access point controllers let you set this on the guest SSID alone.

If your router has no guest option at all, it is a consumer model. A single business-grade access point costs less than a month of the interruptions it prevents.

Set up the guest network

The menus differ by brand, but every business router or controller has the same six settings. Fill them in this order.

1. Create a new SSID. Name it so guests recognize it and staff cannot confuse it with the operations network: Corner Cafe Guest, not NETGEAR-5G-2. Avoid characters the code has to escape (semicolons, commas, colons, backslashes); they work, but they make typing the name by hand harder for laptop users.
2. Set security to WPA2 Personal (or WPA2/WPA3 mixed). Do not use WPA3-only; phones from before 2019 cannot join it. Do not use an open network unless you also run a captive portal, since an open network exposes every guest's traffic to every other guest.
3. Choose a passphrase people can type. Three or four plain words, 12 to 20 characters, lower case, no punctuation: maple bench coffee. The code carries it for phones; the words are for laptops and anyone whose camera fails. Never reuse the staff password.
4. Enable client isolation and any "block LAN access" option on the guest SSID.
5. Set the bandwidth limit per client and, if offered, a total cap for the SSID.
6. Broadcast on both bands. Guest devices, older phones and e-readers need 2.4 GHz. If the controller lets you set a schedule, match it to opening hours so the network is off overnight.

Where to find these settings on common gear:

Decide what the sign says

Guests read the sign for about two seconds. Give them four things, in this order from top to bottom:

1. A one-line instruction: "Scan to join free WiFi".
2. The QR code, at least 3 cm wide on a counter sign and 8 to 10 cm on a wall.
3. The network name, so they can confirm they joined the right one.
4. The password in smaller type, for laptops and older phones.

Leave off anything that is not true. Do not write "secure WiFi": a shared passphrase is not private. Do not write "unlimited" if you set a bandwidth cap. Do not print the staff network name on the same sign, even crossed out. If a captive portal or a house rule applies (an hour limit, no streaming), add one short line under the password.

Rotate the password and reprint

A static WiFi code is fixed text. When the password changes, every printed sign with the old code stops working the same minute. There is no way to update a printed static code remotely, so rotation is a printing job as much as a network job. Plan for it:

1. Decide how often. Quarterly suits most shops and offices. Monthly makes sense for a coworking space that turns over members. A hotel that prints the code on an in-room card can change it per season.
2. Keep a list of every place the code appears: table tents, the window, the receipt footer, the welcome email, the menu. Missing one is the usual cause of "the WiFi is broken" complaints.
3. Generate the new code and print the full set before touching the router.
4. Change the router at a quiet time, usually before opening.
5. Swap every sign the same morning. Old signs go in the bin, not a drawer.
6. Scan one new sign with a phone that was never on the network before.

Because the code is generated in your browser and stored nowhere, there is no account to log in to and no expiry date; the same file prints again until you choose to rotate. If you would rather never reprint, the only alternative is a dynamic code from a paid service, which points at a redirect rather than the WiFi payload and cannot join a network directly. For WiFi, static is the right choice; see do QR codes expire? for the general trade-off.

Placement by business type

In every case, mount the code at 100 to 150 cm from the floor, in even light, and not behind glass that reflects a window.

Legal and acceptable-use notes

None of this is legal advice; check your local rules. But three points come up with every business guest network:

• Terms cannot be attached to a static WiFi code. A captive portal is a web page the guest must accept before traffic flows. The code gets the phone onto the network; the portal still appears afterwards, and phones handle that step inconsistently. If your insurer or lawyer requires accepted terms, keep the portal and tell guests on the sign to expect a login page. If not, print a one-line acceptable-use note on the sign and skip the portal; more guests will get online.
• Your ISP contract may prohibit sharing. Residential plans often do. Business plans generally allow guest access. Read the contract before you put the code up.
• Content filtering. A family venue or a clinic should set DNS-based filtering on the guest SSID (most controllers offer a family-safe DNS option). It costs nothing and it is the first question a parent asks.
• Logs. Some countries require operators to retain connection logs for public networks. If yours does, the controller's log export is where you get them; the QR code itself records nothing.

Laminated sign spec

Hand this list to whoever prints the signs:

• Paper size. A6 (105 by 148 mm) for tents and stations; A5 for wall signs.
• Code size. No smaller than one tenth of the scanning distance, and never below 3 cm on a business sign.
• Quiet zone. At least four modules of blank margin on every side of the code. The generator adds it; do not let the layout crop it.
• Colors. Black modules on white. If you set a brand color, keep contrast at 4.5:1 or better and never invert to light-on-dark.
• Error correction. Level M for a plain code; Q or H if you add a logo, which should cover no more than 20% of the code.
• File. SVG or PDF for the print shop; PNG at 300 DPI for the printed size if you print in-house.
• Lamination. Matte 125 micron pouches. Gloss reflects downlights and fails at an angle.
• Test. Scan the laminated sign with an iPhone and an Android phone from the intended distance before the batch is printed.

Many locations at once

For a chain, a franchise or a property company, each site has its own SSID and password, and the sign for each site needs its own code. Making them one at a time works up to about five; after that use the bulk generator.

1. Build a spreadsheet with three columns: name, wifi, type. The wifi column holds the network name, password and security type (WPA or WEP) separated by pipes, in that order. Add a fourth pipe field of true only for a hidden network.
2. Save it as CSV. A three-site file looks like this:

name,wifi,type
"Downtown","Corner Cafe Guest|maple bench coffee|WPA","wifi"
"Airport","Corner Cafe Guest|runway cinnamon|WPA","wifi"
"Station kiosk","Corner Kiosk Guest|platform teapot|WPA","wifi"

3. Upload the file. The generator maps the columns, generates one code per row and lists any row it could not read.
4. Download the batch as a zip. Each file is named after the name column, so the print shop can match files to sites.
5. Keep the CSV. At the next rotation, change the passwords in the file, upload it again and reprint the whole set.

Keep the spreadsheet somewhere only managers can read, since it contains every guest password in plain text.

FAQ

Should each site use the same guest password? No. One leaked password should not open every location, and separate passwords let you rotate one site without reprinting the others.

Can I count how many people scan the sign? Not from the code; it contains no link and reports nothing. Your controller's client list is the only count.

Do I need a different code for iPhone and Android? No. Both read the same WIFI: format, on iOS 11 and later and Android 10 and later.

Set up the guest SSID first, then make the code in the WiFi QR generator and scan the printed sign before you hang it.