QR code formats: encoding Wi-Fi, contacts, calendars, and payments
A QR code is just text - but the right prefix turns it into a Wi-Fi login, a saved contact, or a calendar invite. Here are the standard formats worth knowing.
A QR code is a text container
Everything a QR code can do is really about the text inside it. Scanners look at the first few characters and decide how to interpret the payload:
http://orhttps://โ open a URLWIFI:โ connect to Wi-FiBEGIN:VCARDโ save as contactBEGIN:VEVENTโ add to calendarmailto:โ compose emailtel:โ dial a phone numbersms:โ open SMSgeo:โ open in a map
Anything else is treated as plain text. Nothing here requires proprietary APIs; every format below is a public standard.
Wi-Fi
The de-facto format, supported by iOS, Android, and every modern camera:
WIFI:T:WPA;S:MyNetwork;P:MyPassword;;
The fields:
T- auth type:WPA,WEP, ornopass(open network).S- SSID (network name).P- password (omit for open networks).H:true- optional, marks the network as hidden.
Special characters (\, ;, ,, :, ") in the SSID or password must be escaped with a backslash. Trailing ;; is required.
vCard (contacts)
vCard 3.0 is the safest version - every scanner understands it:
BEGIN:VCARD
VERSION:3.0
FN:Ada Lovelace
ORG:Analytical Engines
TEL:+441234567890
EMAIL:ada@example.com
URL:https://example.com
END:VCARD
Keep it short - QR codes have a hard capacity limit (about 2,900 bytes at maximum size with lowest error correction). Long vCards produce dense, unscannable codes.
Calendar events (iCalendar)
BEGIN:VEVENT
SUMMARY:Product Launch
DTSTART:20260901T140000Z
DTEND:20260901T150000Z
LOCATION:HQ Boardroom
DESCRIPTION:Kickoff meeting
END:VEVENT
Dates use the compact ICS format - no dashes, no colons, Z for UTC. Some scanners want the full VCALENDAR wrapper; most accept a bare VEVENT.
URL - the boring but most-scanned format
Just paste the URL. Two tips:
- Uppercase HTTPS URLs compress better. QR codes have a special "alphanumeric" mode that packs A-Z, 0-9, and a few symbols more densely than the "byte" mode used for mixed-case text.
HTTPS://EXAMPLE.COM/PATHproduces a smaller, denser code thanhttps://example.com/path. In practice most people don't bother - but for print, where scanning distance matters, it helps. - Add UTM parameters if you need to measure QR-driven traffic. The QR itself is untrackable; the URL it encodes isn't.
Payments
Region-specific and evolving:
- UPI (India):
upi://pay?pa=merchant@bank&pn=MerchantName&am=100.00&cu=INR - EMVCo QR (global standard, used by PayNow, PromptPay, etc.): a structured format with tag-length-value fields - usually generated by payment SDKs, not by hand.
- PayPal.me link: just a URL -
https://paypal.me/username/25.
Error correction: pick the right level
QR codes reserve some bits for error correction. Four levels:
- L (7%) - smallest code, minimal damage tolerance. Fine for screens.
- M (15%) - default. Handles small print imperfections.
- Q (25%) - for outdoor use, faded labels.
- H (30%) - required if you want to overlay a logo in the center.
Higher levels mean a denser code that stores less data. If your data barely fits at level M, dropping to L helps; if the code needs to survive rain, go H.
Making a QR safely
QR Code Generator runs entirely in your browser - the content you're encoding (Wi-Fi passwords, private URLs, contact details) never touches a server. It downloads as PNG (screens, social) or SVG (print, unlimited scaling).
Related tools:
- URL Encoder - for parameters that need to survive being embedded in the QR's URL.
- Base64 Encoder - for embedding small images in QR-directed vCards.
Tools mentioned in this post
Related reading
Every social media image size you actually need in 2026
TikTok, Reels, Shorts, Instagram, X, YouTube, LinkedIn, Facebook, Pinterest - the current image and video dimensions, updated for 2026, in one bookmarkable list.
How to generate a strong password (and why length beats symbols)
The math behind password strength, the myth of the special-character requirement, and how modern password managers changed the whole equation.
JWT explained: what actually goes inside that token
Every login flow you touch these days involves JWTs, but 'JSON Web Token' hides a lot. Here's the three-part structure, the security pitfalls, and when not to use them.
The regex cheat sheet every JavaScript developer actually needs
Forget lookbehind edge cases. Here are the 15 patterns you'll use in real code - validation, extraction, replacement - with the JavaScript-specific gotchas.
Shan builds 712 Tools. He holds a Master's degree in Mechanical Engineering and now works as a Software Engineer, shipping browser-based developer utilities out of Ontario, Canada. Learn more ยท 712studiogames@gmail.com