A café counter answers two questions all day. One card can hold both codes.

A café's Wi-Fi password is written on a chalkboard, a Post-it, or the back of the till receipt roll, and every new customer reads it out loud to their friend. Meanwhile the menu is a PDF nobody can read on a phone, or a link in the Instagram bio that opens a delivery app. Both problems are the same problem: information that lives in a person's head instead of on the paper the customer is already holding.

The fix is one printed card with two codes on it — one that joins the Wi-Fi, one that opens the menu — and it is a solved engineering problem with a small number of rules. This page is those rules: the string the phone parses, the millimetres that decide whether it scans, and the four failure modes that show up in real shops.

First, the string: what a Wi-Fi QR code actually contains

A QR code is just text. For Wi-Fi it is text in a format called the WIFI: URI, which started as a convention in the ZXing barcode library and is now written into the Wi-Fi Alliance's WPA3 specification, section 7.1 (the scheme is registered with IANA as wifi, registered 26 August 2020). A minimal one looks like this:

Four fields, each ending in a semicolon, and a second semicolon at the very end to close the string:

Two practical details that catch people out. First, the double semicolon at the end: some readers accept a single one, others stop parsing and refuse the code. Second, an open network: the password field goes away entirely and the type becomes T:nopass — not an empty password, which some readers treat as a failed parse. The WPA3 specification does not define WEP at all; if a router still offers it, a QR code is the wrong thing to spend time on.

The semicolon trap, and why it breaks phones selectively

This is the failure that produces the “it works on my phone” support call. The same password string is encoded two ways in the wild:

• The specification says characters outside a printable set — including the semicolon — are percent-encoded (; becomes %3B).
• Android instead escapes with a backslash (\;), which is the older ZXing convention, and it does not decode percent-encoding when scanning.

So a guest password like cafe;2026 produces a code that one platform joins and another reads as a truncated password. The same applies to a comma, a colon and a quote. You cannot fix this in the print: the fix is at the router. A guest password built from letters and digits — no punctuation at all — is read identically by every phone, and a 12-character random string is both easier to print and stronger than FlatWhite2019!.

What the format cannot do

Being honest about this up front saves a bad afternoon. The WIFI: URI carries credentials for a password-protected network, an open network, an SAE (WPA3) network and optionally a hidden SSID. It does not carry:

• A captive portal. If the router puts up a “log in” or “accept the terms” page, the code joins the network and the portal appears exactly as before. The customer still types whatever the portal asks.
• Enterprise authentication. 802.1X networks — the username-and-certificate kind used by universities and offices — are outside this format. A café's WPA2/WPA3 pre-shared key is the case it solves.
• Per-person vouchers, time limits, bandwidth limits or MAC allow-lists. Those live in the router; the code is a printed password, nothing more.
• Both Wi-Fi and a URL. One symbol, one payload. A phone cannot be told to join a network and open a page by the same code, which is why the card carries two.

In practice a café with a normal guest SSID is the easy case, and it is the majority. If the shop has a time-limited guest network, print the code anyway — it still removes the password typing — and add one line: “Then enter the code on the screen.”

The sheet, measured

Our Wi-Fi card is not a design mock-up; it is a generated A4 PDF (four cards, cut lines, vector everything), and the numbers below were measured in the file rather than estimated for a screenshot:

Read the module sizes against the printer floor. Denso Wave's own FAQ puts a common laser printer's minimum module at 0.17 mm, and recommends each module be made of at least four printer dots — 0.33 mm on a 300 dpi thermal printer. At 1.17 mm, the menu code is three and a half times above that floor: it is not a marginal print, and that margin is the headroom that survives a cheap printer and a slightly dusty lens.

The symbol sizes differ because the payloads differ: the WIFI: string is shorter than a URL, so it lands one version lower (29 modules rather than 33). That is worth knowing when someone asks why the same 48 mm box holds “more” of one code than the other — it does not; the Wi-Fi code simply has fewer modules to fit.

Print rules that decide whether it scans

Four rules, each one a print run saved:

1. Print at 100%, never “fit to page”. A4 artwork on US Letter is scaled to 94% because Letter is 20 mm shorter. The 48 mm code becomes 45 mm and every module shrinks with it. Set scaling to “none” or “actual size”, and put a 100 mm rule on the sheet so a proof can be checked with a ruler.
2. Matte paper, matte laminate. Glossy stock under a ceiling spotlight throws a highlight across the code exactly when a customer tilts their phone. A matte laminate also survives a counter being wiped twenty times a day.
3. Black on white, and keep the quiet zone empty. A dark card with a white code looks handsome and fails on a fair number of cameras. Nothing prints inside the four-module border — no border line, no logo, no “scan me” arrow crossing it.
4. Two phones, on the counter, before the print run. Scan it with an iPhone and an Android, standing where the customer stands, with the shop's lights on and the phone's screen brightness at normal. One test sheet costs cents; a reprint of 200 costs an afternoon.

Also print the fallback in plain text: the SSID and the password under the Wi-Fi code, and the page address under the menu code. Every unsupported reader shows the raw string, and a customer who can read “Kestrel Coffee / oatlatte2026” can join manually in ten seconds.

The password-on-the-wall question

A code that joins the network is a password printed in public, so treat it like one:

• Guest SSID only. Most routers have a guest network switch that isolates guests from the rest of the LAN. Put the till, the office laptop, the printer and the card terminal on the main network and hand out the guest one.
• Rotate on a schedule you will keep. Quarterly is realistic for a café. Rotation costs one reprint of this sheet — one command in our kit, because the file is generated from the same record as the page — so the schedule can be short without becoming a chore.
• Never print the router's admin password, the main network's password, or a password that is reused anywhere else. The sign exists to give one credential away; make sure it is only that one.

The second code: what the menu code should open

The menu code is the easier half, and the one most cafés get wrong by pointing it at a PDF. A PDF is a picture of a menu: a customer cannot copy a price out of it, a phone cannot reflow it, a screen reader cannot read it, and every price change means a reprint and a new upload. A one-page menu on a real URL does what the PDF cannot:

• Prices typed once — the flat white, the oat milk surcharge, the seasonal bake, each with the line the staff already say out loud.
• Hours with an open-now state — “open until 18:00” answers the question the customer has at 17:40.
• Address with Directions, and a phone number that dials — the two things a visitor needs after deciding.
• Photos after the prices, never before — a customer who has to scroll past six latte-art shots to find a price has been given decoration where they asked for information.

And it can be edited at 7am without reprinting anything, which matters for a bakery counter where the sold-out line changes by the hour (that case is its own note: a bakery's daily menu page).

What this costs, against what the sign replaces

A Wi-Fi card is one of the pieces in the printed kit this site builds with the page: fifteen printed files for a shop with tables from $49 once, eight for a shop without tables. In the kit the Wi-Fi sheet is 10-wifi-pop-A4.pdf — four cards, the SSID and password filled in, the same menu URL as the page, generated from the same record so the two cannot drift apart.

The alternatives are not expensive either, which is the honest part. A copy shop prints an A4 in colour for cents; Canva has free Wi-Fi code templates; the router's own app can draw a code for you. What those routes do not do is keep the card and the page in one place: the moment the password changes or a price moves, someone has to remember which file was the good one. That is the actual product — one record, a page and a print run from it — and the sign is the visible part of it.

If the question behind the question is “should I be paying a builder every month for this”, the three-year cost calculator takes your own monthly figure and puts it beside a page and a print kit that are paid for once. Squarespace Basic at $19 a month billed annually ($25 monthly) is $684 over three years; Linktree Pro at $14 a month annually ($17 monthly) is $504; Wix Light at $17 a year-plan is $612 — list prices read on the vendors' own pricing pages, 13–14 November 2026, before tax. None of them includes a printed Wi-Fi card.

Doing it in one afternoon

1. Check the guest network's name and password against what the router actually broadcasts, and change the password to letters-and-digits if it has punctuation in it.
2. Decide the two destinations: the Wi-Fi credentials, and the menu page URL.
3. Set the card text: shop name, SSID, password in plain letters, “point your camera, tap Join”, then “menu, prices, hours” with the URL underneath.
4. Print one sheet at 100%, cut one card, and test it with both phones at the counter distance.
5. Print the batch, tape one card at eye level where the queue forms, and put the second by the till — not under the till drawer, where nobody looks.

That is the whole job. The card is not clever; it is just the two answers, printed at a size that scans, from a file that will still be right after the next password change.

Questions that come up

Related reading: the millimetres that decide whether any printed code scans, what a café's menu page should cost in 2026, table tents with a QR menu and no monthly fee, and the website and menu links on a Google Business Profile.

Or make the page first — thirty seconds, free, no account, and it stays free:

Create a page — free   See three live samples

Sources, read on 14 November 2026: the Wi-Fi Alliance WPA3 specification v4.0, section 7.1 (WIFI-URI grammar: T: is “WPA” for password-based authentication, absent for open networks; H:true for hidden SSIDs; R: for transition-disable; semicolons percent-encoded) and the IANA provisional registration of the wifi URI scheme (26 August 2020). ZXing's “Barcode Contents” page for the original backslash-escaping convention that Android still emits. qrcode.com/en/faq (Denso Wave) — a common laser printer's floor of about 0.17 mm per module, the recommendation of at least four printer dots per module (0.33 mm at 300 dpi), and the four-module margin. ref-pd.gs1.org/guidelines/2d-in-retail, “2D Barcodes at Retail Point-of-Sale Implementation Guideline”, release 1.1.0 ratified December 2025 — the QR quiet zone as four times the X-dimension. Phone support (iPhone Camera since iOS 11 in 2017; Android's native Wi-Fi QR reading since Android 10) is widely reported platform behaviour rather than a published specification, and unsupported readers fall back to showing the raw text. Card geometry and code sizes (93 × 127.5 mm cards, 8 mm gutters, 48 mm codes, module sizes 1.30 mm and 1.17 mm, quiet zone 4.7–5.2 mm) were measured in the 10-wifi-pop-A4.pdf this site generates, not estimated; the 94 × 134 mm card is the Korean build of the same four-up. The 1:10 scan-distance figure is an industry rule of thumb, not part of ISO/IEC 18004. Vendor prices are list prices from each vendor's own pricing page read 13–14 November 2026, before tax.