A WiFi QR code encodes the network name, the security type and the password, so a phone can join without anyone reading a password off a chalkboard. Worth getting the details right, because this is one of the few QR types where a mistake locks people out rather than sending them somewhere wrong.
Use your guest network, not your main one
Put the code on the guest SSID. Anything encoded in a QR code on a public table is, by definition, public — a photograph of it is a permanent copy of the password. On your main network that is a real problem; on an isolated guest network it is simply how it works.
Most business routers can run a guest network that reaches the internet but not your till, your printer, or your back-office machines. If yours can, use it.
The details that trip people up
Security type must match. WPA2 and WPA3 are not interchangeable in the encoding. If the code is built for the wrong one, phones will try and fail with an unhelpful error.
Hidden networks need to be marked as hidden. Otherwise the phone looks for a broadcasting network, finds nothing, and gives up.
Special characters in the password. Semicolons, colons, backslashes and quotes have meaning inside the WiFi payload. A password containing them needs escaping. If you have a choice, pick a password without them — it removes a whole class of failure.
Case matters, in both the network name and the password.
Rotating the password
The moment you change the password, every printed code becomes a support conversation. Two ways to live with that:
Change it rarely, on a schedule you control, and reprint deliberately
Point the code at a short URL that opens a page with the current details, which you can update without reprinting — slower for the guest by one tap, but it never goes stale
Put it where someone sitting down can reach it
Table tents and the back of the menu work. A sign behind the counter does not — people connect after they sit, not while they order.
