Use your guest network, not your main one

Put the code on the guest SSID. Anything encoded in a QR code on a public table is, by definition, public — a photograph of it is a permanent copy of the password. On your main network that is a real problem; on an isolated guest network it is simply how it works.

Most business routers can run a guest network that reaches the internet but not your till, your printer, or your back-office machines. If yours can, use it.

The details that trip people up

Security type must match. WPA2 and WPA3 are not interchangeable in the encoding. If the code is built for the wrong one, phones will try and fail with an unhelpful error.

Hidden networks need to be marked as hidden. Otherwise the phone looks for a broadcasting network, finds nothing, and gives up.

Special characters in the password. Semicolons, colons, backslashes and quotes have meaning inside the WiFi payload. A password containing them needs escaping. If you have a choice, pick a password without them — it removes a whole class of failure.

Case matters, in both the network name and the password.

Rotating the password

The moment you change the password, every printed code becomes a support conversation. Two ways to live with that:

• Change it rarely, on a schedule you control, and reprint deliberately
• Point the code at a short URL that opens a page with the current details, which you can update without reprinting — slower for the guest by one tap, but it never goes stale

Put it where someone sitting down can reach it

Table tents and the back of the menu work. A sign behind the counter does not — people connect after they sit, not while they order.