A guest network is a separate network, not a checkbox
On most routers, "Guest Network" does two things: it creates a second SSID, and it lets you keep guests away from your devices. The second part is what matters. Check that client isolation (sometimes called AP isolation) is on, so guests cannot reach each other's phones or laptops either.
If your router has no guest network option, do not hand out the main network. An inexpensive second router or a mesh system with a guest mode is cheaper than a compromised till.
What the QR code actually exposes
This surprises people: a WiFi QR code contains the password in plain form. Scanning apps may display it as text. That is the point — the password is for guests — but it means two rules follow automatically:
- Only ever encode the guest network, never the network with your POS, cameras or smart locks.
- Treat the printed code like the password itself: if it leaks somewhere it should not, rotate the password and reprint.
Settings that actually matter
A practical checklist for the router's guest network:
- WPA2 or WPA3 — never an open network, even for guests
- Client isolation on — guests cannot see each other
- WPS disabled — it bypasses the password entirely
- Router admin password changed from the default, and admin access not reachable from the guest SSID
- Firmware updated — router bugs are the most common entry point in small venues
- Bandwidth limit on the guest network if the router supports it, so one guest cannot starve the till
What does not help
Hiding the SSID. It fails to appear in the list, so a QR code cannot join it reliably, and it adds no real security — scanners find hidden networks quickly.
MAC address filtering. Modern phones randomise MAC addresses per network, so filtering breaks legitimate guests and stops nobody determined.
Changing the password weekly. Rotation only helps if you also reprint the codes. Rotate on a schedule you can actually maintain.
Captive portal or plain QR code?
A captive portal can collect consent or show a landing page, at the cost of an extra tap and a page that sometimes fails to load. For a café or a small hotel, a plain QR code joined directly to an isolated guest network is simpler and has fewer failure modes. Use a portal when you have a legal or marketing reason, not by default.
Rotate on a schedule you can maintain
Quarterly is realistic for most venues: change the password, regenerate every code with the generator, reprint, and note the date on the back of one card. A rotation you never do is worth less than a strong password you never share badly.
Frequently asked
Is a WiFi QR code less secure than a written password?
It is the same secret in a different coat. The code is easier to copy, but it is only visible on your premises — and it removes the bigger risk of guests being handed the wrong network.
Can guests see the password by scanning the code?
Often yes: some scanner apps display the decoded text. That is acceptable for a guest network; it is the reason the code must never point at your main one.
Should we use WPA3 if our router supports it?
Yes, if all guest devices can join. If very old phones fail to connect, run WPA2/WPA3 mixed mode rather than downgrading to an open network.