UniFi guest WiFi QR code
UniFi guest access can be a normal password-protected SSID, an isolated guest network, or a Hotspot Portal flow with additional authentication. The sign has to tell visitors what happens after the scan.
For a credential-based guest SSID that matches the generator fields, create the join QR directly. If Hotspot Portal is enabled, the QR can help with WiFi association but the portal remains a separate step.
Change WiFi name or password after printing
No reprint needed.
Guest isolation is a network design decision
Ubiquiti's current guest-WiFi guidance recommends segmentation and network isolation rather than treating guest access as the primary LAN.
Hotspot Portal adds another authentication stage
UniFi can present a captive portal with password, vouchers, payment, RADIUS, or external portal authentication.
The QR and portal should not be confused
A credential QR can assist association; it does not replace the browser-based portal when that portal is part of the design.
Visitors need to know whether the QR is the entire join process or only the first step before a portal.
A tested QR can handle the network-name and shared-credential step.
Tell visitors that a browser sign-in, voucher, or other portal action follows association.
Workflow
Start with guest-network architecture, then make the QR and signage fit that exact journey.
Decide between a conventional credential-based guest SSID and a Hotspot Portal or other managed onboarding model.
Use the intended guest network/VLAN and isolation controls before producing signage.
For a compatible credential-based SSID, generate the QR from the verified guest network details.
Scan from an unmanaged device and verify association, portal behavior if enabled, internet access, and isolation from protected resources.
The output is not just a code; it is a predictable visitor onboarding surface.
Use concise signage for a repeatable guest flow.
Keep the QR tied to the guest SSID and not the employee network.
Explain the portal or voucher step after the QR instead of presenting the scan as the whole authentication process.
01
02
03
04
Comparison
They solve different layers of the visitor journey.
Helps a compatible device associate with a conventional SSID using the encoded network details.
Runs after association and can require additional browser-based authentication or acceptance.
Questions about QR signage, guest isolation, and portal boundaries.
Yes, when the guest WiFi is a conventional credential-based network that maps accurately to the generator and has been tested on receiving devices.
No. The portal is a separate post-association step when it is enabled.
Keep it limited to the join action, the guest network identity when useful, and a concise portal instruction if another step follows.
Normally use the dedicated guest access design and its isolation controls rather than exposing protected-network credentials.
Test association, portal behavior, internet access, and isolation from the perspective of an unmanaged visitor device.
Verify the UniFi guest SSID, create the QR for the credential step it can represent, and test the entire visitor journey before printing the sign.
Create guest WiFi QR