Make a Wi-Fi NFC Tag So Guests Connect Without Typing the Password

To make a Wi-Fi NFC tag, you write a single NDEF record — MIME type application/vnd.wfa.wsc — that holds your SSID, security type, and password. Stick the tag somewhere guests can reach, and one tap joins their phone to your network. Android picks it up cleanly. iPhone takes one extra confirmation.

Quick answer

The record format is called Wi-Fi Simple Configuration, or WSC. It carries the SSID, the auth type (WPA2-Personal, WPA3-Personal, WEP, or Open), the encryption type, and the network key, all as Type-Length-Value attributes packed into one NDEF payload. The whole thing usually fits in 70 to 110 bytes — comfortably under the 144-byte ceiling on a basic NTAG213. Any NDEF-capable tag will do, and any NFC writer app with a Wi-Fi template — NFCore included — assembles the record for you. You don't need to think about the bytes. You pick a tag, enter the network details, and write.

What's actually on the tag

The WSC payload is a small TLV blob inside one MIME-type NDEF record. The attributes that matter are SSID (type 0x1045), Authentication Type (0x1003), Encryption Type (0x100F), and Network Key (0x1027). Some apps also add the router's MAC address (0x1020) so the phone can match a specific AP, but it isn't required. WSC supports pre-shared-key networks — WPA2-Personal and WPA3-Personal — but not Enterprise (802.1X) with RADIUS or certificate auth. If your network is corporate or eduroam-style, an NFC tag won't help.

There's a newer option for WPA3-only setups: Wi-Fi Easy Connect, sometimes called DPP. It writes a bootstrapping URI to the tag instead of the password itself, and the network handles the handshake. Most home routers still ship with classic WSC, which is what this guide assumes.

Step-by-step

1. Grab a writable NTAG. NTAG213 (144 bytes) is enough for almost any home network. If you have a long passphrase or just want headroom, step up to NTAG215. Our NTAG comparison has the full breakdown.
2. Open NFCore — or another writer app — and pick the Wi-Fi template.
3. Enter your SSID, choose WPA2/WPA3, paste the password. The app builds the WSC record for you.
4. Tap Write and hold the phone steady against the tag. Top edge on iPhone, back center on most Android phones. Keep it still — NFC only reaches about 4 cm.
5. Verify with a second device. Android should prompt to join the network within a second of the tap.
6. Stick the tag where guests can reach it: by the front door, on the side of a router, or tucked into a guest-book card.

Doing this on NFCore specifically

NFCore's Wi-Fi creator template is one screen — network, security, password, write. The same flow works for writing NFC tags of any other type, so once you've done it once the rest of the app feels familiar. We recommend writing two copies of the tag so you have a backup; nothing breaks more often than a single sticker that fell off a wall. If you want the tag to be tamper-resistant once it's deployed, NFCore can flip the lock bytes from the same screen. That step is permanent, so double-check the password before you commit.

The iPhone caveat

iPhones don't auto-join from a vnd.wfa.wsc record. Core NFC has read NDEF since iOS 11 and written it since iOS 13, but Apple never wired the Wi-Fi join behavior into the background tag handler. Your guest sees a notification, taps it, and confirms the join in Settings — two extra steps, but still faster than typing a 16-character password. If your guest list skews iPhone-heavy, you can also write a plain URL record pointing to a hosted "tap here for Wi-Fi" page; the link opens in Safari and the user copies the password from there.

FAQ

Will this work on iPhone? Reads, yes. Auto-join, no — iOS shows a notification and the user confirms in Settings.

Does it support WPA3? WSC handles WPA3-Personal. For WPA3 with Wi-Fi Easy Connect (DPP), the tag carries a bootstrapping URI instead.

Can the password leak from the tag? Anyone within about 4 cm can read it. Treat it like a sticky note on the fridge — fine for a guest network, not for one with sensitive devices on it.

Why doesn't it work on Enterprise Wi-Fi? WSC only carries pre-shared keys. 802.1X / RADIUS networks are out of scope.

Can I change the password later? Yes — overwrite the tag, or write a new one. A locked tag can't be rewritten.

If you'd rather not poke at hex by hand, NFCore's Wi-Fi template handles the record for you on iOS and Android — and the NFC Forum's WSC spec covers the rest if you want the gory detail.