Match Your Wi-Fi Tag to Your Router: Security Fields That Matter
A Wi-Fi NFC tag stores an authentication type and an encryption type next to the password. Here is how to pick values that fit your router.
Quick answer
A Wi-Fi tag stores two security fields next to the password: an authentication type and an encryption type. Set both to the mode your router actually uses. For most home networks that means WPA2-Personal with AES. If the values on the tag disagree with the router, the phone cannot complete the join, and the tag looks broken even though the password is right.
What a Wi-Fi tag stores
A Wi-Fi tag holds one NDEF record of type application/vnd.wfa.wsc. Inside it sits a credential with the network name (SSID), an authentication type, an encryption type and the network key, according to the ndeflib documentation. All four are required. We walk through the full record in the WSC record explained, so this guide stays on the two security fields.
The two fields that must match
Authentication says how the network checks who may join. Encryption says how traffic is protected afterwards. The ndeflib page lists the allowed values:
| Router mode | Authentication | Encryption |
|---|---|---|
| Open network | Open (0x0001) | None (0x0001) |
| WPA2-Personal | WPA2-Personal (0x0020) | AES (0x0008) |
| WPA and WPA2 mixed | Mixed (0x0022) | TKIP and AES mixed (0x000C) |
Three details will save you trouble:
- WEP and plain WPA-Personal are deprecated in the format, and TKIP is deprecated except in mixed mode.
- The mixed values need WSC version 2.0 or newer.
- A reader must not assume the fields appear in any particular order, so do not hand-edit bytes and expect a fixed layout.
Open your router's wireless settings, read the security mode, and pick the matching row. Not sure? WPA2-Personal with AES is the combination the format describes most clearly.
One quirk to know about: an ST Community thread shows a library that sets the "none" value to 0 instead of the spec's 1, with the comment that this is for Android native support. The values you see in a raw dump can therefore differ from the table above.
Where WPA3 gets complicated
The Wi-Fi Protected Setup specification, v2.0.8, does not define WPA3 authentication types, as the moderator of that ST thread points out. A standard Wi-Fi record has no value that says "WPA3". The same thread names Wi-Fi Easy Connect as the Wi-Fi Alliance's alternative, and it uses an NDEF URI record rather than the WSC record.
So what about a WPA3 router? Cisco notes that with transition mode enabled on an SSID, both WPA2 and WPA3 devices can connect at the same time. If your router offers that mode, a WPA2-Personal tag points at the same network and password. Check the router's settings before you rely on it. We found no source saying every router offers the option.
Transition mode has a cost. Cisco adds that it can expose WPA3 devices to downgrade attacks. If your router is set to WPA3 only, a tag written with the standard record is the wrong tool, and typing the password in by hand is safer than guessing at values.
Password exposure
The tag holds the credentials unencrypted. A Dart ndef package page says the Wi-Fi Configuration Token carries unencrypted credentials, so anyone who can read the tag can recover the Wi-Fi password. Put the tag on a guest network, not your main one. Only write tags for networks you own or manage.
Test the tag
Write the tag, then scan it back and check that the record type and both security fields match your router. NFCore can write and inspect Wi-Fi records on iPhone and Android. Then tap it with a phone that is not on the network.
Platforms differ here. Android acts on the Wi-Fi record, while an iPhone does not auto-join from it; see why an iPhone does not auto-join from a tag. If guests carry both kinds of phone, add a URL fallback after the Wi-Fi record.
Conclusion
Read the security mode on your router, then write the same authentication and encryption pair on the tag. WPA2-Personal with AES covers most home networks, mixed mode covers the older WPA and WPA2 setups, and WPA3-only routers sit outside what the standard record can express. Scan the tag back before you stick it to the wall.
Frequently Asked Questions
Which security mode should I pick for a Wi-Fi NFC tag?
Match your router. WPA2-Personal with AES is the combination the tag format describes most clearly. Use the mixed values only if the router is set to WPA and WPA2 mixed.
Can an NFC tag hold a WPA3 network?
The Wi-Fi Protected Setup specification v2.0.8 does not define WPA3 authentication types, so a standard Wi-Fi record cannot name WPA3. A router in WPA3 transition mode still accepts WPA2 devices on the same network.
Is the password on the tag encrypted?
No. The Wi-Fi Configuration Token carries the network key unencrypted, so anyone who can read the tag can recover it. Use a guest network.
What happens if the security fields do not match the router?
The phone cannot complete the join with those settings, so the tag appears to fail even though the password is correct. Rewrite the tag with values that match the router's mode.