Verify Wi-Fi and contact fields stay on this device

WifiSignQR builds a Wi‑Fi QR and an optional vCard contact QR in the browser. This page is the check you can run yourself: which network calls are normal, and which calls would mean the password or contact fields left the tab. The generator is on the home page. The short policy is the privacy policy. The usage rules are the terms. Publisher context is on about.

What you are proving

You are proving that generating a QR does not upload SSID, password, or vCard fields. You are not proving that nothing on your computer can see the bytes. A browser extension, malware, or a recorder you installed can still read a tab. This site does not receive those values, and it does not claim to block other software on the device. Credentials never leave this device through this page.

If Network shows a POST or PUT of your password or vCard fields, stop using that session and write to contact@wifisignqr.pages.dev with the page URL and what you saw — without attaching the real password. That would not match how this tool is built.

Steps in DevTools

1. Open the generator. Use a throwaway test SSID the first time you learn the panel — not your production guest password — until you trust the flow.
2. Open DevTools → Network. In Chrome that panel is documented as the Network panel. In Firefox it is the Network Monitor. Enable “Preserve log” so a reload does not wipe the list.
3. Reload the page once and let the first requests finish. You should see same-origin GETs for the document, /assets/styles.css, /assets/qrcode.js, /assets/tool.js, and the favicon.
4. Type an SSID and password. Change security. Toggle hidden. Watch for new rows. There should be no POST, PUT, or beacon whose body is the password or SSID.
5. Press Print / PDF or Download PNG. Print opens the browser print dialog. PNG uses a data: URL from canvas.toDataURL in the tab — it is not a multipart upload to our server.
6. Fill the vCard fields the same way. Again, no request should carry name, phone, or email to our origin or a third party.

Expected requests

• Page assets. HTML, CSS, qrcode.js, tool.js, and the icon — all GET, all from this site — when the page loads. qrcode.js is the vendored encoder (qrcode-generator 1.4.4, MIT). It is script code, not your password.
• Analytics beacon, maybe. The privacy policy describes Cloudflare Web Analytics. If that product is enabled for the zone, a request to cloudflareinsights.com can show up. It is a page-view beacon. It is not an upload of SSID, password, or vCard fields. The HTML we ship does not include an advertising script.

Requests that should not appear

• A POST, PUT, or PATCH that carries SSID, password, or vCard field values.
• A call to a third-party “QR API”, Wi‑Fi cloud, or contact sync endpoint after you type.
• A script load from an ad host. Response headers for this site set a strict script-src to 'self'. That policy does not list an ad network.

Why the fields can stay in the tab

The forms are ordinary inputs. The page builds a WIFI:… or BEGIN:VCARD string in JavaScript, then draws modules on a canvas. PNG download reads the canvas with toDataURL. Print uses CSS to isolate one card and hide the form, so the password is not printed as readable text. When you close the tab, those values go with the page’s memory. We have no account database to reopen.

This tool draws QR codes for Wi‑Fi and contacts. It does not draw Code128 or EAN linear barcodes. SSID caps at 32 characters and password at 63 in the form; security choices are WPA/WPA2/WPA3, WEP, or open. Those limits are product honesty, not a scan of your router.

Publisher, contact, and policy pages

These pages stay on the existing URLs. They are how you learn who publishes the tool and how to reach us:

• About — who publishes the pages.dev experiment and what the generator is for.
• Contact — a working mailbox for wording and bugs, with clear “do not send Wi‑Fi passwords.”
• Privacy — no credential upload, hosting logs, optional Web Analytics, children note.
• Terms — your networks and contacts, acceptable use, honest limits.
• This trust page — a verifiable Network check for browser-local QR generation.

This experiment does not run advertising scripts today. Response headers set script-src 'self'. If that ever changes, privacy and about would need an honest update first.

Where to go next

• Make a Wi‑Fi or vCard QR
• Getting started
• Print a guest wifi sign
• iPhone and Android scan behavior
• Make a vCard contact QR
• About · Privacy · Terms · Contact

Questions about this wording, email contact@wifisignqr.pages.dev. Do not send your real Wi‑Fi password in that email. We do not need it, and we do not want it in a mailbox.