Back to guides

Copy the Message, Not the Dump: Safer NFC Tag Copies

Copying the NDEF message gives you the same content on a fresh tag without carrying over lock bytes or passwords. Here is how to do it on tags you own.

Published

When you copy an NFC tag you own, copy its NDEF message, not a raw memory dump. The message is the content you actually care about: the link, text, contact card or Wi-Fi record. A dump also drags along the parts of the chip that were never meant to move.

Quick answer

An NDEF message sits in the tag's user memory. A raw dump is every page on the chip, and that includes the UID, lock bytes, the capability container and the password settings.

Take an NTAG213. It has 180 bytes in 45 pages of 4 bytes, but only 144 bytes are user memory. The 7-byte UID is factory programmed and read-only. The lock bytes and the capability container are one-time programmable. So a dump is mostly not your content, and some of it can't be undone once written.

This guide covers tags you own or control: your own business-card stickers, Wi-Fi tags, smart-home triggers. It does not cover access credentials, transit cards, payment cards or hotel keys. That's a hard line. If you only want to edit a tag you already wrote, read changing a tag after writing it instead.

Step-by-step

1. Scan your own tag and read the message

Tap the tag and read it as NDEF. You want the records, not the pages. As Android's documentation puts it, an NDEF message holds one or more records, and each record has a type name format, a type, an optional ID and a payload.

2. Check the size against the target tag

Count the bytes in the message and compare them with the blank tag's capacity. An NTAG213 has 144 bytes of user memory. An NTAG215 has 504 bytes, in pages 4 to 129. A message that came from an NTAG215 may simply not fit on an NTAG213. Going the other way is fine.

3. Write every record, not only the first

A message can hold several records, and Android's docs warn you not to assume the full payload is in the first one. Some tags also carry an Android Application Record, which can sit in any record of the message. Copy the whole message in order.

4. Read the copy back and compare

Scan the new tag and check that the records match the original: same types, same payloads, same order. Do this before you stick it anywhere. Only lock the tag once you're happy with it, because locking is permanent.

Common problems and fixes

The copy is read-only. Lock bytes on NTAG213 and NTAG215 are one-time programmable, and they can make memory permanently read-only, which can't be reversed. If a page-level copy carried locked bits onto your blank tag, you've lost a rewritable tag for good. This is the main reason to avoid dumps. To see what state a tag is in, check whether a tag is locked before you write to it.

A password came along. The NTAG215 configuration pages (131 to 134) hold AUTH0, ACCESS, a 32-bit password and a 16-bit PACK. A password can restrict writing from the page that AUTH0 names. Copy those pages onto a new tag and you could end up with something you can't edit. A message-only copy leaves the configuration at its defaults.

The write fails. The message may be too large, or the tag may already be locked. Our notes on read-only and tag-lost write errors explain how to tell the two apart.

The UID is different. It will be. The UID is read-only on both chips, so a copy of the message is a new tag with its own identity. If something you built depends on one specific UID, a message copy won't satisfy it.

Doing this on NFCore specifically

In NFCore, scan the tag you own, save its message, then hold a blank tag to the phone and write it. Check the size first if you're moving from a larger chip to a smaller one. NFCore has no account, and nothing is uploaded to a cloud.

You can get NFCore on the App Store or Google Play. iOS and Android differ in what they can read and write on a tag, so test on the phone you'll use.

Frequently Asked Questions

Can I copy an NFC tag's UID onto another tag?

No, not with ordinary tags. The 7-byte UID on an NTAG213 or NTAG215 is factory programmed and read-only. Copying the message gives you the same content on a tag with its own UID.

Can I copy an NTAG215 message onto an NTAG213?

Only if the message fits in 144 bytes. An NTAG215 has 504 bytes of user memory, so check the message size before you write.

Why did my copy come out read-only?

Lock bytes are one-time programmable. A page-level copy that carried them over can make the new tag permanently read-only, which is why we suggest copying the message instead.