What's Actually Stored on an NFC Tag (and Who Can Read It)

What Actually Fits on a Tag

An NFC tag stores an NDEF message — one or more records, each carrying a type, an ID, and a payload. In practice that payload is almost always one of a handful of things: a short block of text, a URL, a Wi-Fi network name and password, or a contact card. NDEF records can also carry arbitrary MIME-typed data or an app-specific "external type" payload, but the record structure itself stays lightweight by design.

There isn't much room to work with. NTAG213, NTAG215, and NTAG216 — the chips inside most consumer NFC stickers — hold 144, 504, and 888 bytes of usable memory. Enough for a URL or a few sentences of text. Not a photo, not a file. For the full breakdown by chip, see how much data fits on an NFC tag.

Who Can Actually Read It

Here's the part that surprises people: by default, any NFC-capable phone that taps the tag reads its entire NDEF payload. No pairing, no login, no special app permission beyond the phone's NFC being on. On Android this happens through the tag dispatch system — any app registered to handle NDEF data receives the tag's contents the moment it's scanned.

That sounds alarming until you factor in range. Working distance tops out around 10 cm in real-world conditions, and most reads happen well under 4 cm. Standard NFC also isn't encrypted by default, so the realistic exposure is proximity, not remote scanning. Someone has to physically hold a phone against your tag to read it — full stop.

The One Thing You Can Never Hide — the UID

Every NFC tag ships with a UID (unique identifier) burned in at manufacture. Unlike everything else on the tag, the UID is always readable — on every tag, in every state, regardless of lock or password protection — and it can't be changed or hidden. Learn more about the tag's UID and what it's used for.

Think of the UID as a serial number stamped on a product, not a secret. It doesn't expose anything you wrote to the tag, but it's a fixed, permanent identifier — worth knowing about if you're using tags for anything where being trackable by UID matters.

Locking a Tag vs. Protecting Its Read Access

People mix these up constantly, so it's worth being precise. Locking a tag makes it read-only — nobody can overwrite what's on it anymore, but the existing contents stay just as readable as before. Locking protects against tampering, not reading.

Restricting who can read a tag is a separate, optional feature. NTAG213/215/216 chips support password protection: set an access threshold and the tag requires a 4-byte password before any page at or above it can be read or written. It's basic access control, not strong cryptography — enough to stop a casual scan, not a dedicated attacker who can capture a legitimate exchange with a sniffer at close range. For anything sensitive, store a pointer or ID on the tag and keep the real data server-side, rather than trusting the onboard password alone. See password protection vs. permanent locking for the full comparison.

Doing This on NFCore

Before you reuse or repurpose a tag, open it in NFCore's Tag Inspector to see exactly what's written to it — the raw NDEF records, the UID, and whether password protection is active. Writing a new tag that should resist casual reads, like a Wi-Fi tag at a business rather than a coffee-table one at home? NFCore lets you set password protection at write time instead of leaving the tag wide open. For a deeper look at what's exposed either way, NFC security basics covers sniffing and replay risk in more detail.

Frequently Asked Questions

Can someone read my NFC tag just by walking past me?

No. NFC read range is a few centimeters in practice — a phone has to be tapped or held right against the tag. There's no realistic scenario where someone scans your tag from across a room.

Does locking an NFC tag stop people from reading it?

No. Locking a tag makes it read-only — it stops anyone from overwriting the data, but the existing contents stay fully readable to any NFC-capable phone. To restrict reading, you need to enable password protection separately.

Is the unique ID on my NFC tag private?

The UID is set at manufacture and is always readable, even on a locked or password-protected tag — there's no way to hide it. Treat it as a public serial number, not a secret.

Is it safe to store a Wi-Fi password on an NFC tag?

It's convenient, but anyone who taps that tag gets the plain-text password unless you've enabled password protection on the tag itself. For a home network you don't mind sharing casually, that's fine. For anything sensitive, use a password-protected tag or store a link instead of the raw credential.

Conclusion

An NFC tag holds a small NDEF payload — a URL, some text, a contact card, maybe Wi-Fi credentials — and anyone with a phone can read it within a few centimeters unless you've turned on password protection. The UID is always public, no matter what. Know what's on a tag before you tap it, and use NFCore's Tag Inspector to check any tag you're about to reuse.