NFC Tag Password Protection vs. Permanent Locking: What's the Difference?

If you've ever written data to an NFC tag and wanted to stop it from being changed, you have two different tools available: a password that gates writes but can be undone, and a permanent lock that can't be undone by anyone — including you. Mixing the two up is how people end up with a tag they can no longer update, when a password would have done the job.

Quick answer

Password protection — PWD, PACK, and AUTH0 on NTAG-family chips — is reversible. If you know the current password, you can change what's protected, re-scope it, or remove it entirely later. Permanent locking is different: lock bytes and OTP (one-time-programmable) bits make a physical, one-way change. Once a page is locked, no reader, password, or command can ever write to it again.

Rule of thumb: use a password when you (or someone else) might need to edit the tag again. Use a permanent lock only when the content should never change, full stop. Neither one is encryption — both control who can write, not who can read. Anyone tapping a password-protected tag can still read it; it's the write that's gated.

Step-by-step

Setting password protection (PWD/PACK/AUTH0)

On NTAG213/215/216 and similar chips, three configuration values do the work:

• PWD — a 32-bit password you choose.
• PACK — a 16-bit password acknowledge value, checked alongside PWD during authentication.
• AUTH0 — the page address from which password verification kicks in. Any read or write at or above that page requires a successful PWD/PACK exchange first.

Set AUTH0 to a page above your last used page and protection is effectively off — which is exactly what makes this reversible. As long as you still know the password, you can rewrite PWD, PACK, and AUTH0 later to change scope or turn protection off entirely. Worth knowing: PWD and PACK can never be read back over NFC. Pages holding those values always report as blank to a reader, so the password itself is never exposed, even to a device that's already authenticated. One more wrinkle — most configuration changes only take effect after the tag's next power-on, meaning it has to leave and re-enter a reader's field. PWD/PACK writes are the exception; those apply immediately.

Making a lock permanent (OTP / lock bytes)

Static and dynamic lock bytes, plus OTP bits, work at a lower, physical level. Setting a lock bit for a given page removes write access to that page forever — no password or command reverses it. It's the same feature covered in our guide to permanently locking a tag: suited to content that must never change, the same way a tag's UID is fixed at manufacture.

Common problems and fixes

Locking a tag you'll actually need to update. A reusable business-card or Wi-Fi tag doesn't need a permanent lock — it needs a password, so you can still edit it later. Default to password protection unless you're certain the content is final.

Setting a password, then losing it. There's no recovery path. Write the password down somewhere safe before you tap-write it to a tag — NFCore can't retrieve a password it never stored.

Assuming a locked or protected tag hides its data. It doesn't — both guard writes, not reads. For a blank slate, a still-writable tag can be erased and reformatted; a permanently locked one can't be, by definition.

Doing this on NFCore specifically

NFCore's write flow lets you set a password on supported NTAG chips before you tap-write, and a separate permanent-lock option once you're confident the content is final. We'd default to password protection for anything you might want to update — a digital business card, a Wi-Fi tag, a Shortcuts trigger — and save permanent locking for one-and-done cases, like a fixed asset tag or a sealed authenticity sticker. Both options live in the same write screen in NFCore, on iOS and Android alike.

Frequently Asked Questions

Can I remove password protection once it's set?

Yes — if you still know the password, you can rewrite PWD, PACK, and AUTH0 to change what's protected or turn protection off entirely. That's the core difference from a permanent lock: password protection is a setting you can change again, not a one-way trip.

What happens if I forget the password on a protected tag?

You lose write access for good. The tag usually stays readable, but editing or reformatting it without the password isn't possible, and there's no reset or recovery path — NFCore never stores your password, so it has nothing to hand back.

Does locking a tag permanently also hide its data from readers?

No. Neither password protection nor permanent locking is encryption. Both control who can write to the tag, not who can read it — anyone who taps a locked or password-protected tag can still see its stored data unless reads are separately restricted, which most consumer tags don't support.

Conclusion

Password protection is reversible access control; permanent locking is a one-way physical change. Pick based on whether the tag's content is ever supposed to change again — and if you're not sure, start with a password. You can always lock it permanently later. You can't go the other way.