Lock an NFC Tag Permanently: When (and When Not) to Make It Read-Only

Locking an NFC tag makes it permanently read-only — anyone can still tap and read it, but no one, including you, can ever rewrite it. It's a one-way switch, so lock a tag only after you're certain the content is final.

Quick answer

A consumer NFC tag ships rewritable. Locking sets a handful of "lock bits" inside the chip from 0 to 1, and those bits can never go back to 0. Once they're set, the protected memory is frozen. Lock a tag when you want to stop tampering — a price on a retail display, a URL on an event poster, a Wi-Fi credential on a public sticker. Leave it unlocked if there's any chance you'll want to change what it points to, which covers most personal use.

How locking actually works

The mechanism is refreshingly simple, and that's also why it's irreversible.

Static and dynamic lock bytes

On an NTAG213, NTAG215, or NTAG216, the static lock bytes sit at page 2 (bytes 2 and 3). They protect the capability container and the first stretch of user memory. To cover the rest of the chip, NXP adds dynamic lock bytes further up — page 40 on NTAG213, page 130 on NTAG215, page 226 on NTAG216 — covering 96, 456, and 840 data bytes respectively, per the NTAG213/215/216 datasheet. Writing a 1 to any of these bits locks that block of pages. You can set a bit; you can never clear it.

The read-only capability container

There's a second, higher-level switch. The capability container has a read/write-access nibble that an NDEF writer can flip from 0x00 (read/write) to 0x0F (read-only). When a phone "makes a tag read-only," this is usually what it's doing. It, too, is a one-way change.

Locking is not password protection

NTAG chips also support a password (the AUTH0, PWD, and PACK bytes). That's a different tool: a password restricts who can write and can be changed or removed later. A lock is permanent and protects everyone equally. If you might need to update the tag, use a password — not a lock.

Step-by-step

1. Write your final content and tap to read it back. Confirm the URL, text, or vCard is exactly right.
2. Test the tag on the phones that will actually use it — an old locked typo helps no one.
3. Only now, choose lock. On Android the system call is Ndef.makeReadOnly(); on iOS, Core NFC issues a write-lock to the connected tag. Either way the chip burns the lock bits.
4. Tap once more to verify it still reads — and confirm a second write is now refused.

Common problems and fixes

You locked a typo. There's no fix. The tag is now scrap; grab a fresh one and rewrite. This is the whole reason to verify first.

Only part of the tag locked. Some apps set the static lock bytes but not the dynamic ones, leaving later pages writable. Use a tool that locks the full memory range if you need the entire chip frozen.

The tag "won't write" but you didn't mean to lock it. A factory-locked or read-only tag will refuse writes from the start. Check whether it was sold pre-locked before assuming the chip is faulty.

You wanted reversible. You wanted a password, not a lock. Re-read the section above — they solve different problems.

Doing this on NFCore specifically

In NFCore the safe sequence is built in. Use Write Data to put your URL, text, or Wi-Fi record on the tag, tap to read it back and confirm it's correct, then use Tag Lock to set the tag permanently read-only. NFCore shows you the tag type and remaining memory before you commit, and it asks you to confirm — because once those lock bits flip, we can't undo it any more than you can. NFCore is free on the App Store and Google Play.

FAQ

Can I unlock an NFC tag later? No. Locking sets bits that hardware can't reset. A locked tag stays read-only for its life.

Does locking erase the data? No — it preserves whatever you wrote and freezes it. The tag reads normally; it just won't accept new writes.

Will an iPhone still read a locked tag? Yes. Locking only blocks writing. Reading works the same on iPhone and Android.

Should I lock a digital business card? Usually not. If your number, title, or link ever changes, you'll want to rewrite the tag. Lock only tags whose content is genuinely permanent.