What is NTAG 424 DNA?

It is an NFC chip from NXP with cryptography built in. Unlike a plain NFC sticker, which just stores a link anyone can rewrite, a 424 DNA chip holds an AES-128 key and can sign each tap. The signature changes every time, so a reader can tell a genuine tap from a replayed one.

Can someone copy an NTAG 424 DNA tag?

The data on a tag can be read and written onto another chip. What cannot be copied is the AES-128 key, which never leaves the chip. A cloned tag produces signatures that do not verify, so the server rejects it. The honest framing is not that the tag is uncopyable, it is that a copy fails the check.

Secure Unique NFC message, also called Secure Dynamic Messaging. The chip appends a counter and a cryptographic signature to the URL on every tap. NFCFind verifies both server side, so a replayed URL from an earlier tap is refused.

How is this different from a QR code?

A QR code is an image. Anyone who photographs it can reproduce it perfectly, and nothing about the copy is detectable. A 424 DNA tap carries a signature that a copy cannot reproduce, so the two are not comparable on authenticity.

Do I need 424 DNA for ordinary lost and found?

No. For getting a lost bag back to you, a plain NFC tag with a link is enough and costs less. The cryptographic tags matter when someone has a reason to fake the tag: proving an item is genuine, proving who holds it, or proving a check actually happened at the item.

Does a finder need an app?

No. Tapping opens a web page on any modern phone. The verification happens on our servers, not in an app on the finder’s phone.

Tag security

NTAG 424 DNA, and what it actually secures

Most NFC stickers are a link in a text field. Anyone with a phone can overwrite one in about four seconds. NTAG 424 DNA is the chip that fixes that, and it is what NFCFind uses for its secure tags.

The problem with a plain NFC tag

A standard NFC tag such as an NTAG 213 or 215 stores an NDEF record, which is a small block of text holding a URL. There is no key and no signature. If the tag was not locked at manufacture, any phone with a free writer app can replace that URL with another one. If it was locked, the content can still be read and written onto a fresh chip, and nothing about the duplicate gives it away.

That is fine for a luggage tag. It is not fine when the tag is the thing proving an item is genuine, or proving that someone stood in front of it.

What the 424 DNA chip adds

Two things, and they do different jobs.

An AES-128 key that never leaves the chip

When NFCFind registers a tag, it writes the link and locks the chip with an AES-128 key held only by the owner’s account. Nobody can rewrite the tag afterwards, not us and not someone who picks the item up. This is verified on hardware.

A fresh signature on every tap

The chip appends a tap counter and a cryptographic signature to the URL each time it is read, a scheme NXP calls SUN or Secure Dynamic Messaging. NFCFind checks both on the server. A URL captured from an earlier tap and replayed later does not verify, and a cloned chip cannot produce a valid signature because it does not have the key.

Worth being precise here, because the industry is loose about it: this does not make a tag uncopyable. The bytes on a tag can be copied onto another chip. What a copy cannot do is produce a signature that passes the check.

Where this matters, and where it does not

What you need	Tag to use
A finder can reach you about a lost item	A plain NFC tag is enough
Proof an item is the genuine article	NTAG 424 DNA
Proof of who currently holds an item	NTAG 424 DNA
Proof someone was physically at the item	NTAG 424 DNA
A record that survives resale and handover	NTAG 424 DNA

We say this plainly because the upsell is tempting and usually wrong: if all you want is your bag back, buy the cheap tag.

424 DNA compared with secure RFID

NFC is a subset of RFID operating at 13.56 MHz, so a 424 DNA tag is an RFID tag. The practical difference is the reader. Secure RFID in logistics usually means UHF tags and a dedicated handheld reader. A 424 DNA tag is read by any phone made in the last several years, with no reader to buy and no app for the person tapping.

That trade is range. UHF reads across a room; NFC needs a few centimetres. For proving someone was at an object, the short range is the point.

Questions people actually ask

What is NTAG 424 DNA?: It is an NFC chip from NXP with cryptography built in. Unlike a plain NFC sticker, which just stores a link anyone can rewrite, a 424 DNA chip holds an AES-128 key and can sign each tap. The signature changes every time, so a reader can tell a genuine tap from a replayed one.
Can someone copy an NTAG 424 DNA tag?: The data on a tag can be read and written onto another chip. What cannot be copied is the AES-128 key, which never leaves the chip. A cloned tag produces signatures that do not verify, so the server rejects it. The honest framing is not that the tag is uncopyable, it is that a copy fails the check.
What is SUN or SDM?: Secure Unique NFC message, also called Secure Dynamic Messaging. The chip appends a counter and a cryptographic signature to the URL on every tap. NFCFind verifies both server side, so a replayed URL from an earlier tap is refused.
How is this different from a QR code?: A QR code is an image. Anyone who photographs it can reproduce it perfectly, and nothing about the copy is detectable. A 424 DNA tap carries a signature that a copy cannot reproduce, so the two are not comparable on authenticity.
Do I need 424 DNA for ordinary lost and found?: No. For getting a lost bag back to you, a plain NFC tag with a link is enough and costs less. The cryptographic tags matter when someone has a reason to fake the tag: proving an item is genuine, proving who holds it, or proving a check actually happened at the item.
Does a finder need an app?: No. Tapping opens a web page on any modern phone. The verification happens on our servers, not in an app on the finder’s phone.

Where this is heading

A tag that can prove an item is genuine and prove who holds it is the building block the EU’s Digital Product Passport rules are circling. If that is why you are here, the next page is the one you want.

The EU Digital Product Passport, explained