The Ultimate NFC Tag Guide: Every Chip, What It Is For, and What Reads It

You open a listing for a pack of NFC tags. It says “NFC 213”, or “NTAG215 compatible”, or just “1K NFC card, works with all phones”. You want to know one thing: will this do the job I have in mind? And the listing cannot tell you, because the person who wrote it does not know either.

I have spent years building NFC.cool Tools, an app whose first job on every tap is to answer exactly that question: what chip is this, and what can it do? The identification code alone recognises around sixty products from seven manufacturers, and every one of them got into that list because somebody held it up to a phone and something did not behave the way the listing promised. This guide is the reference I wished existed while I was writing that code. It is long on purpose. If you want the short version, the beginner’s guide to NFC tags is the place to start, and it links back here for depth.

The one sentence take, so you have it before the tables: there is no best NFC tag, there is only the right chip for the job, and the job is decided by three things: how much you need to store, who you need to keep out, and what has to be able to read it.

How to use this guide

Every number in this guide comes from a manufacturer datasheet, a platform document from Apple or Google, or from the code of my own app, and the sources are listed at the end. Where I have had a chip on my desk, I say so in a hands-on note. Where I have not, I say that too: the exotic parts come from datasheets, and a datasheet is a promise, not a measurement.

Two things you will not find here: a step-by-step on writing your first tag (that is the writing guide) and the full NTAG 424 DNA story, which has its own post.

• What an NFC tag physically is

• The alphabet soup: standards, Forum types, and what is not NFC

• How to read a datasheet or a listing

• NDEF and what actually fits on a tag

• Memory maps: what is where on the chip

• The decision table

• Family by family

• Form factors and read range

• What reads what

• What NFC.cool Tools does with each chip

• Buying without getting burned

• The whole catalog on one table

• The matchups people search for

• Frequently asked questions

• Glossary

• Sources and further reading

What an NFC tag physically is

An NFC tag is three things glued together: a chip the size of a grain of sand, an antenna that is a few turns of etched aluminium or copper, and a substrate that holds them, which can be a paper sticker, a PET inlay, a PVC card or a glass capsule. The chip has no battery. It is powered by the phone.

The way that works is inductive coupling. The phone’s antenna is a coil driving a magnetic field that alternates 13.56 million times a second. Bring a second coil into that field and a current is induced in it, the same way a wireless charger works, just at a tiny fraction of the power. The tag’s chip lives on that induced current. To send data back it does not transmit anything of its own. It switches a load across its antenna on and off, which the phone’s coil feels as a tiny change in its own field. That trick is called load modulation, and it is why the phone does all the work and the tag can cost eight cents.

It is also why the range is what it is. The field of a small coil falls off with the cube of the distance, so a tag that reads perfectly at one centimetre gets nothing at ten. I think of it like a candle: you can read by it if you are close, and no amount of squinting helps from across the room. The NFC Forum’s own definition says “a typical range of up to 2 cm”, Android’s documentation says “4 cm or less”, and NXP’s datasheets say “up to 100 mm depending on field strength and antenna geometry”. All three are right. The phone figure is what you will see; the 100 mm is what the chip can do with a big reader and a big antenna.

Data rates are modest because there is no need for more. A Type A or Type B tag talks at 106 kbit/s, with the faster chips negotiating 212, 424 or 848 kbit/s after the initial handshake. FeliCa runs at 212 or 424. ISO 15693, the long-range family, is slower still at 26.48 kbit/s in its normal mode, because it was designed to be read from a metre away by a warehouse gate rather than a phone. A full dump of an NTAG216’s 888 bytes takes a fraction of a second either way.

The alphabet soup: standards, Forum types, and what is not NFC

Every listing mixes three naming systems: the ISO standards that define the radio, the NFC Forum tag types that define how data is laid out, and the manufacturers’ product names. Here is the map.

The standards

The NFC Forum tag types

The NFC Forum did not design chips. It wrote five recipes for storing an NDEF message (the container format every phone understands) on chips that already existed. That is what “Type 2 tag” means: not a chip, but a layout.

Two things that are deliberately not on that list. MIFARE Classic is not a Forum tag type at all; NDEF on Classic is an NXP mapping that Android supports on some phones and iOS does not support on any. And the Forum recipes say nothing about security. A Type 2 tag can be a plain NTAG213 or an NTAG 224 DNA with AES-128 authentication; a Type 4 tag can be a bare ST25TA02K or a bank card. The type tells you how the NDEF message is stored, not who can get at it.

What is not an NFC tag

Half the “why won’t my phone read this” messages I get are about things that were never NFC. A phone’s NFC coil is tuned to 13.56 MHz and speaks the protocols above. Anything else is invisible to it, no matter how tag-shaped it is.

The 125 kHz badge is the one that hurts. It fits the reader at the door, it is a plastic card with a coil in it, and it will never talk to a phone. I wrote up why an iPhone cannot open your condo door because the honest answer is a hardware one.

How to read a datasheet or a listing

A datasheet front page has all the numbers you need, and a good listing copies them. Here is what each one means and which ones lie.

User memory versus total memory

Every chip has more EEPROM than you can use. An NTAG213 has 180 bytes in total and 144 of them are yours; the other 36 hold the UID, the lock bits, the capability container and the configuration pages. A MIFARE Classic 1K has 1024 bytes and 752 are data, because every sector loses a block to its keys. Listings quote whichever number is bigger. The number that matters is user memory, and even that is not what fits in an NDEF message, which is the next section.

The UID

The unique identifier is burned in at the factory and cannot be changed, except on the clones built to change it. Three lengths exist:

The manufacturer code comes from the ISO/IEC 7816-6 register, and it is the fastest honest check on a listing. If a “genuine NXP” tag reports 1D, it was made by Fudan.

ATQA, SAK and GET_VERSION: how a reader tells chips apart

When a Type A chip answers a phone it sends two small values, the ATQA and the SAK. Readers, including my app, use the SAK to sort chips into families, because the SAK bits say whether the chip speaks ISO-DEP and which broad family it belongs to. NXP’s own identification note says in bold not to use the ATQA for anything, because it collides and misleads, and I have found that to be true.

Since every NTAG and every Ultralight answers SAK 00, telling an NTAG213 from an NTAG216 from an Ultralight EV1 needs one more command: GET_VERSION. It returns eight bytes, and three of them do the work. Byte 2 is the product type (03 Ultralight, 04 NTAG, 07 NTAG I2C, 01 DESFire, 02 Plus, 08 DESFire Light), byte 4 is the generation, and byte 6 encodes the storage size. This is how NFC.cool knows what it is looking at, and it is also the first thing an Amiibo-reading console asks a tag.

Chips without GET_VERSION exist: the original Ultralight, Ultralight C and the old NTAG203 never had it, and neither do most clones. That absence is itself a fingerprint.

Endurance, retention, temperature

These three are the numbers listings almost never quote and datasheets always do.

• Write endurance is how many times a byte can be rewritten. 100,000 cycles is the floor for anything current; the Classic-era chips and the original Ultralight are rated 10,000. DESFire EV3 and the ST25DV family are rated 1,000,000 typical.

• Data retention is how long the bytes survive unpowered. 10 years is the old standard, 50 years is what NXP rates NTAG 424 DNA and the ICODE SLIX family at, and ST rates the ST25TA Type 4 chips at 200 years. Retention is specified at room temperature; heat shortens it.

• Operating temperature is -25 to +70 °C for most NXP consumer chips, -40 to +85 °C for the ST and EM parts, and up to 105 °C for ICODE 3. The chip is usually not the limit; the adhesive and the substrate are.

The security ladder

This is the part of a listing that lies most. “Encrypted”, “secure”, “anti-clone” get printed on tags whose only protection is a 32-bit password sent in the clear. Here is the ladder, bottom to top, and every chip in this guide sits on one rung.

Two features sit beside the ladder rather than on it. An originality signature is a digital signature over the UID, written by the manufacturer, that lets a reader check the chip came from NXP or ST. It does not stop copying, because a clone can carry a copied signature, and NXP says so in its own application note. And counters (a 24-bit read counter on NTAG213/215/216, three one-way counters on Ultralight EV1, a 16-bit write counter on SLIX2) are for use cases, not security, unless they are folded into a SUN message.

NDEF and what actually fits on a tag

NDEF (NFC Data Exchange Format) is the envelope. A phone does not read “a URL” off a tag; it reads an NDEF message containing a URI record, and the envelope has weight. Knowing the weight is how you answer “will my link fit on an NTAG213”.

The record

Every record starts with a flags byte (message begin, message end, short record, and a three-bit type name format), then the length of the type, the length of the payload (one byte if the payload is under 256 bytes, four bytes otherwise), the type itself, and the payload. A short URL record therefore costs 4 bytes of header before the first byte of your link.

The prefix byte is the one clever thing in the URI record. Instead of spelling out https://, the first payload byte is a code for a common prefix, and the phone puts it back.

So https://nfc.cool/ is stored as the byte 04 followed by nfc.cool/: nine bytes of payload for a seventeen-character URL. NXP’s own NTAG 5 datasheet ships the example D1 01 0C 55 01 followed by nxp.com/nfc, which decodes to http://www.nxp.com/nfc.

The envelope around the record

On a Type 2 or Type 5 tag the message sits inside a TLV: one byte saying “NDEF message” (03), one length byte (three bytes if the message is 255 bytes or longer), the message, and a terminator byte (FE). On a Type 4 tag there is no TLV; the NDEF file begins with a two-byte length. And on a factory NTAG213 or NTAG212 the first five bytes of user memory are already taken by a Lock Control TLV that NXP ships pre-written and every writer preserves.

Here is the arithmetic for a single https:// link, done by hand for the chip most people buy:

• NTAG213 user memory: 144 bytes

• minus the factory Lock Control TLV: 139

• minus the NDEF TLV framing (03, length, FE): 136 bytes for the message

• minus the record header (flags, type length, payload length, U): 132 bytes of payload

• minus the prefix byte: 131 characters after https://

What fits where

Two footnotes that trip people up. NXP’s own capability container on the NTAG215 and NTAG216 declares 496 and 872 bytes, less than the user memory, so Android’s getMaxSize() reports the smaller number and it is correct. And a vCard with a name, phone, email and URL is 132 bytes before the envelope and 148 after it, which is why it does not quite fit on an NTAG213 and why business-card vendors default to the NTAG215 or NTAG216. The rounded figures I used in the beginner’s guide (about 130, 480 and 850 characters) are these numbers with the edges knocked off.

Memory maps: what is where on the chip

If you have ever dumped a tag in NFC.cool and stared at the hex, this is the decoder ring.

Type 2: the NTAG213 page map

An NTAG215 has the same shape with user memory running to page 81 and the configuration at 83 to 86; an NTAG216 runs to E1 with configuration at E3 to E6. The capability container bits are one-way: once the read-only flag in byte 3 is set, or a lock bit is set, it cannot be cleared, which is what “permanent lock” in the app actually writes. A “format” on Type 2 writes an empty NDEF TLV (03 00 FE) to page 4; it does not zero the memory, so old data can still be dumped until it is overwritten.

Type 4: the NTAG 424 DNA file system

There are no pages. An ISO 7816 application named D2760000850101 contains three files: a 32-byte capability container (E103), a 256-byte NDEF file (E104) and a 128-byte proprietary file (E105). Each file has its own read, write and change access rights, each mapped to one of five AES keys. DESFire works the same way but lets you create your own applications and files; NTAG 424 DNA’s three are fixed, which is why I described it as a small locked safe with three drawers.

Type 5: ISO 15693 blocks

Four-byte blocks, numbered from zero, with the capability container in block 0 (E1 40 followed by the size) and the NDEF TLV starting in block 1. The UID, AFI, DSFID and lock status live outside the addressable blocks and are read with a separate GET SYSTEM INFORMATION command. On an ICODE SLIX2 the last addressable block, 79, is the 16-bit counter; on ICODE 3 block 75 holds a 24-bit counter and blocks 76 and up are a separate configuration area.

MIFARE Classic: sectors, trailers and the directory

A Classic 1K has 16 sectors of 4 blocks of 16 bytes. The last block of every sector is the sector trailer: key A, three access bytes, one free byte, key B. Block 0 of sector 0 is the manufacturer block with the UID. To put NDEF on a Classic, NXP defined a directory: sector 0 becomes the MIFARE Application Directory (MAD), readable with the public key A0 A1 A2 A3 A4 A5, and it lists which sectors hold NDEF under the application code 03 E1. Those sectors use a second public key, D3 F7 D3 F7 D3 F7. A factory-fresh card has every key set to FF FF FF FF FF FF. When NFC.cool on Android formats a Classic card, this directory and these keys are what it writes, and it is the reason a formatted Classic card reads on some Android phones and on no iPhone.

The decision table

Start here if you know the job and want the chip.

What is not in the table: MIFARE Classic. There is no job in 2026 for which I would buy a Classic chip, and the section below explains why.

Family by family

Each family gets the same treatment: a spec table from the datasheet, what the chip is for, what the phones do with it, and a hands-on note where I have one.

NTAG 21x: the sticker family

This is the chip in nearly every NFC sticker, coin and card sold to consumers, and NXP still lists all of them as active in 2026 even though the datasheet has not changed since 2015.

All of them are NFC Forum Type 2, ISO/IEC 14443 Type A, 7-byte UID, 106 kbit/s, rated -25 to +70 °C. The NTAG210 and NTAG212 come with a 17 pF input capacitance for small antennas; the 213, 215 and 216 are 50 pF. The originality signature is ECDSA on the secp128r1 curve, 32 bytes, read with the READ_SIG command; the verification key is in an NXP application note that is not public, which is why almost no consumer app checks it.

The three features that matter in practice are the password (a 32-bit PWD, a 16-bit PACK the tag answers with, AUTH0 to say where protection starts, and AUTHLIM to brick the tag after a chosen number of wrong guesses), the NFC counter (24 bits, incremented once per read session, readable with a dedicated command), and the ASCII mirror, which pastes the UID and the counter as text into your NDEF message so a plain URL becomes https://example.com/?u=04A1...&c=000123 on every tap. The Philips Sonicare brush heads I wrote about use an NTAG213 with AUTHLIM set to three, which is how a brush head locks itself if you guess wrong.

Hands-on: these are the chips I test every release against, and the NTAG216 is the one I recommend when someone wants to buy one pack and stop thinking about it. The password is worth setting on anything you leave in public; it stops the person with a free app, which is most people. It does not stop anyone with a sniffer, because the password itself travels over the air unencrypted, and I say that plainly in the app.

On the phones: NDEF read and write on everything, iPhone background reading of URL records, and raw access on both platforms for the password, counter and mirror. NFC.cool does all of that on iPhone, Android and through a USB reader on iPad and Mac.

NTAG DNA: the ones that sign every tap

Three generations, two of them still made.

SUN, Secure Unique NFC, is the feature that makes these worth three times the price of an NTAG213: the tag mirrors its UID and read counter into the URL and appends an AES-128 CMAC over them, computed fresh on every tap. The server checks the MAC; a cloned tag has no key and fails. I went through all of it, including LRP mode and the five keys, in the NTAG 424 DNA post, so here is only what changed since: NXP now also sells the NTAG 426Q DNA and the NTAG X DNA, a 16 kB connected Type 4 chip certified to EAL6+, so the 424 is no longer the newest DNA chip, just the one you can actually buy as a sticker.

The 22x DNA family is the interesting newcomer: SUN on a Type 2 chip, which means the sticker is cheaper and the phone reads it as a plain NTAG. The StatusDetect variants add a sensor: either a conductive loop that records, irreversibly, that it was broken, or a capacitance measurement from 0 to 11 pF between two pins, which NXP pitches for liquid level, humidity and pressure.

Hands-on: I bought my first NTAG 424 DNA tags on AliExpress for a few euros and built the app’s whole 424 feature set around them: key changes, SUN in plain and encrypted modes, file access rights, the vault file, tamper status. The 424 is also the one chip where NFC.cool verifies the originality signature against NXP’s published public key and shows “Genuine NXP”. The 22x DNA I have only on paper.

MIFARE Ultralight: the ticket family

Ultralight is NTAG’s older sibling. Same air interface, same 4-byte pages, same SAK, and from EV1 on the same commands. The difference is intent: Ultralight was built for single-trip tickets and the NTAG line for stickers with a URL, which is why NTAG ships with a pre-written capability container and Ultralight does not.

The Ultralight EV1’s three one-way counters are its distinguishing feature: a transit operator burns a count down and the chip refuses to go back up. The Ultralight AES is the quiet answer to “I want an NTAG213 with real authentication”: same 144 bytes, AES-128 instead of a password, on a Type 2 tag any phone can read.

On the phones: everything here reads as a Type 2 tag. Apple’s Core NFC exposes an .ultralight family and lets an app send native commands; Android has a MifareUltralight class that is optional but present on every phone I have seen. NFC.cool names the EV1 variants and the AES from GET_VERSION and treats the password on EV1 like NTAG’s; the AES authentication itself is not something the app does.

MIFARE Classic, Plus and DESFire: the access-control family

Three families in one section because they are one story: Classic was broken, Plus was the migration path, DESFire is where the industry ended up.

MIFARE Classic is the chip in your old hotel key, your gym card and a great many office badges. It is not an NFC Forum tag type. It has its own cipher, CRYPTO1, which two research groups reverse-engineered in 2008: Nohl and Plötz by looking at the silicon under a microscope, and the Radboud University group by watching the protocol, who recovered a key “from just one or two authentication attempts with a genuine reader in less than a second”. NXP went to court to stop the second paper and lost. Sixteen years later, in August 2024, Quarkslab published a hardware backdoor in the Fudan FM11RF08S, the most common Classic-compatible chip of the last five years, and found an older backdoor key shared by earlier Fudan chips, some Infineon chips and even some NXP chips from around 2000. Classic is not a security product, and NXP’s own product page for the Classic EV1 now says “not recommended for new designs” and points to DESFire Light.

The straight iPhone answer, because I get asked weekly: an iPhone cannot read the contents of a MIFARE Classic card, and no app can change that. Apple’s Core NFC has no Classic family in its API and the documentation for its MIFARE command says outright that it “doesn’t support the Crypto1 protocol”. The phone sees the UID and the SAK, my app names the family from those, and that is the end of it. Android is different: the MifareClassic class is optional, implemented by phones whose NFC controller has CRYPTO1 in hardware (NXP’s controllers do; the Broadcom chips in a generation of Nexus and Galaxy phones did not), and on those phones NFC.cool reads every sector the factory key opens and can format a fresh card for NDEF.

MIFARE Plus is Classic’s memory map with AES-128 bolted on, so an operator could swap cards first and readers later. It runs in security levels: SL1 behaves like a Classic (with optional AES), SL3 is AES only over ISO-DEP, and the Plus X had an SL2 in between. Plus S and Plus X are discontinued; Plus SE (a 1K, 752 bytes) and Plus EV2 (2K or 4K, EAL5+, 25-year retention, 1,000,000-cycle typical endurance) are current. In SL1 a phone sees SAK 08 or 18, the same as a Classic; in SL3 it sees an ISO-DEP card.

MIFARE DESFire is a different animal: a small file system with applications, files, per-file access rights and up to 14 keys per application, speaking APDUs over ISO-DEP at up to 848 kbit/s.

The “2K” in a DESFire name is not 2048 bytes of anything you can use directly. NXP’s comparison note gives the usable figures in the table, and every application and file you create takes a slice for its own headers, allocated in 256-byte pages. Ask the card with the FreeMemory command rather than trusting the label. DESFire EV3 also brought SUN to the family, so an EV3 can do the NTAG 424 DNA trick of signing a URL, which the EV2 cannot.

On the phones: iOS delivers DESFire as a .desfire MIFARE tag, or as an ISO 7816 tag if the app asks for the NDEF application; Android uses IsoDep. NFC.cool identifies the generation and size from GetVersion and lists the applications and files it is allowed to see without keys. It does not authenticate to a DESFire or write to one; that is a job for the operator’s own tooling, and I would rather say so than pretend.

ISO 15693: the long-range family

These are the chips that were designed for a metre, not a centimetre. A phone still reads them (Apple since iOS 13, Android through NfcV), and GoToTags measured Type 5 tags reading at roughly twice the distance of Type 2 tags on an iPhone, but their home is the library gate, the warehouse shelf and the laundry. The UID is 8 bytes starting with E0, blocks are 4 bytes, and the family adds three things Type A chips do not have: an AFI (an application family byte a reader can filter on), a DSFID (a data format byte), and EAS, the electronic article surveillance bit that makes a shop gate beep.

NXP ICODE. The lineage runs SLI (2000), SLI-S and SLI-L (2007), SLIX and its S and L variants (2010), SLIX2 (2014), ICODE DNA (2016) and ICODE 3 (2024). There is no “SLIX3”; a listing that says so means ICODE 3 or is guessing.

ICODE 3 is the one to know about: it mirrors the UID and its tap counter into the NDEF message the way an NTAG213 does, reads at up to 212 kbit/s, and self-tunes its antenna. It does not have AES; the ICODE DNA is the AES part, and neither of them does SUN.

STMicroelectronics ST25TV and ST25DV. ST’s Type 5 line, and the one with the best datasheet numbers in the whole guide.

The ST25TV02KC’s Augmented NDEF deserves a paragraph because it gets sold as security. The chip inserts its UID, a custom field and a three-character unique tap code into the URL on every read, without touching the EEPROM. The tap code changes per tap and ST’s datasheet says in so many words that it is “predictable”. It is a freshness token that tells your server this is a new tap, not proof that the tag is genuine. TruST25, ST’s originality signature over the UID, is the genuineness feature, and like NXP’s it is a static signature that a clone can copy.

The rest of the Type 5 world. Texas Instruments’ Tag-it HF-I inlays (Standard 32 bytes, Pro 32 bytes with a password-protected write and a kill command, Plus 256 bytes) are in every library that installed NFC before 2015 and every one of them is now marked not recommended or obsolete. EM Microelectronic’s EM4233 (208 bytes, a 96-bit key privacy mode, 60-year retention) is available on request. Infineon’s my-d and Fujitsu’s MB89R118 show up in NFC.cool’s identification code because users sent them in. NXP’s NTAG 5 (link, boost, switch) is an ISO 15693 chip despite the NTAG name, with 2048 or 512 bytes, an I2C port, energy harvesting up to 30 mW and a 1,000,000-cycle, 40-year EEPROM: a connected tag for electronics, not a sticker, and software written for NTAG21x will not talk to it.

Hands-on: the SLIX2 is the chip inside every OpenPrintTag filament spool, so I have handled a good number of them and NFC.cool reads, writes and formats them on both platforms. What the app does not do, and I want to be clear about it, is the ISO 15693 password, privacy, EAS and AFI commands. The command bytes are in the code as a reference table; the buttons are not there yet.

Type 4 outside MIFARE: ST25TA

ST’s ST25TA family are Type 4 tags on ISO/IEC 14443 Type A without any of the DESFire machinery: one NDEF file, a capability container file and a system file, two 128-bit passwords (read and write), and a 20-bit event counter that can count reads or writes.

Two hundred years of retention and a million write cycles, at 106 kbit/s only. The -P and -D variants have a general purpose output pin that toggles when the tag is read, which is how you make a lamp react to a phone. On both phones these read as Type 4 tags; NFC.cool reads and writes NDEF on them and shows the ISO-DEP details.

Sensor and dual-interface chips

These are chips with two faces: an NFC antenna on one side and an I2C bus, a sensor or a second radio on the other.

I have not built anything with these, so this table is datasheet only. They matter to the guide because they show up in listings as “NFC chip” and confuse people: an NTAG 5 is not an NTAG213 and an em echo tag will not do anything special on your phone.

Legacy and niche

Topaz (Innovision, later Broadcom) is NFC Forum Type 1: 8-byte blocks, 96 or 512 bytes, one-time locks, 10,000 write cycles. Both phones still read NDEF from a Topaz, but the NFC Forum removed Type 1 from its 2021 specification set and nobody designs it in any more. Resellers still have stock.

FeliCa is Sony’s family and Japan’s public transport. FeliCa Lite-S (224 bytes of user memory in 16-byte blocks, an 8-byte IDm, a streamlined triple-DES MAC) is the tag version and NFC Forum Type 3; FeliCa Standard is the smart-card version, now with AES and a Common Criteria EAL6+ rating on the current RC-SA01, and it is what Suica, PASMO, Edy, WAON, nanaco and Hong Kong’s Octopus run on. Sony’s FeliCa Plug modules were discontinued in March 2026. NFC.cool names the transit and e-money brands from the system code on both platforms, reads Lite-S and Standard, and writes NDEF to them on iPhone.

Kovio NFC Barcode was a printed-silicon, read-only, 16-byte tag. Android still has an NfcBarcode class for it. Kovio’s assets went to Thinfilm in 2014, Thinfilm stopped NFC production in 2019 and renamed itself in 2021. The class is a fossil.

ISO 14443 Type B memory chips. ST’s SRI512, SRT512 and SRI4K (512 or 4096 bits in 32-bit blocks, two count-down counters, 1,000,000 cycles, 40 years) live in French and Belgian transit and in some ski passes. Android exposes them through NfcB; the iPhone has no raw Type B tag object at all, so unless a Type B card speaks ISO-DEP and answers a SELECT, an iPhone will not see it. Calypso, the Paris Navigo system, is a Type B smart card that does.

Clones and compatibles

This is the section the listings do not want you to read.

Fudan FM11NT021 is the most common “NTAG213” that is not an NTAG213. It has the same 180 bytes in 45 pages, the same 144-byte user area, a password, a 24-bit read counter and a Fudan manufacturer code of 1D in the UID. It does not implement GET_VERSION and its current datasheet lists no READ_SIG command, so a reader that asks either question gets silence and falls back to guessing from memory size, which is why the Proxmark3 community reports it as an NTAG203. Fudan also makes 504 and 888-byte versions (FM11NT041, FM11NT081). For a link on a sticker they work. For Amiibo they do not, because the console asks GET_VERSION first.

Fudan FM11RF08 and FM11RF08S are the Classic-compatible chips in most cheap “1K” cards. The 08S added countermeasures against the known Classic attacks in 2020 and then turned out to carry a hardware backdoor key common to every card made, which Quarkslab published in 2024 along with tooling that is now in the Proxmark3 firmware.

Magic MIFARE Classic cards are chips built so the UID and the manufacturer block can be rewritten, which a real Classic never allows. The generations are a hobby of their own:

Magic NTAG21x cards exist too, and the fully emulating ones will even accept a copied originality signature, which is the point NXP makes about static signatures.

“NTAG215 compatible” for Amiibo. An Amiibo is a plain NTAG215 whose 540 bytes carry data encrypted and signed with keys derived from the tag’s own UID. Copy the bytes to another tag and the signatures no longer match, which is why a backup has to be re-keyed to the target UID, which is what NFC.cool’s Amiibo backup and restore does. The console’s read sequence starts with GET_VERSION, then a password authentication derived from the UID, then a read of all 135 pages including the configuration ones. A chip that lacks GET_VERSION or has 45 pages instead of 135 fails at step one. TagMo’s documentation puts it in one line: only NTAG215 is recognised.

How a clone shows up in the app. NFC.cool identifies by GET_VERSION first. A chip that does not answer it, or answers with a memory size that does not match what it advertises, is named by what it actually is, not by the listing. On an NTAG 424 DNA the app goes one step further and verifies the ECDSA originality signature against NXP’s public key, which is the only place in the app that can say “Genuine NXP” with cryptographic backing. For NTAG21x the app does not read the signature, partly because NXP’s verification key is under NDA and partly because a copied static signature passes anyway. The honest chain of evidence for a Type 2 tag is manufacturer code, GET_VERSION, memory size, and the presence of the features the chip claims.

Form factors and read range

The chip decides what the tag can do; the form factor decides whether the phone can reach it.

Two physical rules explain most “it does not read” tickets. Antenna size sets range, roughly: a card reads from further than a coin, a coin from further than a 10 mm inlay, and an implant needs contact. Metal detunes the antenna: a coil on a metal surface induces eddy currents in the metal, its inductance drops and its resonance drifts away from 13.56 MHz, so a normal tag on a steel cabinet is dead. A ferrite sheet between the coil and the metal redirects the field and brings the tag back, at the price of a shorter range and a higher cost, which is why on-metal tags cost three times as much.

Where to hold the phone matters as much as the tag. On an iPhone the antenna is at the top edge; Apple’s own instruction is “hold the top of your iPhone near” the tag. On Android it varies by model, usually the centre of the back or near the camera. The beginner’s guide has the walkthrough.

What reads what

The phone and reader matrix. Phone columns come from Apple’s and Google’s documentation and from my own app; the desktop and hobbyist columns are from the vendors’ spec sheets and the projects’ own documentation, and I have not tested those devices myself except the readers named in the iPad and Mac column.

A few rows deserve a sentence.

• iPhone background reading fires only for an NDEF URL record, only when the phone is unlocked and in use, and not while the camera, Wallet, a reader session or airplane mode is active. It never reads a raw chip. iPhone XS and later.

• Which iPhones read tags at all: iPhone 7 and later inside an app, per Apple’s WWDC 2019 session. Writing and raw commands arrived with iOS 13.

• Android’s MifareClassic class is optional. Google’s own words: “if it is not implemented, then MifareClassic will never be enumerated”. It is the controller, not the Android version.

• Web NFC is NDEF only, Chrome 89 and later, Android only, and Apple has a negative position on it, so there will be no Safari version. That is why the online NFC reader on this site works on Android and tells iPhone users to use the app.

• iPad and Mac have no NFC radio. Since NFC.cool 6.15.0 the app talks to a USB CCID reader through Apple’s smart-card stack instead; the HID OMNIKEY 5022 CL is the one I tested, the ACS ACR1552U-M1 and ACR1255U-J1 were reported working by users, and the post lists the limits. Setting an NTAG password works through a reader; removing one needs a command the OMNIKEY refuses, so that one is a phone job.

• The ACS ACR122U does not do ISO 15693, and neither does the ACR1252U or the ACR1255U-J1. In the ACS line only the ACR1552U does. The OMNIKEY 5022 does both. Worth knowing before buying a reader for library tags.

• Proxmark3 and Flipper Zero are the tools that can recover MIFARE Classic keys and emulate cards. That is what they are for, and the guide mentions them because “what reads it” would be dishonest without them.

What NFC.cool Tools does with each chip

This is the point in a post where the thing I built shows up, and it belongs here because every row above ends in “and what does the app do with it”. The table below is not marketing copy; I pulled it from the app’s own source while writing this guide, and it corrected two things I would otherwise have claimed.

The two corrections, for the record: I would have written that the app verifies the originality signature on NTAG21x tags, and it does not; only the 424 gets that. And I would have written that the ISO 15693 password commands were in, and they are a reference table waiting for a UI. Both are on the list.

Buying without getting burned

What a listing has to say before I buy from it:

1. The exact chip name. “NTAG213” not “NFC 213”; “ICODE SLIX2” not “ISO 15693 tag”; “MIFARE Classic EV1 1K” not “1K card”. If the listing does not name the chip, the seller does not know or does not want you to.

2. User memory in bytes, and it should match the chip: 144 for an NTAG213, 504 for a 215, 888 for a 216, 316 for a SLIX2. A “1K” that turns out to mean a MIFARE Classic will not work on an iPhone.

3. The manufacturer, if it claims genuine NXP or ST. The manufacturer code in the UID will tell you the truth after you buy; the price will tell you before. Nobody sells genuine NTAG216 stickers for a third of the going rate.

4. The antenna size and the form factor. A 10 mm inlay reads at a centimetre; a 38 mm one at four. On-metal must say on-metal.

5. Whether it is NDEF-formatted. NTAG ships pre-formatted; Ultralight EV1 and most ISO 15693 chips do not, and NFC.cool formats them, but it is one more step.

Red flags: “NTAG215 compatible” (it is not an NTAG215), “encrypted” on anything under rung 4 of the ladder, “works with all phones” on a MIFARE Classic, and any chip name with a letter the manufacturer never used, such as SLIX3.

What tags cost. Listing prices I saw on 9 September 2026 at Seritag, Shop NFC, GoToTags, NFCW Shop, NFC.CARDS, NFC-Tag-Shop.de, Tagstand and Digi-Key. Most shops sell in tens at minimum, so the “single” column is the smallest tier they offer. Prices move; treat these as ratios.

The pattern is the one you would guess: memory is nearly free, cryptography costs about double, and the form factor costs more than the chip. A bare NTAG213 die is fourteen cents; the sticker around it is most of the price.

Where to buy: I keep a list of the tags and readers I actually use on the affiliate links page, and the 424 tags that started the whole DNA feature set came from AliExpress, so I am not going to tell you the marketplaces are off limits. Check what arrives with the app before you write anything to it.

The whole catalog on one table

One row per chip. “User bytes” is what you can write; for DESFire it is NXP’s usable figure. The phone columns say what the platform can do, not what every app does; the NFC.cool column says what mine does. Scroll sideways on a phone; the first column stays put.

The matchups people search for

NTAG213 vs NTAG215 vs NTAG216. Same chip in three memory sizes: 144, 504 and 888 bytes, with the same password, counter, mirror and signature. Buy the 213 for a link, the 215 for Amiibo, the 216 for a contact card or for not having to think. The price difference is about thirty cents.

NTAG213 vs Ultralight EV1. Same air interface and commands; the NTAG has the ASCII mirror and a pre-written capability container, the EV1 has three one-way counters and comes in 48 or 128 bytes. Stickers want the NTAG; tickets want the EV1.

NTAG213 vs ST25TN01K vs Fudan FM11NT021. Three 144-to-160-byte Type 2 chips. The NTAG has a password and a read counter and answers GET_VERSION; the ST25TN has more memory, a kill command, a tap code and TruST25 but no password; the Fudan copies the NTAG’s features except GET_VERSION and, in its current datasheet, the signature. For a plain link any of them; for a counter or Amiibo, the NTAG.

MIFARE Classic vs DESFire. Not a contest. Classic’s cipher was broken in 2008 and its most common clone was backdoored in 2024; DESFire EV3 has AES, key management, EAL5+ certification and SUN. The only argument for Classic is that the reader on the wall was installed in 2009.

NTAG 424 DNA vs NTAG213. The 424 signs every tap with AES-128 and stores 416 bytes in three files with five keys; the 213 stores 144 bytes with a 32-bit password. If the question is “is this product real”, only the 424 answers it. If the question is “does this sticker open a link”, the 213 does it for a third of the price.

NTAG 424 DNA vs NTAG 223 DNA. Both do SUN. The 424 is Type 4 with five keys, LRP, a random UID option, a vault file and 50-year retention; the 223 is a Type 2 sticker with one SUN key, a 32-bit password and 10 years. The 223 is the cheaper way to put a signed URL on a label; the 424 is the one with an app that can configure it today.

ICODE SLIX2 vs NTAG216 for inventory. If a phone is the only reader, the NTAG216 has more memory and the counter. If a gate or a handheld reader is involved, the SLIX2 reads at a metre and the NTAG at four centimetres, and that decides it.

FeliCa vs NTAG in Japan. A Japanese transit gate speaks FeliCa and nothing else; a Japanese phone reads both. For a tag on a poster in Tokyo, NTAG is fine. For anything a Suica reader must accept, FeliCa, and that is not a chip you program with a phone app.

Frequently asked questions

Should I buy NTAG215 or NTAG216?

The 216 unless you are writing Amiibo. It has 888 bytes to the 215’s 504, the same password, counter and mirror, and the same phone support. The 215 exists in every shop because Nintendo’s figures use it, and if that is your job it is the only choice.

Can an iPhone read MIFARE Classic tags?

It can see that one is there. Core NFC reads the UID and the SAK and stops; Apple’s API has no Classic family and its documentation says the MIFARE command “doesn’t support the Crypto1 protocol”. No app can read a sector on an iPhone. Android phones with an NXP NFC controller can; phones with some other controllers cannot, and the MifareClassic class simply does not appear on those.

How many times can I rewrite an NFC tag?

100,000 times for anything current from NXP or ST at room temperature, and the datasheet numbers are minimums. A DESFire EV3 or an ST25DV is rated a million. The old NTAG203, the original Ultralight and the Topaz were rated 10,000. Nobody rewrites a sticker ten thousand times; the number matters for counters and for tags that log.

How far away does an NFC tag work?

From a phone, up to about four centimetres for a card-sized antenna and about two for a small sticker, in the right spot on the phone. The NFC Forum’s own definition says “up to 2 cm”. An ISO 15693 tag on a gate reader with a big antenna works at a metre, but a phone reads it at the same few centimetres as anything else, maybe twice that of a Type 2 tag.

Do NFC tags expire or wear out?

The chip’s data is rated for 10 years on most consumer chips, 50 on NTAG 424 DNA and the ICODE SLIX family, 60 on ST25TV and 200 on ST25TA, all at room temperature. Heat shortens that. In practice the adhesive, the paper face and the antenna give up long before the EEPROM does.

Are cheap NFC tags from marketplaces safe to buy?

Safe, yes; what they claim, not always. A cheap “NTAG213” is often a Fudan FM11NT021, which works for a link and fails for anything that asks GET_VERSION. A cheap “NTAG215” is often not one, and Amiibo will refuse it. Check the manufacturer code and the chip name in the app before you write anything, and buy from a shop that names the chip.

Can my phone read my bank card or my passport with an NFC app?

The passport yes: with the machine-readable zone as the key, an app can read the chip’s data groups, and NFC.cool does that on both platforms. The bank card is an EMV smart card; an app can read its application list and some public records, but Apple blocks payment-card reading in Core NFC, the card’s security code is not on the chip, and every transaction is signed by a key that never leaves the card, so there is nothing to copy.

Why does my office badge or hotel key not show up in the app?

Most office badges are 125 kHz proximity cards, which a phone’s 13.56 MHz coil cannot even sense. Most hotel keys and older transit cards are MIFARE Classic, which an iPhone can only identify and an Android phone can read only with the right controller and the right keys. Neither is something an app can fix, and I would rather say that than sell you a workaround.

Can I unlock an NFC tag that was made read-only?

No. The lock bits on a Type 2 or Type 5 tag are one-way bits in the chip; the read-only flag in the capability container is the same. A password can be removed if you know it; a lock cannot. That is why NFC.cool asks twice before it locks anything.

Is the NTAG password real security?

It stops the person with a free app, which is most people. It does not stop anyone with a reader that can listen, because the 32-bit password crosses the air unencrypted and the tag answers with a 16-bit acknowledgement. For anything that has to survive a motivated attacker, the ladder starts at AES: Ultralight AES for a Type 2 sticker, NTAG 424 DNA if the tap itself has to prove anything.

Which tag do I need for Amiibo?

An NTAG215, and only an NTAG215. The console asks GET_VERSION, authenticates with a password derived from the UID and reads all 135 pages. A chip without GET_VERSION or with a different page count fails on the first command. Writing an Amiibo to a tag is permanent, because the lock bytes and the password are part of the format.

Which NFC tag works on a metal surface?

Any chip in an on-metal form factor, which means a ferrite sheet between the antenna and the metal. A normal tag stuck to steel does not read at all; an on-metal tag reads at roughly four fifths of its normal range. If you can put three millimetres of anything non-metallic between a normal tag and the metal, that works too.

Does NFC.cool work on iPad and Mac?

Yes, since version 6.15.0, through a USB smart-card reader; neither device has an NFC radio of its own. The HID OMNIKEY 5022 CL is the one I tested and the ACS ACR1552U and ACR1255U-J1 have been reported working. Everything that works on Type 2, Type 4 and FeliCa through the phone works through the reader, with MIFARE Classic read-only.

Glossary

Sources and further reading

Every table in this guide was checked against one of these. Prices are from the shops named in the buying section on 9 September 2026.

NXP NTAG

• NTAG213/215/216 datasheet, Rev 3.2

• NTAG210/212, NTAG 210µ, NTAG213F/216F and NTAG 213 TT datasheets

• NTAG 223 DNA and NTAG 224 DNA StatusDetect datasheets

• NTAG 424 DNA and NTAG 424 DNA TagTamper datasheets, and AN12196, the 424 features and hints note with the originality public key

• NTAG I2C plus and NTAG 5 boost datasheets

• AN13089, NTAG 21x features and hints, on why a static originality signature is not a clone guarantee (mirror; the nxp.com copy is not public)

NXP MIFARE

• MIFARE Ultralight, Ultralight C, Ultralight EV1 and Ultralight AES datasheets

• MIFARE Classic EV1 1K and Classic EV1 4K datasheets

• MIFARE Plus S, Plus SE and Plus EV2 short datasheets

• DESFire EV1, DESFire EV2, DESFire EV3 and DESFire Light datasheets, and AN12752 on usable DESFire memory

• AN10833, MIFARE type identification, AN10927, MIFARE UIDs, AN1305, NDEF on MIFARE Classic, AN10787, the MIFARE Application Directory, AN11004, DESFire as a Type 4 tag

NXP ICODE

• ICODE SLIX, SLIX-S, SLIX-L, SLIX2, ICODE DNA and ICODE 3 datasheets

• AN11809, the ICODE family comparison

STMicroelectronics, TI, EM, Sony, Fudan

• ST ST25TV02KC, ST25TN01K, ST25DV64KC, ST25TA02KB and M24LR64E-R datasheets, AN5658 on Augmented NDEF and TA0358 on TruST25

• TI Tag-it HF-I Standard, Pro and Plus datasheets

• EM Microelectronic EM4233, EM4423 and EM4425

• Sony FeliCa Lite-S datasheet and FeliCa Standard RC-SA01

• Fudan FM11NT021 datasheet

Security research and standards

• Quarkslab, MIFARE Classic: exposing the static encrypted nonce variant and a few hardware backdoors (2024)

• Nohl, Evans, Starbug and Plötz, Reverse-Engineering a Cryptographic RFID Tag (USENIX Security 2008)

• Garcia et al., Dismantling MIFARE Classic (ESORICS 2008)

• ISO/IEC JTC1/SC17 Standing Document 5, the register of IC manufacturers

• Proxmark3 magic card notes and 3dbrew on the Amiibo tag layout

• NFC Forum on the technology and the Type 2 tag specification

Phones and readers

• Apple Core NFC, background tag reading, the MIFARE command that excludes CRYPTO1 and WWDC 2019 session 715

• Android MifareClassic, the advanced NFC guide and Web NFC in Chrome

• Readers: ACS ACR122U, HID OMNIKEY 5022 CL, NXP PN532, Proxmark3, Flipper Zero and Chameleon Ultra

• Antennas and ferrite: TI SLOA241 and Würth ANP022

The bottom line

Match the chip to the job. An NTAG213 for a link, an NTAG216 when you are not sure, an NTAG215 for Amiibo, an NTAG 424 DNA when a tap has to prove something, an ICODE SLIX2 or ICODE 3 when a gate has to read it, a DESFire EV3 when a door has to trust it, and nothing at all from the MIFARE Classic shelf. Everything else in this guide is the reasoning behind that sentence, and the tables are there so you never have to take a listing’s word for it again.

If you want to see what a tag actually is before you write to it, that is what NFC.cool Tools does on every tap, on iPhone, on Android, and on an iPad or Mac with a reader plugged in. And if you have a chip on your desk that the app names wrongly, or one it does not name at all, write to me. That is how most of the sixty got there.