Secure NFC tags and standard NFC tags

In short

The Linxy App writes two different kinds of NFC tag. A standard tag carries its content directly — a web address, a phone number, a contact card, Wi-Fi credentials — and any phone can read it. A secure tag carries a revocable token instead, and the destination is resolved by the platform at the moment of the tap.

The difference that matters is not who can read the tag. Both are readable by an ordinary phone. It is that a standard tag is its content, so changing or killing it means physically getting the tag back, while a secure tag is only a pointer you can redirect or revoke from your desk.

Where the two actually differ

Almost everyone approaches this as a question about secrecy: the secure tag must be the one strangers cannot read. That is the wrong axis, and starting there leads to bad decisions about where each one belongs.

The real difference is where the content lives. On a standard tag the content is on the tag, in your pocket, on the wall, in the customer's hand. It is the only copy and it is final. On a secure tag the content lives on the platform, and the tag holds a 32-character token that identifies which record to look up.

Every practical consequence follows from that one fact: whether you can change the destination after printing, whether you can switch a tag off, whether protection rules apply, and whether you learn anything at all about the taps.

	Secure tag	Standard tag
What is on the tag	A revocable token	The content itself
Change the destination later	Yes, from the console. The tag never moves	Only by physically rewriting the tag
Switch it off	Revoke it. The tag stops resolving immediately	Not possible. Retrieve or destroy the tag
Password, expiry, invited-people rules	Apply, exactly as they do on a scan	Do not apply. There is nothing to apply them to
Location gating	Applies. A gated Mark opens only inside its zone	Does not apply
Interaction data	Recorded against the Mark	None. Nothing is reported back
Works on a phone without the App	Yes — it opens the web address	Yes
Needs a Mark to exist first	Yes. Tokens are generated against a Mark	No

What is written on a secure tag

A secure tag is not a single record. The App writes three, and each is there for a specific phone behavior.

The amber note is the correction worth carrying away. "Secure" describes the arrangement, not an encryption barrier at the tag. Anyone can read a secure tag; what they get is a pointer that you can redirect or switch off, and which the platform will refuse to resolve if the Mark's rules say so. Design your placements around revocability, not around who might tap them.

What happens when somebody taps

The phone reads the tag
On Android the app record means Linxy opens directly rather than a browser chooser appearing. On iPhone the web address is followed.
The token is sent to the platform
Not the destination — the tag does not hold one. The platform looks up which Mark the token belongs to.
The token is checked
Unrecognized tokens are refused. Revoked tokens are refused and say so. This is the switch-off.
The Mark's rules are applied
The same ladder a scan goes through: archived, expired, password-protected, restricted to invited people. A tap is not a way around any of them.
Location is checked, if the Mark is gated
A gated Mark asks the App to confirm you are inside the zone, then resolves. Outside it, the tap is refused with an explanation rather than silently failing.
The destination opens, and the interaction is recorded
Against the Mark, alongside its scans. When the Linxy App handles the tap, the destination opens inside the App, never in the phone’s browser.

A single tag can be pointed somewhere of its own. Tags generated against the same Mark normally all open that Mark. A tag can also be given its own destination, which replaces the Mark's for that tag only — useful when a hundred table tents share one Mark but table twelve needs its own page. The interaction is still counted against the Mark, so your reporting stays whole.

What a standard tag can carry

The standard writer produces ordinary NFC records that any phone understands, with no Linxy involvement at all after writing.

Type	What a tap does	Notes
Web address	Opens the page	If the address is a Linxy one, the app record is added so Android opens the App
Text	Displays the text	Plain note, no action
Contact card	Offers to save the contact	Name, phone, email, organization, title, website
Wi-Fi	Joins the network	Android joins on tap; iPhone behavior varies by version
Phone, email, message	Opens the dialler or a pre-addressed message	Spacing in numbers is stripped for you
Address	Opens the location in maps	Written as a web address so it works on any phone
Web search	Runs the search	An ordinary search address
App	Opens the app, or its store listing	An Android package identifier gets an app record; paste a store link for iPhones

A standard tag is a printed object with no undo. Wi-Fi credentials on a tag by the door are the password, handed to everyone who taps it, until you retrieve the tag. A phone number on a tag is that number forever. Write standard tags for things you would be comfortable engraving.

Choosing between them

Use a secure tag when	Use a standard tag when
The tag will be in the world longer than the campaign behind it	The content is genuinely permanent — your own phone number, your office Wi-Fi
You may need to switch it off — a lost badge, an ended promotion	Nothing bad happens if it keeps working forever
You want to know how often it is used	You do not care, or the tag is for your own convenience
Access should be restricted by password, expiry, invitation or location	The content is public by nature
Many tags share one destination you may want to change once	Each tag is its own one-off
The tag will be handled by people you do not control	The tag stays in your own hands

Both kinds can be written from the phone or, for production runs at a bench, with the desktop Linxy NFC Encoder — the choice of tool does not change the tag.

Locking a tag

Locking makes a tag permanently read-only at the hardware level. It is offered for both kinds, it is irreversible, and it is the right choice for anything going out in public where somebody with a phone could otherwise overwrite your tag with their own content.

Two behaviors worth knowing before you use it. Not every tag supports locking — if yours does not, the App tells you the content was written and saved but the tag could not be locked, rather than pretending it succeeded. And a tag that is already locked cannot be reused for anything: the App will say so and you need a fresh one.

Locking a secure tag is not the same as freezing the destination. The lock fixes what is written on the tag — the token. Where that token leads remains yours to change or revoke. This is exactly the combination you want for public placements: physically tamper-proof, editorially flexible.

When the tag must prove it is genuine

Both kinds of tag give the same link on every tap, so anyone can copy one onto another tag and the copy works. For products that have to prove they are the real one, use Verified authentic tags: NTAG 424 DNA chips that make a new one-time code on every tap. Linxy checks the code, and a copied tag or a copied link shows a warning instead.

Use a Verified authentic tag when	A secure tag is enough when
A copy would cost you or the customer: luxury goods, spare parts, collectibles, medicines, documents	A copy does no harm, or you only need to redirect or switch it off
You want to hear when a copy is tapped, and where	Tap counts are all you need

They are written from More Tools › NFC Tags › Write Verified authentic tags. See Verified authentic tags.

Symptoms, causes and fixes

Symptom	Cause	Fix
Android offers a list of browsers instead of opening Linxy	The tag has no app record — typically a standard web-address tag pointing at a non-Linxy address	Expected for standard tags. Use a secure tag if you want the App to open directly
A tap says the tag has been revoked	Somebody revoked that token	Working as designed. Generate a new token and write a fresh tag
A tap says the tag is not recognized	The token is not in the system — a tag written from another account, or a damaged read	Re-read the tag. If it persists, rewrite it from the Mark it belongs to
The tap asks for a password and the scan did not	It should ask on both — a tap runs the same rules as a scan	Check the Mark's protection settings; the tag is not the cause
A gated tag refuses outside the venue	The Mark is location-gated and the zone check failed	Correct behavior. Tap inside the zone, with location enabled
"This tag is locked"	The tag was written once and sealed	Locked tags cannot be reused. Write to a fresh one
The content saved but locking failed	The tag does not support locking, or the lock command failed	The content is fine. Use a lockable tag if permanence matters
No interaction data from your tags	They are standard tags	Standard tags report nothing. Secure tags are the ones that count

Things people commonly get wrong

“A secure tag cannot be read without the App.”It carries a web address precisely so that a phone without the App still works. What is protected is your control of the destination, not the tag's readability.

“I will use standard tags now and upgrade later.”Upgrading means physically re-writing every tag you have distributed. Decide before the tags leave your hands.

“Protection settings on the Mark do not apply to a tap.”They do — a tap runs the same ladder as a scan, location gating included. A tag is not a side door.

“A secure tag proves the product is genuine.”It controls where the tag goes, but a copy of it works the same. Use a Verified authentic tag when a copy must fail.

“Locking protects the content.”Locking stops the tag being overwritten. It says nothing about who may open what the tag points to. Use the Mark's protection settings for that.

“Wi-Fi on a tag by the door is safer than a printed password.”It is the password, in a form anyone can copy silently by walking past with a phone. Treat a standard tag as public the moment you place it.

Related reading: Writing an NFC tag from the App, Reading an NFC tag, NFC from the console, Mark settings, Geofencing, and Verified authentic tags.

In short

On this page

Where the two actually differ

What is written on a secure tag

What happens when somebody taps

What a standard tag can carry

Choosing between them

Locking a tag

When the tag must prove it is genuine

Symptoms, causes and fixes

Things people commonly get wrong

Related