EdgeNFC
Sign in Start free

Secure Digital Business Cards & Portfolios#

The problem#

An ordinary NFC business card is a static link written into a chip. Anyone who taps it can read the URL, and anyone who has the URL can hand out a card that behaves exactly like yours. The link is also frozen: change agency, change portfolio host, change phone number, and you reprint the whole run.

How EdgeNFC solves it#

The card stops being a link and becomes a credential.

  • The tap is signed. Every tap produces a fresh AES-CMAC computed on the card, with a per-tag key derived from your System Master Key and never readable off the chip. A copied URL is not a copied card.
  • The tap is unrepeatable. A monotonic counter advances on every genuine tap, so a forwarded or screenshotted URL comes back not authentic with reason: non_monotonic.
  • The destination is yours to change. Custom routing lives server-side, so you can re-point the same physical cards at a new site, a new portfolio, or a campaign-specific landing page — as often as you like, without reprinting anything.
  • You can see the follow-up signal. On Brand+, aggregate scan counts and country breakdowns tell you which events actually produced taps — counts and ISO-2 country codes only, never a UID or an IP.

How it works here#

One provisioning pass over a pack of cards; after that every tap is verified at the edge.

EdgeNFC NTAG 424 DNA edgenfc.com SINGLE-USE CODE A7F3·91C4·5E08 2D9B·04E7·C316 6B1E·FD52·8A47 tap #1,247 tap #1,248 tap #1,249 Genuine Verified at the edge

One tag. A new code every tap — and a fresh proof behind it.

  • 1 Provision, once The app derives a per-tag AES key with AN10922 diversification (your System Master Key + the tag UID), installs it via AuthenticateEV2First + ChangeKey, then writes the SUN URL template mirroring uid, ctr and mac.
  • 2 Tap — a new code, every time The chip's SDM engine mints the URL at read time: the SDMReadCtr counter advances and the MAC changes on every single tap. Nothing is reusable.
  • 3 Verify at the edge Cloudflare re-derives the tag's key and checks the 8-byte AES-CMAC in microseconds, in the same Rust/WASM core hosted and DIY deployments share.
  • 4 Replays rejected A monotonic counter that fails to advance means a captured link is being re-used — it is refused, not redirected. Genuine taps get a 302.
An illustrated end-to-end EdgeNFC lifecycle. A garment hang-tag carrying an NTAG 424 DNA chip hangs from a product on a cord; a smartphone taps it and an NFC ripple spreads out from the contact point. Provisioning happens once, over ISO-DEP: the Android app derives a per-tag key from the System Master Key and the tag UID using AN10922 AES-128 diversification, installs it with AuthenticateEV2First then ChangeKey, and writes the SUN URL template with SDM mirrors for uid, ctr, and mac. On every tap the NTAG 424 SDM engine emits a dynamic URL of the form https://edgenfc.com/?uid=&ctr=&mac= — the phone screen shows the single-use code changing from A7F3·91C4·5E08 to 2D9B·04E7·C316 to 6B1E·FD52·8A47 while the SDMReadCtr tap counter climbs from 1,247 to 1,249. Verification runs at the Cloudflare edge, near the customer, typically in well under a second: the Rust/WASM core re-derives the per-tag key, verifies the 8-byte AES-CMAC, and checks the monotonic counter against D1 to reject replays. The phone then reveals a green Genuine check — a genuine, counter-advancing tap returns a 302 redirect (or a JSON authentic:true payload), while a forged or replayed tap returns the tap page with a not-verified result.

What you need#

PieceWhat to pick
HardwareNTAG 424 DNA tags — no other chip works. CR80 PVC cards are the obvious pick; a 25 mm token if you want to stick one on a laptop or a press kit. Where to buy
PlanCreator for custom dynamic routing — the feature that makes the card re-pointable; Brand if you want a custom verification domain and scan analytics
SoftwareThe provisioning app to encode the pack. No backend of your own required

This is the lowest-effort way into EdgeNFC: a Creator plan plus a ten-pack, and you can be live in an afternoon.

Step by step#

  1. Create a system for your cards and generate its System Master Key.
  2. Encode the pack with the provisioning app — a ten-pack is a few minutes of tapping.
  3. Set the destination with custom routing (Creator+): your site, your portfolio, a scheduling link. Owner-stored config only, so a forged tap can never be redirected anywhere.
  4. Optionally split by card. With per-tag routing (Enterprise) each card in a team can point somewhere different — one printed design, one system, many destinations.
  5. Re-point whenever you want. New job, new portfolio, new campaign: change the route, not the cards.

Verify it worked#

  • Tap your card on a phone: it opens your destination, and the tap verifies authentic with the counter advanced.
  • Copy the URL out of the address bar, then open it again: not authentic, reason: non_monotonic, and no redirect. That is the difference between a credential and a link.
  • Change the route, tap again, and confirm you land somewhere new with nothing re-written on the card.

Known limits#

Warning

Some Android phones need the EdgeNFC app to open the card. Android 16+ can't NDEF-dispatch NTAG 424 DNA tags — a Google regression — so on those devices the tap may do nothing until the tag is scanned from inside the EdgeNFC app. iOS and pre-16 Android read these tags natively. Worth knowing before you hand a card to someone at a conference: if nothing happens, it is that bug, not a dead card.

Start free#

Create a system on the free Sandbox plan, encode a card, and try the replay demo before you buy a pack.

Start free →