EdgeNFC
EdgeNFC
NTAG 424 DNA · SUN · SDM
EdgeNFC turns any NTAG 424 DNA tag into a forgery-proof seal. Every tap generates a fresh, single-use cryptographic code, verified at the edge near your customer — typically in well under a second, anywhere in the world. Clone it, replay it, fake it: it fails.
Unlimited scans — no scan caps. Every tier bills on active tags, never per tap. Verify a tag a million times for the same price.
No credit card · Free forever tier · Works with the free EdgeNFC provisioning app
How it works
You provision the tag once. Every tap after that is a fresh cryptographic proof your customer — and your server — can trust.
The free Kotlin app writes a unique diversified key + SUN URL to the NTAG 424.
A phone tap opens the URL — carrying a different code every single time.
A Cloudflare Worker re-derives the key, checks the CMAC + counter — at the edge, near your customer, typically in well under a second.
Genuine ✓ — or rejected if it's forged, replayed, or unknown. No ambiguity.
The full walkthrough: what happens on the chip, in the URL and at the edge →
Why it can't be faked
QR codes and static NFC tags can be photographed and copied. EdgeNFC can't — the proof changes on every tap and never leaves the chip's secret behind.
Every tag carries its own AES key derived (AN10922) from your master + its UID. Tear one down and you learn one tag — never the master.
A monotonic tap counter is signed into every code. Re-use a captured URL and the server rejects it as already-seen.
Verification runs on Cloudflare's global network, near your customer — typically in well under a second, anywhere in the world. It's the same Rust/WASM core hosted and DIY deployments share, so verdicts never diverge.
The security model in full: key hierarchy, threat model, and what we don't claim →
Under the hood
Provision the tag once. After that, each tap makes the chip mint a brand-new single-use code — and the edge proves it, typically in well under a second, before your customer sees a thing.
One tag. A new code every tap — and a fresh proof behind it.
uid, ctr and mac.
Use cases
Every EdgeNFC tag answers the same question — "is this the real, un-cloned original?" — in whatever context you ship it. Find the one closest to yours.
Prove every garment is the real thing. Each tap is a fresh cryptographic proof a counterfeiter can't clone or reuse.
See the playbook →Clone-proof digital tickets & VIP passes. A monotonic counter defeats screenshot, relay and clone — one-tap door check.
See the playbook →Physical-to-digital provenance. Bind an item to its digital twin and ownership record, verifiable across its whole lifetime.
See the playbook →A tap that's provably you. Dynamic routing backed by a cryptographic identity — not a copyable static link.
See the playbook →Browse all use cases — what to tag, and what each one proves →
Pricing
Unlimited scans on every tier — you pay for active tags, never per tap. No scan anxiety.
Unlimited scans — no scan caps
Unlimited scans — no scan caps
Unlimited scans — no scan caps
Unlimited scans — no scan caps
Prefer to run it yourself? See the $749 perpetual on-premise license below — or compare every plan side by side.
Need more? Let's talk. Enterprise is a published, self-serve price — you never have to speak to us to buy it. Past 100,000 active tags, or if you need a custom SLA or an on-premise / air-gapped deployment, those are real conversations: tell us what you need.
On-premise
One payment, forever. The Enterprise Edge License hands you the same Rust/WASM verification core our hosted service runs, to deploy inside your own infrastructure — where your master keys are generated, stored and used, and never reach us at all.
$749 once. No per-seat fee, no per-scan fee, no renewal that can be repriced out from under a product line you already shipped.
You hold the System Master Key. Diversification and verification happen on your hardware, so there is no custody question to answer in a security review.
Verification is a pure function of the tap and the key — no callback, no licence check at runtime. It works on a network that has never seen the internet.
The same core, byte-for-byte. A verdict on your servers and a verdict on ours cannot disagree — parity is enforced by cross-language test vectors.
The ecosystem
The open EdgeNFC Android app writes and arms your tags at your workbench. The Sandbox tier verifies them in production at no cost — so you can prove the whole loop before you pay a cent.
Create your free accountCustom & on-premise
You do not need this form to buy Enterprise. That tier is a published price you can subscribe to right now, in a browser, without speaking to anyone. This is for the requirements a price list cannot answer.
FAQ
Any NTAG 424 DNA tag (stickers, cards, labels) and an Android phone with NFC to provision. End-users verify with any modern phone — no app required, a tap opens a web page.
Never. Every tier includes unlimited verifications. You're billed only on the number of active tags in your account.
The tag signs each tap with a per-tag secret key it never reveals, plus a counter that only moves forward. A copied URL fails the signature or the replay check. See Why it can't be faked.
Yes. The Enterprise Edge License ($749, one-time) gives you the Wasm verification core to run on your own infrastructure — hosted and self-hosted use the identical engine.
Some Android phones and versions have a known platform quirk where tapping an NTAG 424 DNA tag doesn't reliably hand the link off to a browser from the home screen or lock screen. It's outside our control, and it varies by device. The reliable workaround: open the EdgeNFC app and scan the tag from there — it reads the tag and verifies it the same way, with the same result.
Yes — GDPR / CCPA / LGPD. Granular cookie consent, and self-serve data export & deletion. See our Privacy Policy.