EdgeNFC
Start free

Live demo · no signup

Forge a tap. Watch it fail.

This page runs the real EdgeNFC verification core — the same Rust engine behind hosted verification and the on-premise packages — compiled to WebAssembly and executed in your browser. Sign a tap, verify it, forge the code, replay it.

Nothing leaves this page. The demo key is generated by your browser, used by your browser, and forgotten when you close the tab. No account, no upload, no server call — the only thing fetched is the verification core itself.

Try it

Four steps, start to finish.

Sign → verify → tamper → replay. Every verdict below is produced locally by the WASM core; the JSON is exactly what a production verifier returns.

Simulated tag UID—
Master key (this tab only)—

Ready. Press Run the demo.

  1. 1

    The tag signs the tap

    waiting

    A per-tag key is derived from the master key and the chip's own UID (AN10922), then the UID and the read counter are MAC'd (AES-CMAC). The key never leaves the chip.

  2. 2

    A genuine tap verifies

    waiting

    The same URL, checked against the master key. The signature matches and the counter advanced.

  3. 3

    A forged code is rejected

    waiting

    One hex digit of the MAC is flipped and nothing else changes. The URL still looks perfectly ordinary — the maths does not.

  4. 4

    A copied tap is rejected

    waiting

    The genuine URL, presented a second time. Its signature is still perfect — the counter is what exposes it, which is why a screenshot or a copied link is worthless.

What you just proved

  • Cloning the URL doesn't work. The counter only moves forward, so a copy is detectable on its second use.
  • Guessing the code doesn't work. The MAC is derived from a key that never appears in the URL, on the tag's own UID.
  • The verdict is the same everywhere. Hosted and on-premise run this identical core — no divergence.
Start free — 100 tags See pricing

No credit card · Unlimited scans on every tier · Works with the free EdgeNFC provisioning app

This demo simulates a tap with a key generated here. It never claims anything about a physical tag you own — pasting a real tag URL is a different tool. Need blanks? Where to buy NTAG 424 DNA tags.