EdgeNFC
Sign in Start free

Apparel & Merch Anti-Counterfeiting#

The problem#

Counterfeit streetwear and merch is indistinguishable by eye. Hangtags, holograms and QR codes are photocopyable — anything printed can be reprinted, and anything static can be screenshotted. Your buyer has no way to check, your resale market gets polluted, and every fake sale is a sale you didn't make.

How EdgeNFC solves it#

A tag sewn into the garment holds a per-tag key that never leaves the chip. Every tap builds a fresh cryptographic code over the tag's UID and a monotonic counter, and EdgeNFC verifies that code at the edge before anything else happens.

That gives you two properties a printed mark can never have:

  • A copy is not enough. Producing a valid tap needs the tag's own key. The key is diversified per tag from your System Master Key (NXP AN10922), so tearing down one garment's tag yields one tag's key — not the master, and not any other tag. See Key management & security.
  • A screenshot is not enough. The counter only ever moves forward. A photographed or forwarded tap URL replays as non_monotonic and comes back not authentic.

For the buyer it is one gesture: tap the garment, a page opens. No app install for a plain URL tag on a phone with NFC turned on.

How it works here#

The same lifecycle runs whether the tag is in a hem or on a hangtag — provision once, then every tap is verified at the edge.

EdgeNFC NTAG 424 DNA edgenfc.com SINGLE-USE CODE A7F3·91C4·5E08 2D9B·04E7·C316 6B1E·FD52·8A47 tap #1,247 tap #1,248 tap #1,249 Genuine Verified at the edge

One tag. A new code every tap — and a fresh proof behind it.

  • 1 Provision, once The app derives a per-tag AES key with AN10922 diversification (your System Master Key + the tag UID), installs it via AuthenticateEV2First + ChangeKey, then writes the SUN URL template mirroring uid, ctr and mac.
  • 2 Tap — a new code, every time The chip's SDM engine mints the URL at read time: the SDMReadCtr counter advances and the MAC changes on every single tap. Nothing is reusable.
  • 3 Verify at the edge Cloudflare re-derives the tag's key and checks the 8-byte AES-CMAC in microseconds, in the same Rust/WASM core hosted and DIY deployments share.
  • 4 Replays rejected A monotonic counter that fails to advance means a captured link is being re-used — it is refused, not redirected. Genuine taps get a 302.
An illustrated end-to-end EdgeNFC lifecycle. A garment hang-tag carrying an NTAG 424 DNA chip hangs from a product on a cord; a smartphone taps it and an NFC ripple spreads out from the contact point. Provisioning happens once, over ISO-DEP: the Android app derives a per-tag key from the System Master Key and the tag UID using AN10922 AES-128 diversification, installs it with AuthenticateEV2First then ChangeKey, and writes the SUN URL template with SDM mirrors for uid, ctr, and mac. On every tap the NTAG 424 SDM engine emits a dynamic URL of the form https://edgenfc.com/?uid=&ctr=&mac= — the phone screen shows the single-use code changing from A7F3·91C4·5E08 to 2D9B·04E7·C316 to 6B1E·FD52·8A47 while the SDMReadCtr tap counter climbs from 1,247 to 1,249. Verification runs at the Cloudflare edge, near the customer, typically in well under a second: the Rust/WASM core re-derives the per-tag key, verifies the 8-byte AES-CMAC, and checks the monotonic counter against D1 to reject replays. The phone then reveals a green Genuine check — a genuine, counter-advancing tap returns a 302 redirect (or a JSON authentic:true payload), while a forged or replayed tap returns the tap page with a not-verified result.

What you need#

PieceWhat to pick
HardwareNTAG 424 DNA tags — no other chip works. 25 mm PVC tokens to pilot; adhesive wet inlays for production runs into care-label pockets or heat-sealed patches. Where to buy
PlanSandbox (free) to prove the flow; Creator for custom routing to your own "Genuine" page; Brand for a custom verification domain and geo/scan analytics
SoftwareThe Android provisioning app to encode tags, plus the hosted gateway — no code required for a basic genuine-check page

Note

Placement and lamination determine read reliability and wash survival. Test your exact construction (hem pocket vs. heat-sealed patch, wash cycle count) on sample garments before a production run — durability is a hardware/manufacturing question, not a cryptographic one.

Step by step#

  1. Create a system and generate its System Master Key. One system per brand or per drop.
  2. Encode a pilot batch with the provisioning app. Each tag gets its own diversified key and is written into your registry with its UID and key version.
  3. Point the system at your page — a drop page, a rewards portal, or a branded "Genuine" landing page — with custom routing (Creator+). The destination is owner-stored config; it is never read from the tag or the URL, so a forged tap can never be steered anywhere.
  4. Sew or seal the tags in and ship. Nothing on the garment needs to change again — routing is updated server-side, without re-writing hardware.
  5. Watch the taps. Scan counts, the authentic/failed split, and a country breakdown are available on Brand+ as aggregates only (counts, ISO-2 country codes, dates — never a UID or IP).

Verify it worked#

  • Tap a genuine garment: the page opens and the tap verifies authentic, with the counter one higher than the last time.
  • Copy that tap URL out of the address bar and open it again in a new tab: it comes back not authentic with reason: non_monotonic. That is the anti-screenshot property, demonstrated.
  • Hand-edit one character of the mac parameter: not authentic, reason: mac_mismatch, and no redirect to your page.

Known limits#

Warning

Some Android phones need the EdgeNFC app to open the tag. Android 16+ can't NDEF-dispatch NTAG 424 DNA tags — a Google regression — so on those devices a tap may do nothing on its own. The workaround is to scan the tag from inside the EdgeNFC app, which reads and verifies the tag itself. iOS and pre-16 Android read these tags natively. We would rather say this plainly than claim "works on every phone."

Start free#

Create a Sandbox system and provision your first tags today — no card, and the free plan covers a pilot batch.

Start free →