Lock Bits

Lock Bits

Lock bits are special OTP (one-time programmable) memory bits in NFC tags that control read/write access to specific memory blocks. When a lock bit is set to 1, the corresponding memory block or group of blocks becomes permanently read-only. Because lock bits are OTP, this protection is irreversible — once set, the data in the locked pages cannot be modified by any reader, regardless of authentication.

Static vs Dynamic Lock Bits

NFC Forum Type 2 tags (NTAG and MIFARE Ultralight families) implement two layers of lock bits:

Static lock bits (page 2, bytes 2-3 in NTAG 21x): - Control write access to pages 3 through 15 (the first 52 bytes of addressable memory). - Each bit protects a specific page or group of pages. - Bit 0 of byte 2 locks page 3 (capability container). Bits 1-7 and bits 0-7 of byte 3 lock pages 4-15. - Setting the CC lock bit is common practice after writing the final NDEF configuration.

Dynamic lock bits (located after user memory): - Control write access to the remaining user memory pages (page 16 onward). - Each dynamic lock bit typically protects a group of pages (the group size depends on the chip model). - For NTAG 216, the dynamic lock bytes are at pages 226-227, covering pages 16-225.

Lock Bit Behavior

Practical Usage

Lock bits are typically set during the final stage of tag provisioning in manufacturing:

1. Write the NDEF message to user memory.
2. Configure password protection if applicable.
3. Set static lock bits to protect the capability container.
4. Set dynamic lock bits to protect the NDEF data area.

After locking, the tag becomes a read-only data carrier. This is standard practice for NFC tags deployed in products, packaging, and signage where the data should never be modified in the field.

Comparison with Password Protection

Lock bits and password protection serve different purposes. Lock bits provide absolute, permanent write protection. Password protection provides conditional access control — the data can still be written by a reader that knows the 32-bit password. For maximum security, both mechanisms can be combined: password-protect the tag during provisioning (for potential firmware updates), then set lock bits only when the tag is finalized for deployment.