How NFC Chips Work: Types, Frequencies, and Data Limits

What is actually inside an NFC tag?

Every NFC tag contains two components: a passive microchip and a loop antenna. The chip stores your data. The antenna harvests power from your phone's electromagnetic field and broadcasts that data back to the phone. No battery. No charging port. No active electronics at all.

The microchip is an integrated circuit, a tiny slice of silicon containing non-volatile memory (data survives without power), a radio-frequency interface, and security logic that varies by chip type. The entire chip package is typically smaller than 1 mm on a side.

The antenna is a flat spiral coil of conductive material, printed or etched onto a thin substrate. In a card-sized product, the antenna traces around the card's perimeter. In a sticker, it spirals around the chip at the centre. The antenna's geometry determines how efficiently it couples to the reader's field.

Together, the chip and antenna form a self-contained wireless system. The passive design is what makes NFC products last indefinitely. There is nothing to run out of power or wear out mechanically. A well-made NFC sticker installed in 2020 will still work the same way in 2035.

What frequency does NFC use, and why does it matter?

NFC operates at exactly 13.56 MHz in the globally unlicensed ISM radio band. This frequency limits effective read range to approximately 4 cm, which is intentional. It makes accidental reads, eavesdropping, and remote interception essentially impossible in practice.

13.56 MHz was not chosen arbitrarily. The ISM (Industrial, Scientific, and Medical) band is licence-free in every country, which is why an NFC card programmed in Dubai works identically when tapped in London, Tokyo, or New York. No regulatory clearance, no frequency coordination required.

At this frequency, the electromagnetic field generated by a smartphone decays rapidly with distance. Beyond 4 to 5 cm, the field is too weak to power the tag's chip. This is a physical property of the frequency, not an artificial software limit. You cannot extend NFC range by modifying software.

The short range is a security advantage, not a limitation. Contactless payment systems like Apple Pay, Google Pay, and Samsung Pay all use NFC at 13.56 MHz for exactly this reason. A thief cannot read your NFC card from across a room. They would need to physically place a reader within about 4 cm of the card, which is not a realistic attack vector in business settings.

What are the different types of NFC chips?

Commercial NFC products use two main chip families, both manufactured by NXP Semiconductors: NTAG chips for consumer-facing applications (cards, stickers, review stands), and MIFARE chips for access control and payments. Each family has multiple variants with different memory and security profiles.

The NTAG family: NTAG213, NTAG215, and NTAG216

NTAG chips are the standard for business-facing NFC products. They store a URL, text record, or vCard, and when tapped, the phone reads the data and acts on it automatically. No app required on the reader's side.

NTAG213 is the chip in most NFC business cards, Google review stands, and NFC WiFi cards in Dubai. It costs less than the alternatives and handles every common business use case when paired with a redirect URL. NTAG216 appears in premium cards where the client wants the full contact vCard stored directly on the chip, with no redirect service required.

MIFARE chips: for access control and secure payments

MIFARE is a completely different product family, also from NXP but designed for security-first applications. The most important difference: MIFARE chips use encrypted sector data, not open NDEF records. A standard NFC reader cannot read a MIFARE access card. It needs the correct cryptographic keys.

MIFARE Classic (1K or 4K) uses a proprietary 48-bit encryption scheme called CRYPTO1, which was cracked by researchers in 2008. It remains widely deployed in UAE office buildings because the infrastructure exists and the risk is manageable, but new installations increasingly move to MIFARE DESFire.

MIFARE DESFire EV2 and EV3 use AES-128 encryption, the same standard used by banking systems. These are the chips inside modern UAE hotel room keys, transit cards, and corporate security passes. The NFC access cards that SouqNFC supplies for new installations use DESFire.

What is NDEF, and how is data stored on the chip?

NDEF (NFC Data Exchange Format) is the standardised container format that tells your phone what to do with the data it reads. A URL stored in an NDEF URI record causes the phone to open a browser. A vCard payload prompts the Contacts app. A WiFi credential triggers a network join request. The phone knows what to do with each record type natively.

An NDEF message contains one or more NDEF records. Each record includes a type field (URI, TEXT, vCard, WiFi, and so on), a payload length field, and the payload itself. The type tells the phone which app should handle the data. The payload length tells the phone where the record ends. And the payload is the actual URL or contact information.

NDEF adds a small overhead: the type byte, length byte, and framing add 3 to 5 bytes to whatever data you are storing. A URL like “https://go.souqnfc.ae/omar” is 26 bytes of data; with NDEF framing, the total record is about 30 bytes. On an NTAG213 with 144 bytes of user memory, you have 114 bytes left over.

This is why redirect URLs are so useful for NFC cards. Instead of storing your entire digital profile on the chip (which might run to thousands of bytes), you store a short redirect URL (30 bytes or less), and the redirect service sends the user wherever you want. You can update the destination any time without touching the physical card.

How much data can each NFC chip actually hold?

NTAG213 holds 144 bytes, enough for a URL of around 130 characters. NTAG216 holds 888 bytes, enough for a complete vCard contact record. MIFARE DESFire holds up to 32 kilobytes in AES-encrypted files for access and payment applications.

To put 144 bytes in context: a typical short URL is 20 to 30 bytes. A LinkedIn profile URL is around 40 bytes. A WhatsApp API link with a pre-filled message is 60 to 80 bytes. All of these fit easily on an NTAG213.

A full vCard contact record (name, job title, company, email, three phone numbers, website, and LinkedIn) runs between 300 and 700 bytes depending on the length of each field. That fits on an NTAG216 (888 bytes) but not on an NTAG213 (144 bytes).

This is the practical difference between the two chips for a business card. If your card has a single short URL, NTAG213 is more than sufficient and costs less. If you want the card to store and broadcast your complete contact record without any internet connection or redirect service, you need NTAG216.

Which NFC chip should your UAE business care about?

For business cards, review stands, WiFi cards, and table menus, NTAG213 handles most use cases. Choose NTAG216 if you want full vCard storage directly on the chip. For hotel keys, office access systems, and any payment application, MIFARE DESFire EV2 or EV3 is the only choice worth making.

For business cards, stickers, and customer touchpoints

Almost every business use case in this category works fine with NTAG213. Business cards that redirect via a SouqNFC link. NFC table stands that open a Google review page. WiFi cards that join a guest network. Menu cards. Event tags. All NTAG213.

Upgrade to NTAG216 when a client specifically needs the full vCard stored on the chip, typically consultants or executives who present their card at meetings where the recipient may not have internet access to retrieve a redirected profile. In that scenario, a direct vCard on NTAG216 means the contact saves immediately regardless of connectivity.

NFC loyalty cards and NFC wristbands for events typically use NTAG213 linked to a backend web platform, since the loyalty or payment logic lives in the cloud rather than on the chip itself.

For access control and payment applications

If you are implementing door access, hotel room keys, or cashless payments, you are in MIFARE territory. Do not use NTAG chips for these applications. They lack the security model required.

For new installations, specify MIFARE DESFire EV2 as the minimum. MIFARE Classic is still supported by most existing UAE access control readers, but its encryption is outdated. Any system installed in 2024 or later should use DESFire. The cost difference per card is small. The security difference is significant.

Frequently Asked Questions