CCNY CYBERSECURITY CLUB / TAG SETUP
You picked up a blank NFC sticker from us. Right now it does nothing. Ten minutes from now it can join your WiFi, open your LinkedIn, start your study playlist, or fire off a text saying you're on your way. Here's how.
An NFC tag is a tiny chip and antenna with no battery. When you hold a phone within a couple of centimetres, the phone's radio powers the chip and reads the few hundred bytes stored on it. Those bytes are an NDEF record — usually a URL, some text, or a WiFi credential.
The tag doesn't run code. It hands your phone a piece of data, and your phone decides what to do with it. That distinction matters: a tag can't install anything or take over your device, but it can send you to a link you didn't expect. Which is a decent first security lesson — don't tap tags you find in the wild.
Settings → Connected devices → Connection preferences → NFC. Some phones put it under Settings → Connections. If there's no NFC entry at all, your phone doesn't have the hardware — skip to the iPhone note below, it applies to you too.
Free on the Play Store, published by wakdev. It's the standard tool for this and it doesn't need an account.
Open the READ tab and hold the tag against the back of your phone, near the top. You'll see the chip type and how many bytes it holds. Do this before writing — it tells you the tag works and where your phone's antenna is.
WRITE tab → Add a record → pick a type (URL, Wi-Fi network, Text, Contact, and so on) → fill it in → Write. Hold the tag to the phone until it confirms. That's it — the tag now works on any NFC phone, including ones that have never seen your app.
Close the app and tap the tag with your phone unlocked. It should fire. NFC Tools has a Lock tag option under Other — this is permanent and cannot be undone. Leave it unlocked until you're certain, then only lock it if you're handing the tag to someone else.
iPhone 7 and newer can read tags; iPhone 7 through XR need an app open to do it, while XS and newer read them in the background whenever the screen is on. Writing works on iPhone 7 and newer with an app.
Same app, same developer, free on the App Store. There's no NFC toggle to flip on iOS — it's always available to apps that ask.
Write → Add a record → choose your type → Write / Ready to scan → hold the top edge of the phone against the tag. The iPhone antenna is at the top, not the middle.
Shortcuts app → Automation → New → NFC → Scan your tag → then attach any shortcut: turn on Do Not Disturb, set an alarm, open an app, text someone, start a Focus. Turn off "Ask Before Running." This is far more powerful than a plain URL, because the tag stays blank and your phone recognises it by its chip ID.
Trade-off: a Shortcuts automation only works on your phone. A written URL works on everyone's.
Roughly ordered from "useful this afternoon" to "actual side project."
Write a Wi-Fi record with your network name and password. Guests tap it and connect — you never read your password out loud again.
Point it at your LinkedIn or a digital business card. At career fairs you tap someone's phone instead of hunting for a pen.
iOS Shortcut or Android Tasker: tap on arrival to enable Do Not Disturb, start a 50-minute timer and open your notes app.
Tap when you get in: Bluetooth on, Maps to campus, driving Focus, playlist rolling. One tap replaces five taps.
Tap on your way out to text your roommate "heading to campus." Genuinely useful, mildly cursed.
Stick tags on gear and point each at the manual, the reservation sheet, or the setup instructions for that machine.
A tag at the door pointing at a Google Form. Attendance tracked without a clipboard. We're doing exactly this.
Encode a hint, a base64 blob, or the first step of a puzzle chain. Hide tags around a room and make people walk the chain. Bring it to a club meeting.
Dump the bytes with NFC Tools' advanced view and parse the record structure by hand. Then write a record manually and see what your phone does with a malformed one. That's the real project.
Move the tag around slowly — antennas are small and in different places on every phone (top edge on iPhone, upper-middle on most Android). Screen must be on and unlocked.
Metal kills NFC. A tag stuck directly on a laptop lid, a metal desk, or under a metal phone case will read intermittently or not at all. Move it to plastic, glass or wood.
Most cheap tags are NTAG213 with about 137 usable bytes. A long URL plus a text record won't fit. Shorten the URL or write one record instead of two.
It's read-only forever now. Come to a meeting and we'll give you another one.
Post it in the Discord. If it's good we'll run a workshop on it, and you'll be the one teaching it.