Why is a plain NFC tag not an access credential?
Because it asserts rather than proves. Everything a plain tag holds is public, including its identifier, so presenting one only demonstrates possession of a number that anybody standing close could have read for themselves. A credential has to survive being observed.
What a credential must do
Resist reproduction. Someone who observes it must not thereby be able to present it. A tag fails this, because reading it is observing it completely.
Be revocable. Withdrawing it must be immediate and central. That is a property of the system rather than of the object, and it is the one a tag can borrow.
Have provenance. The system must know where each one came from. Tags bought in a packet and written with a phone have none.
A plain tag manages one of the three, and only by leaning on the system.
The identifier is not a secret
Every tag carries an identifier, and it is returned to any reader that asks, before any content is exchanged. It is how the reader addresses the tag.
So an identifier is a name, not a password. Treating it as a secret means treating something the tag announces to everyone as though it were private.
This matters because identifiers feel secret. They are long, they look like keys, and nobody publishes them. None of that makes them confidential.
The test is simple: could someone who stood next to the holder obtain it? For an identifier, yes, with an ordinary phone and no interaction.
Systems that authorise on a number
Some installations read a tag, compare the identifier against a list, and open the door. This is easy to build, cheap, and it is authorisation on a public value.
It is common in small deployments, in retrofits, and in projects where an integrator was asked for something inexpensive.
If you have one, know that you have one. The risk may be acceptable for a stationery cupboard and is not for a server room.
The honest way to describe such a system is that it identifies rather than authenticates. That distinction is the whole subject.
What to use instead
Cards built for access, which authenticate cryptographically: the reader poses a challenge and the card answers in a way only a card holding the right key could.
The key never crosses the interface, so observing the exchange does not let an observer repeat it later.
That capability is a property of the chip and cannot be added to a tag afterwards, which makes it a specification decision rather than a configuration one.
And it still needs the system around it: issuance, revocation, and a record of which card belongs to whom.
Frequently asked questions
Is the tag identifier a password?
No. It is announced to any reader before anything else, so it is a name rather than a secret.
Can I write a secret onto a tag instead?
Anything written to a readable tag is readable. Content protection changes who may write, not who may read.
Are UID based access systems common?
They exist, particularly in small or retrofitted installations. Knowing whether yours is one is worth establishing.
What makes an access card different?
It proves it holds a key without revealing it, so observing the exchange does not let anyone repeat it.