Does password protection authenticate anything?
No. A password gates an operation on the chip, usually writing and occasionally reading. Authentication answers a different question entirely: is this the tag I deployed. A password protected tag can be read, its content written to a blank, and the copy will carry no password at all.
What a password does
It gates an operation. On most chips that means writing: the tag refuses to accept new content unless the password is presented.
On some chips it can also gate reading, which is a different and less common arrangement with real consequences for how the tag behaves in the field.
Either way it is a permission on this tag, checked by this tag, about what may be done to this tag.
What it does not do
It does not travel with a copy. A copy is made by reading the content, and the copy is a fresh tag with no password on it.
It does not prove the tag is yours. The verifier at the far end has no way of knowing whether a password was ever set, because a tag that reads normally reads normally either way.
It does not protect the content from being read, unless you specifically bought and configured read protection, and that has its own consequences.
And it does not survive a lost password, which is the failure that ends more deployments than any attack.
Why the confusion is common
Because a password feels like a credential, and because suppliers describe password protected chips as secure without saying against what.
Because both words describe a defence, and because the difference between preventing a change and proving an identity is not obvious until somebody states it.
And because the two are often needed together, so a deployment that has one is easily assumed to have both.
The test is a single question: after somebody copies the tag, does the password help. It does not, in any arrangement.
Using it for what it is
Set a password where a tag is reachable by the public and being rewritten would matter. That is a real risk and this is the tool for it.
Take NFC Tools. On iOS it requires an iPhone 7 or later running iOS 15.6 or later, and the app must be launched manually. Background reading is available from the iPhone XS and XR onwards.
Record the password somewhere durable and shared, because a password known only to whoever ran the encoding session is a password the organisation does not have.
And where the question is whether a tag is genuine, buy authentication instead, because no password arrangement answers it.
Frequently asked questions
Does a password stop copying?
No. Copying is reading, and the copy is a new tag carrying no password.
Does it prove the tag is mine?
No. A reader cannot tell whether a password was ever set, because the tag reads normally either way.
When should I set one?
When the tag is publicly reachable and being rewritten would matter. That is the risk it addresses.
What if the password is lost?
The tag usually cannot be rewritten again. Losing it ends more deployments than any attack does.