What is a tag UID, and can it be changed?
The UID is an identifier written into a tag at manufacture, in an area that a standard tag will not let you rewrite. Readers use it to tell one tag from another during selection. Tags whose UID can be rewritten do exist, which is exactly why the UID is not a security credential.
What it is for
Its original job is mundane: when several tags sit in the same field, the reader needs a way to address one of them. The identifier makes that possible, and the anticollision procedure uses it to single out one tag before any real exchange starts.
Everything else people do with it is a repurposing of that mechanism, and some of those repurposings are unwise.
Whether it can be changed
On a standard tag, no. It lives in a factory programmed area that is read only, and no application, no reader and no amount of persistence will alter it.
Tags exist whose identifier block is writable. They are sold openly for testing and for recovering access systems where a card has been lost, and they are the reason the paragraph above is not the end of the story. Their existence is not a secret and it is not exotic.
Why it is not a credential
A great many access systems work by reading the identifier and checking it against a list. It is easy to implement and it feels like identity.
It is not. The identifier is transmitted in the clear to anything that powers the tag, so anyone who can hold a reader near your badge for a moment learns it. And since tags with writable identifiers can be bought, learning it is enough to reproduce it.
A system whose security rests on the identifier is a system where the key is printed on the outside of the lock. It may be adequate for a bicycle shed and it is not adequate for anything else.
The distinction that matters
Reading an identifier proves that something presenting that identifier was in the field. It does not prove the object is genuine, because genuineness requires the tag to demonstrate knowledge of something a copy would not have. That is what authentication does, and the identifier is not authentication.
What to use it for instead
As an index, it is excellent. Tracking which physical tag is on which piece of equipment, distinguishing one tag from another in a batch, correlating a scan with a database row: all of these are legitimate and require no trust in the identifier at all.
The rule that separates good use from bad: it is fine to use the identifier to look something up, and not fine to use it to decide that something is permitted.
Where a deployment genuinely needs to know a tag is genuine, the answer is a chip with cryptographic authentication, and the cost difference is small compared with the cost of discovering the problem later.
Frequently asked questions
How long is a tag UID?
It varies by chip family, with four and seven byte identifiers both common in consumer tags. Any system that assumes a single fixed length will eventually meet a tag that breaks it, so treat the length as variable.
Can two tags have the same UID?
They are meant to be unique within a manufacturer's allocation, and duplicates from reputable sources are rare. Tags with writable identifiers can of course be set to any value, which is another reason not to treat uniqueness as a guarantee.
Does the UID change when I format or rewrite a tag?
No. Formatting and writing affect the content area, not the factory programmed identifier. A tag keeps its identifier for its whole life.
Can I read the UID without an application?
Both platforms expose it to software, and the operating system uses it during selection whether or not anything shows it to you. What varies is which applications choose to display it.