Can a tag be protected from being read?
On chips that support it, a password can be configured to guard reading as well as writing. It is available less often than write protection and wanted less often than people think, because a tag that refuses to be read does nothing at all when tapped.
What is possible
On chip families offering password protection, the access configuration usually chooses between protecting writes only and protecting both reads and writes. Selecting the second means a reader without the key gets nothing.
Availability is narrower than write protection. Plenty of common tags support a password for writing and offer no read protection at all, so this must be confirmed against the chip reference before it becomes part of a design.
What it costs
Everything that makes a tag useful to strangers, which is usually the entire point of having one.
A read protected tag tapped by an ordinary phone produces nothing. No banner, no browser, no content, and no explanation. To the person tapping it is indistinguishable from a broken tag or an empty one.
It also excludes the operating system, which is what handles most taps. Only software holding the key can reach the content, which means only your own application, which means the person must already have installed it.
When you actually want it
Closed systems where every reader is yours and no member of the public is expected to tap anything. Asset tags carrying internal data, industrial deployments with dedicated handhelds, staff equipment.
Situations where the content itself is confidential rather than merely authoritative. A serial number is not confidential. A key, a personal detail or a commercial term might be.
What these share is that nobody outside the system is meant to get anything from the tag, so producing nothing is the correct behaviour rather than a failure.
What to do instead
For most cases where read protection feels appealing, the better answer is to put nothing sensitive on the tag.
Store an opaque identifier and keep the sensitive data on a server, where access control is real, revocable and auditable. The tag becomes a pointer that reveals nothing to whoever reads it, and the protection lives somewhere designed for protection.
That approach also survives the tag being lost, cloned or read by someone unexpected, none of which a chip password does anything about once the key is out.
The rule worth remembering
A tag password is an access rule enforced by a cheap chip, not encryption. Treat it as an obstacle to casual reading, and never as the thing standing between a secret and the world.
Frequently asked questions
Do common consumer tags support read protection?
Some do and many do not, so it has to be checked against the specific chip. Write protection is far more widely available than read protection.
Will a read protected tag show anything at all?
The tag is still detected and its identifier is still visible, since selection happens before any protected memory is touched. The content is what stays hidden.
Is the content encrypted?
No. It is stored normally and the chip declines to hand it over without the key. Anyone able to bypass the access rule reads plain content, which is why it is not a substitute for keeping secrets elsewhere.
Can I read protect part of a tag only?
The protection starts from a configured page and covers everything after it, so a layout can leave an unprotected header readable while guarding the rest.