When should you lock a tag, and when should you not?
Default to leaving tags unlocked. The ability to correct a mistake is worth more than the protection in nearly every case. Lock when the tag is in a place a stranger could reach it and the content will never need to change, which usually means a redirect address rather than a destination.
The default is no
Most tags should not be locked, and the reasoning is unglamorous: you will want to change something.
A URL gains a parameter. A phone number changes. A campaign ends. A typo is spotted three weeks in. On an unlocked tag each of these is a one second fix, and on a locked one each is a replacement.
Since the cost of being wrong is asymmetric, the default should be asymmetric too.
What you lose by locking
The ability to correct content, obviously. Also the ability to reformat a tag whose structure gets damaged, which turns a recoverable fault into a dead tag.
And the ability to reuse. Tags removed from a finished deployment are worth keeping and rewriting, unless they were locked, in which case they are worth nothing.
When the answer flips
Three situations, and they share one feature: a stranger can reach the tag.
A tag on a poster, a shelf, a door or a table in a public place. Anyone passing with a phone can rewrite it, and pointing it somewhere else is a genuine and easy form of fraud.
A tag whose content is a credential or an identifier that a system trusts. If your process believes what the tag says, someone changing what it says matters.
A tag in a production run that will be distributed and never seen again. You cannot correct it anyway, so the only question left is whether someone else can.
Locking protects the bytes, not the deployment
A locked tag on a poster can still be covered with a sticker, prised off, or have another tag placed on top of it. Locking removes one attack and leaves the physical ones untouched.
Making locking safe
Write a redirect address on your own domain rather than the final destination. The tag then holds something that never needs to change, so locking costs you nothing and you keep full control of where it leads.
That single practice resolves the tension entirely. Without it, locking a public tag is a bet that you got the content right first time. With it, locking is free.
And verify before locking, always. A locked tag holding a truncated write is the worst outcome available here, and it takes one read to avoid.
Frequently asked questions
Should I lock my personal tags at home?
No. There is no substitution risk on a tag beside your bed, and you will want to change what it does more often than you expect.
Should I lock business cards?
Not if they hold your details directly, since those change. If they hold a redirect address you control, locking is harmless and adds a little tamper resistance.
Does locking help against cloning?
No. Anyone can read a locked tag and write the same content to a blank one. Locking prevents modification of that tag, not duplication of its content.
Can I lock later, after testing?
Yes, and that is the right sequence. Deploy unlocked, confirm everything works in the field, then lock if the situation warrants it.