NFC vs RFID vs QR codes: which fits a product?

NFC tags, RFID tags and QR codes are three ways to give a physical product a link to data. NFC and RFID tags are small radio tags with no battery, powered by the device that reads them. A QR code is a printed pattern that a camera reads. The difference that decides most choices is who can read each one, from how far away, and whether a copy of it passes for the original.

One note on terms. Strictly, NFC is a kind of RFID, since both identify an object by radio. This page uses NFC for the high-frequency tags a phone reads with a tap, and RFID for the ultra-high-frequency (UHF) tags built for readers in warehouses and stores. The comparison below follows that split.

Near Field Communication runs at 13.56 MHz, and the NFC Forum gives a typical range of up to 2 cm. NFC Forum devices, phones among them, can communicate with ISO/IEC 14443 contactless cards and tags, so any phone with NFC reads a tag of that kind. In use, the reader is a phone held against the product.¹

The short range is the point. A tap is a deliberate act by someone holding the item, which suits a customer checking a product, opening its certificate or registering ownership. Secure NFC tags can also prove the item: each tap produces a fresh code, computed with a secret key that stays in the tag, which a server checks.

UHF RFID runs between 860 MHz and 960 MHz under GS1's Electronic Product Code (EPC) Gen2 air-interface standard. Its tags are passive: the standard says they take all of their operating energy from the reader's radio signal. The RAIN Alliance describes read ranges from a few centimeters to several meters, and reading of up to 1,000 items per second.^2,3

That range is built for counting, not for a customer. A reader can take stock of a rail of garments or a pallet of cases without opening a box. A phone's NFC radio works at 13.56 MHz, so it does not read a UHF tag: that takes a dedicated reader. A plain UHF tag answers with identifiers stored in it: the Gen2 standard sets out one memory bank for the item's Electronic Product Code (EPC) and another for information about the tag itself.^2,1

Cryptographic UHF tags exist too. The Gen2 standard includes Challenge and Authenticate commands, so a tag can support one or more cryptographic suites, which ISO/IEC 29167 defines, and answer a reader's challenge with proof that it is genuine.²

A QR code is a two-dimensional barcode, approved as the international standard ISO/IEC 18004 in June 2000, according to DENSO WAVE, which made the specification public. It costs no more than the printing, and any phone camera reads it, which makes it the widest-reaching of the three.⁵

It is also copyable by nature. A QR code is the same on every unit and every scan, so a photo, a photocopy or a reprint on a fake is an exact copy, and it opens the same page. That makes a QR code good at pointing someone somewhere and unable to prove that the thing it is printed on is genuine.

The comparison hides a second axis. How far away a code can be read is one choice; whether a read proves the item is another. A QR code and a plain NFC tag both point to a page and prove nothing. A UHF tag reads at a distance but, in its plain form, also only identifies. Proof comes from cryptography in the tag, and it exists at both ranges: secure NFC tags for a tap, and UHF tags that answer the Gen2 standard's cryptographic challenge for a reader.²

The right choice follows from what happens after the read. A phone that taps an NFC tag reads the standard record stored on it, called NFC Data Exchange Format (NDEF), and acts on it: for a web link, the NFC Forum describes the phone showing a dialog that confirms the URL. On Android, the documentation describes two behaviors: version 16 opens a web link from a tag directly, and version 17 first shows an "open link" notification to tap.^1,4

A QR code needs the person to open the camera, frame the code and then follow the link, so it asks for more effort and works from further away. A UHF read usually ends in no screen at all: the reader passes the tag's number to a stock or shipping system, and nobody holding the item sees anything. That is why UHF suits the warehouse and the store's back room, NFC and QR codes suit the customer, and the jobs divide like this.

In apparel, where stock is counted by the rail, one tag in the care label that reads both ways can serve the customer and the stockroom alike. In wine and spirits, and in perfume, the bottle or the closure carries the tag, because a carton can be thrown away, and the carton can carry a QR code that tells the buyer to tap.

The phrase NFC QR code describes a label that carries both: a printed QR code and an NFC tag on the same sticker or tag. It is a sensible pairing when each half does its own job. The QR code reaches anyone with a camera and can tell them what to do. The NFC tag, if it is a secure one, is what proves the item. Treat the QR code as the printed add-on, never as the proof, because the printed half is the half a counterfeiter can copy with a photo.

Vera tags are read with a phone tap, and a tap opens the item's certificate in the phone's own browser, with nothing to install. Every tap computes a fresh encrypted code with a key held inside the tag, so a forwarded link or a screenshot opens the certificate without the verified state. That is the difference from a printed QR code or label, which is the same on every unit and every scan.

For products that also move through warehouses, Vera's Verify + Trace tag adds RFID. The same tag reads at up to about six meters with an RFID reader and by phone in a customer's hand, so a product does not need a second tag for the warehouse. Tags come in the forms each category needs, including care labels and woven labels for apparel.

• Who needs to read it: a customer with a phone, a warehouse with readers, or both?
• Does a read need to prove the item, or only point to information?
• What happens when someone photographs or copies it? If the copy works, it is a link, not proof.
• Will one item need two tags, one for the customer and one for the stockroom, or can one tag do both?
• Where does the printed code go, and what does it tell the person scanning it to do next?