Is data encrypted on NFC business cards?
Data stored on an NFC business card chip is not encrypted — it's a plain-text URL readable by any NFC device. The profile page the URL loads uses HTTPS, which encrypts the connection between the phone and the server. The chip itself is intentionally open and readable.
The chip: plain text by design
NFC business card chips store data in NDEF format — an open standard. The URL or contact info is stored as readable text, not encrypted. This is by design: the chip needs to be readable by any standard NFC phone without authentication. Encrypting the chip would require a reader app with the decryption key, defeating the 'no app required' benefit.
The profile: HTTPS encrypted
When the phone opens the URL from the chip, the connection to the profile server uses HTTPS (TLS encryption). This protects data transmitted between the phone and server from interception. The profile page content itself is public (that's the point), but any form submissions (like a lead capture form) are sent over encrypted HTTPS.
What's worth encrypting and what isn't
The chip stores a public URL — there's nothing to gain from encrypting it. Your profile content is intentionally public — you're sharing it with anyone who taps. Any private interaction (form submissions, analytics data) happens over HTTPS on the server side. The security model is appropriate for the use case: public contact sharing doesn't require end-to-end encryption.
Can someone intercept my NFC signal and read the chip data?
Theoretically yes, with specialized equipment within a few centimeters. In practice, they'd get a public URL — the same thing printed on the QR code.
Is my personal data safe on the profile server?
This depends on the platform. Reputable platforms use HTTPS, have privacy policies, and don't sell your data. Read the privacy policy before choosing a provider.
Can I put sensitive information on my NFC card profile?
Only if you're comfortable with it being publicly accessible. Profile pages are publicly viewable URLs — treat them the same way you'd treat any public web page.