NFC Crypto Cards Explained: How Tap-to-Authenticate Works

An NFC crypto card is a battery-free contactless card you tap against a phone to interact with a crypto wallet, running over the same 13.56 MHz, ISO/IEC 14443 proximity-card handshake as a contactless payment card. The phrase covers two very different designs: key-storage cold cards, whose secure element holds your private keys and signs transactions offline, and tap-to-authenticate companions, which hold no keys and simply prove you are physically present. Tap-to-authenticate works by possession rather than custody — the reader's field powers the chip, the card answers over an encrypted exchange with its unique ID, and that tap confirms an action your wallet app has already prepared. The WATS NFC Metal Card is the second kind: it stores no private keys, pairs to exactly one device, and confirms actions inside the non-custodial WATS apps where the keys actually live — closer to a physical security key than to a cold-storage vault.

An NFC crypto card is a contactless card you tap against your phone to interact with a crypto wallet, but the term hides two completely different designs. Some NFC cards are cold key-storage devices: a secure element inside the card holds your private keys and signs transactions offline, so the card itself is the wallet. Others are tap-to-authenticate companions: they hold no keys at all and instead act as a physical factor that confirms you are present before an action your wallet has already prepared goes through. Both use the same short-range radio handshake, but they protect different things and fail in different ways. Knowing which type you are holding is the whole game.

How NFC works

NFC — Near Field Communication — is a short-range subset of the older RFID family. NFC crypto cards, like transit passes and contactless payment cards, operate at 13.56 MHz and follow the ISO/IEC 14443 standard for proximity cards. The card has no battery. When you bring it within a couple of centimetres of an NFC reader — your phone — the reader's coil emits a small electromagnetic field, and that field induces just enough current in the card's antenna to wake the chip. The card powers itself from the reader for the half-second it needs to talk.

Once powered, the two devices run a short contactless handshake: the reader requests, the card responds, and a brief back-and-forth establishes what the card is and what it can do. On a well-built crypto card this exchange is wrapped in encryption — commonly AES — so a casual eavesdropper cannot simply record the conversation and replay it later. The exact contents of that handshake are where the two card philosophies diverge, but the radio mechanics are identical for both.

The most underrated security property of NFC is its range. Because the card is passively powered by the reader's field, it only functions when it is almost touching the phone — typically under 4 cm. There is no broadcasting across a room, no tapping from a stranger's pocket at normal distance. The physics that make NFC convenient also make remote, drive-by reading impractical. Range is not a substitute for cryptography, but it is a genuine, free layer of defence: an attacker generally has to get the card physically against a reader to do anything with it at all.

Two kinds of NFC crypto cards

Here is the distinction that almost every buyer gets wrong, because the cards look identical from the outside. The same brushed-metal rectangle can be either of two fundamentally different security tools.

• Key-storage cold cards. The private keys live inside the card, in a hardened chip, and the card signs transactions internally. The card is your wallet. Tapping it is how you sign.
• Tap-to-authenticate companions. The card holds no keys. Your keys live in software (a phone app or browser extension) or in a separate device. The card is a physical factor — a tangible "yes, I am here" that gates access or confirms an action. Tapping it proves possession, not key custody. The WATS NFC Metal Card is this type.

Neither design is universally better. They answer different questions. A cold card answers "how do I keep my signing keys off any internet-connected device?" A tap-to-authenticate companion answers "how do I add a physical second factor to a wallet I still want to use freely on my phone?" Confusing the two leads to the most dangerous mistakes in this space — treating a companion card as if it were a vault, or treating a cold card as casually as a transit pass. The table below lays the split bare.

Property	Key-storage cold card	Tap-to-authenticate companion (e.g. WATS)
Holds private keys?	Yes, in a secure element	No — keys live elsewhere
Signs transactions?	Yes, internally and offline	No — it authenticates an action
Works on its own?	It is the wallet (with an app to relay)	No — needs the paired wallet app
If lost or stolen	Risk depends on PIN/seed protection	Inert metal on its own; no keys to steal
Main job	Keep signing keys offline	Add a physical presence factor

Key-storage cold cards

A key-storage NFC card is a hardware wallet in card form. The defining component is a secure element — a tamper-resistant chip, similar to the one in a passport or a SIM, designed so that the private key generated inside it can never be exported in plaintext. You initiate a transaction in a companion app, the app sends the unsigned transaction to the card over NFC, the secure element signs it internally, and only the finished signature comes back out. The key never touches your phone, never touches the internet, and never leaves the silicon it was born in.

That is a strong model, and it is why this category exists. The trade-offs are the usual cold-storage ones. Backup and recovery have to be handled deliberately — either through a seed phrase you record, or through a multi-card scheme where several cards share the ability to recover an account. Losing the card without a backup can mean losing the funds, exactly as with any hardware wallet. And the security ultimately rests on the integrity of the secure element and its certification: you are trusting that the chip does what its manufacturer claims and resists physical extraction attacks. For people whose threat model is "keep my signing keys off every connected device," a properly certified cold card is a serious tool — and that is worth saying plainly even though it is not the design WATS ships. For the broader pros and cons of metal hardware in general, this piece on whether metal crypto wallets are worth it weighs the category honestly.

Tap-to-authenticate companions

A tap-to-authenticate card flips the question. Instead of moving your keys onto the card, it leaves them where they already are — in a non-custodial wallet app — and adds the card as a physical factor layered on top. The tap does not sign with a key inside the card. It proves you physically possess the card at the moment of an action you have already started in the app, the same way a hardware security key proves possession when you log into a sensitive website.

The appeal is everyday usability. You keep the fluid experience of a phone wallet — open the app, unlock with Face ID or a fingerprint, do what you came to do — and the card adds a tangible confirmation step that a remote attacker simply cannot reproduce, because they do not have the metal in their hand. Phishing a password or even tricking a biometric prompt does not conjure the physical card against the reader.

The honesty this model demands is about scope. A companion card protects the front door — access and confirmation. It does not, by itself, guard a signing key, because there is no signing key in it to guard. Its security therefore depends on the wallet it is paired with: the card is one factor in a larger design, not a self-contained vault. Anyone who tells you a keyless companion card is "cold storage" is selling you a category error. Used for what it is, though, it is a clean, low-friction way to bolt a physical factor onto a wallet you use every day.

What the WATS card is

The WATS NFC Metal Card is squarely the tap-to-authenticate type. It is a physical factor for your WATS wallet, and it does not store your private keys and is not cold storage. Your keys stay in the fully non-custodial WATS apps — the mobile app and the Chrome extension — and the card's job is to authenticate access and enable NFC tap-to-sign: you bring the card to your phone, the app reads it, and that tap becomes a tangible confirmation for an action you already initiated. WATS never holds a key; you do.

Two behavioural details matter as much as the chip. Each card carries a unique card ID, and the first time you tap it to your phone in the WATS mobile app it pairs to exactly one device — from then on it authenticates only with that paired phone. That one-card-one-device binding is what makes a stray card useless to whoever finds it. The card sits alongside the other three WATS products — the Chrome extension, the mobile app and the WATS Hot Wallet — and the wallet it authenticates spans Ethereum, Arbitrum, Optimism, Base, Polygon, BNB Chain, Solana and TON.

On the hardware side it is built to be carried and abused. The specifics:

• Chip: NTAG 216, a secured NFC tag — not a private-key vault.
• Handshake security: AES-128 encryption over the contactless exchange.
• Standard / frequency: ISO/IEC 14443 at 13.56 MHz, the same proximity-card stack described above.
• Durability: IP68 waterproof (submersible 1.5 m for 30 minutes) and MIL-STD-810 tolerances across -40 °C to +85 °C.
• Form: CR-80 card size (85.6 x 53.98 x 0.84 mm), around 22 g in brushed 316L stainless steel or about 5 g in polycarbonate.

One nuance worth stating directly: the AES-128 here protects the handshake, the authentication exchange, rather than guarding a secret signing key etched into a certified secure element. WATS describes the card accurately as a secured NFC authentication tag, not as a tamper-proof key vault, because that is what it is. It complements a non-custodial model in which you alone hold your keys and your seed phrase — it is an additional layer, not a replacement. The biometric unlock proves it is you on the device; the card tap proves you physically hold the paired companion; and your self-custodied keys stay under your sole control the whole time. The card strengthens the front door; your keys never leave your hands. For a deeper walk through the chip and the loss scenario, see how the WATS NFC metal card security model works.

Strengths and limits

Being fair about a tap-to-authenticate card means naming both sides.

What it does well. It adds a genuine physical factor that defeats purely remote attacks. Short NFC range means it cannot be read across a room. Because it holds no keys and pairs to a single device, losing it is an inconvenience rather than a catastrophe — a found card, in isolation, is inert metal that cannot sign anything or move funds on its own. And the metal build means it survives water, heat, cold and the bottom of a bag far better than a paper note or a plastic card.

What it does not do. It is not cold storage and never claims to be. It does not keep a signing key offline, because the key is not on it. It does not, on its own, protect against a fully compromised phone where an attacker controls the wallet app and is present to tap the card — a companion factor raises the bar but is not absolute. And it depends on the security of the wallet it is paired with; it is one layer in a stack, judged by the stack as a whole. A key-storage cold card makes the opposite trade: stronger key isolation, but loss and backup become higher-stakes, and you carry something that genuinely is your wallet. Choose by your threat model, not by which card feels heaviest. For the two designs laid side by side, this roundup of the best Web3 wallets with an NFC metal card compares them without pretending one wins for everyone.

Bottom line

"NFC crypto card" is one phrase for two different tools that happen to share a radio. Both rely on the same 13.56 MHz, ISO/IEC 14443 contactless handshake, and both benefit from short range as a free security property. But a key-storage cold card holds your keys in a secure element and signs offline, while a tap-to-authenticate companion holds no keys and simply proves you are physically present. Pick the design that matches what you actually need to protect, and never let a card's weight convince you it is something it is not.

If the design you want is the second one — a durable physical factor on top of keys you still control yourself — the WATS NFC Metal Card is the concrete way to do it: download the WATS app, set up your non-custodial wallet, then tap the card once to pair it to that phone. From there, every tap is a physical confirmation, and the keys never leave your side of the equation.