How it works · Tap to DPP

Tap the product. The passport opens.

One tap. No app install. A GS1 Digital Link URI, resolved to the unit's Digital Product Passport.

A Digital Product Passport is only useful if someone can actually open it — standing in a shop, on a loading dock, or at a customs desk. Aeroz makes that a single gesture against the product itself, and makes the chip that answers hard to duplicate. Here is exactly what happens, step by step.

Book a walkthrough → See the URI anatomy
GS1 Digital LinkEPCIS 2.0NFC Forum NDEFISO/IEC 15693ESPR 2024/1781EN 18220:2026
The sequence

Five steps, about one second.

Step through it below. This is an illustration of the flow — the timings are the design targets the system is built against.

  1. Tap0 ms

    The phone's NFC reader energises the passive chip through the label, the fabric or the packaging. There is no battery in the tag and nothing to pair — the chip runs on power drawn from the reader's own field.

  2. Read~100 ms

    The chip returns a GS1 Digital Link URI: a plain web address carrying the product's GTIN and that unit's serial number. Alongside it comes a value that is different on every single read.

  3. Resolve~250 ms

    The default browser opens the URI. A GS1 Digital Link resolver maps that unit's identity to the right passport for the market the phone is standing in — the same tag can answer differently in Milan and in Dubai.

  4. Verify~350 ms

    The per-tap value is checked against the sequence expected for that serial. A response copied from a genuine unit has already been used, so it fails. This is the step a printed code cannot perform.

  5. Render~400 ms

    The passport appears: identity, materials, documents, custody. A shopper sees care and repair. An inspector sees compliance and chain of custody. Nobody installs anything.

What the tag actually says

The whole thing is a web address.

That is the design decision that makes a tap work without an app. The chip does not hold the passport — it holds a pointer to it, in a format any browser already understands.

https://id.brand.example/01/09506000134352/21/AZ-4417-9930K

The resolver host

Owned by the brand, not by us. It decides which passport a given unit resolves to, and can answer differently by market, language or viewer.

/01/ the GTIN

GS1 Application Identifier 01 introduces the Global Trade Item Number — what the product is. Every unit of this SKU shares it.

/21/ the serial

AI 21 introduces the serial number — which unit this is. This is the difference between a passport for a product line and a passport for the item in your hand.

Aeroz builds to GS1 Digital Link and EPCIS 2.0. Aeroz is a member of INCITS, the US Technical Advisory Group to ISO/IEC JTC 5. Membership of a standards body is participation, not endorsement or certification — no standards organisation certifies or endorses Aeroz.

Tap vs printed code

Both open the passport. Only one resists a copy.

This is not an argument against QR codes. A QR code is cheap, universal, and required reading for any passport programme. It is an argument about what a data carrier can and cannot prove on its own.

 Printed 2D codeAeroz dual-frequency chip
Opens the passport with no appYes — cameraYes — tap
Carries a GS1 Digital Link URIYesYes
Unit-level serialYes, if serialisedYes
Response changes on every readNo — it is a static imageYes
Survives being photographed and reprintedA photocopy scans identicallyA captured response fails on reuse
Readable through packaging or fabricNeeds line of sightReads through most non-metal materials
Bulk read across a palletOne at a timeUHF reads many units at range
Tamper evidence on removalPeel and reapplyDestructive-open constructions available

Read together, not instead of each other. Aeroz pairs a GS1 2D code with the chip, so the passport opens for anyone with a camera while the chip carries the part a picture cannot: evidence that this specific object is the one the record describes.

Why the anchor is a separate problem

Records prove the claim. The anchor proves the object.

A passport is a claim about a thing

Every field in a Digital Product Passport — origin, fibre, carbon, repairability — is an assertion about a specific physical object. Data integrity controls protect the assertion. They say nothing about whether the object presenting it is the object it was written for.

Counterfeiters copy carriers, not databases

The realistic attack on a passport programme is not breaching the record. It is putting a perfect copy of a legitimate carrier on an illegitimate product, so a genuine passport renders over counterfeit goods and reassures the buyer.

Which is why binding is physical

Aeroz binds unit identity to the passport at the chip, so the link between record and object is checked at the moment of reading — in a shop aisle, at goods-in, at a border — by anyone with a phone and no prior relationship with the brand.

One tap, three answers

The same gesture, filtered to the viewer.

A passport that shows everyone everything is either useless to a shopper or dangerous to a brand. Resolution is where entitlement is applied.

The shopper

Authenticity, materials, care, repair and resale. The reason they tap a second time is that something useful happened the first time — which is what turns a compliance obligation into a channel the brand owns.

The inspector

Declarations, conformity documents, substances of concern, and the custody trail behind them, as EPCIS 2.0 events with an append-only log. Verifiable at the point of inspection rather than requested by email weeks later.

The brand

Where units are being tapped, by how many distinct devices, and where verification is failing. Failed checks clustered in one region are the earliest counterfeit signal most brands will ever get.

See it on your own product

Bring one SKU. We'll tap it.

A walkthrough on a real unit of yours — the tag in your label, the passport your customer opens, and the verification result an inspector would see. Then a fixed-fee readiness audit if it's worth going further.

Book a walkthrough → EU Digital Product Passport →
Fixed fee 14-day written report No commitment to proceed

What the walkthrough covers

  • Carrier placement for your material — fabric, glass, metal, carton.
  • GS1 Digital Link mapping from your GTIN and serial scheme.
  • The three views — shopper, inspector, brand — on your data.
  • Failure modes — what a cloned carrier looks like when it fails.
  • Line impact — where application sits in your existing process.
FAQ

Tap to DPP, answered.

What does tap to DPP mean?

Tap to DPP means opening a product's Digital Product Passport by touching an NFC-capable phone to the product itself. The chip returns a GS1 Digital Link URI, the phone's browser resolves it, and the passport renders — typically in under a second, with no application install.

Do I need an app to read a Digital Product Passport?

No. NFC tag reading is built into current iPhone and Android operating systems. The tag returns a standard web URL, so the default browser opens it like any other link. Requiring an app install is a common reason consumer-facing passport programmes go unused.

How is a tap different from scanning a QR code?

A printed QR code is an image, so anything that can photograph and reprint it reproduces it perfectly. A tap reads a chip whose response changes on every read, so a captured response cannot be replayed. Both can carry the same GS1 Digital Link URI; only one of them is difficult to copy.

What is a GS1 Digital Link URI?

A web address that carries GS1 identifiers in its path. A serialised example takes the form https://example.com/01/09506000134352/21/ABC123, where 01 introduces the GTIN identifying the product and 21 introduces the serial number identifying the individual unit. Because it is an ordinary URL, a browser opens it directly.

Does the EU Digital Product Passport require NFC?

No. ESPR Reg. (EU) 2024/1781 requires a data carrier linking to the passport but does not mandate a single technology. EN 18220:2026, the published European standard for DPP data carriers, permits optical 2D codes such as QR and Data Matrix as well as RFID tags and NFC chips.

What stops someone copying the chip?

The chip's response is not a fixed value. Each read produces a value that must fall in the expected sequence for that specific serial, so a value captured from a genuine unit fails when presented again. Detecting a duplicated carrier is a different problem from detecting a duplicated code.

How long does a tap take?

The chip read completes in roughly 100 milliseconds. Resolution and rendering depend on the network. In normal mobile conditions the passport is on screen in well under a second — the practical threshold for a consumer repeating the action rather than abandoning it.

Does it work on metal, glass or fabric?

Yes, with the right inlay. Metal requires an on-metal construction with a ferrite layer; glass and fabric use different antenna geometries. Carrier selection by material is part of the walkthrough, because a tag that reads on carton may not read on a bottle.