Product identity without an app
Serial, QR, and cryptographic NFC: what each carrier proves, and why the consumer path must never require an install.
Every physical product that wants to prove something about itself needs a carrier: the thing on the product a person can read or tap. There are three that matter, and they form a ladder.
The carrier ladder
- Serial number. Human-readable, works with no hardware at all; someone types it in. A well-designed serial is short, unambiguous (no 0/O confusion), and checksummed so typos fail loudly instead of resolving to the wrong item.
- QR code. One scan opens the product's page. A QR proves the product points somewhere. But a QR can be photocopied perfectly, so on its own it identifies rather than authenticates. Printed to the GS1 Digital Link standard, one code serves consumers, customs, and recyclers alike.
- Cryptographic NFC. A secure chip (the industry-standard part is NXP's NTAG 424 DNA) signs a fresh one-time code on every tap. A photocopy, a reused code, or a cloned URL doesn't produce the next valid code, so a tap can return a genuine verdict, not just a link.
What each rung proves
Identification and authentication are different claims. A serial or QR answers "which item is this supposed to be?" A cryptographic tap answers "is this tag the real one?" That's why verdict language should stay tiered: a scan shows a registered item; a cryptographic tap can say verified this second.
Why "no app" is non-negotiable
Verification that requires installing an app dies at the moment of truth: the person holding the product is standing in a store, at a doorstep, or in a resale meetup. Every install screen sheds most of them. Both modern phone platforms read NFC and QR natively into the browser, so there is no technical excuse. And the emerging European DPP standards and CIRPASS-2 UX guidance point the same direction for passports: the public data must be reachable without an app, an account, or a wallet.
The quiet part: possession vs. ownership
A public code on the outside of a product can be read by anyone, so it must never be the thing that proves ownership. The pattern that works: a public serial anyone can check, plus a private claim code inside the box that lets the actual buyer claim the item once. Proof of possession stays separate from proof of identity.
This ladder is exactly how SAGAS Commerce is built: serial, GS1 QR, and NTAG 424 DNA taps, with verdicts in the browser. You can run the simulated tap yourself.
General information, not legal advice. Verify obligations against the cited regulations on EUR-Lex, or with counsel. Citations checked July 30, 2026.