DEV Community: Pocket Factory

An NFC card at the register that opens your Instagram: the URL, iPhone vs Android, locking and the QR fallback

Pocket Factory — Sat, 24 Oct 2026 19:32:35 +0000

I run Pocket Factory, which sells pre-programmed NFC cards, so I have a stake in this topic. Everything below works with a blank tag and a free app. You don't need to buy anything from me.

Here's a common question for a coffee counter: "Can I leave a card by the register that opens our Instagram when someone taps it?" Yes. But a few details decide whether the card works for every customer or only for some of them. This post covers those details: what to write to the tag, how iPhone and Android handle it, how much memory you need, when to lock the tag, where to put it, and how to test it.

If you've read my earlier post on writing a Google review link to an NFC tag, the chip side is the same. What's different here is the Instagram link and the coffee counter.

TL;DR

Decision	Do this	Why
Link format	`https://www.instagram.com/yourhandle/` as an NDEF URI record	iPhone background reading and Android both handle https; Instagram opens the app if it's installed
Don't use	`instagram://user?username=...`	App-specific URL schemes aren't a reliable background-read target; customers without the app get nothing
Clean the link	Remove `?igsh=...` and `?utm_source=qr` from the share link	Shorter payload, and you're not passing your own share-tracking token around
Chip	NTAG213 is enough; NTAG215 gives headroom	A profile URL is about 40 bytes
Lock it?	Yes, once it's tested	A counter card is a public object; an unlocked tag can be rewritten by anyone with a phone
Fallback	A printed QR code with the same URL	Covers phones with NFC turned off and iPhones older than the XS
Placement	In a holder near the register, not on top of the payment terminal or on bare metal	Metal detunes the tag, and two NFC targets side by side confuse people

1. Get the right Instagram link

In the Instagram app, go to your profile, tap Share profile, and copy the link. You'll get something like this:

https://www.instagram.com/yourcafe?igsh=MWx0bTNh...&utm_source=qr

Trim it to the canonical profile URL:

https://www.instagram.com/yourcafe/

Three reasons to trim it:

Size. The query string can double the payload.
Behavior. The clean URL is what Instagram's app link handling expects. It opens the profile in the app when the app is installed and in the browser when it isn't.
Hygiene. igsh is a share identifier tied to your share action. A card on a counter doesn't need it.

Open the trimmed URL on your own phone before you write anything. If it doesn't land on your profile, fix it now.

2. Write it as an https URI record, not an app scheme

It's tempting to write instagram://user?username=yourcafe so the tap "goes straight to the app." Don't.

On iPhone, background tag reading (the mode where you just hold the phone near the tag with no app open) is built around URL records. Apple's Core NFC background reading docs describe it working with universal links and a small set of system schemes. A random app scheme isn't something you can count on.
If a customer doesn't have Instagram installed, an app-specific scheme dead-ends. An https link opens the web profile instead.
An https link to instagram.com already opens the app on phones that have it, through universal links on iOS and app links on Android.

In NDEF terms you want a single URI record (TNF 0x01, type U) with prefix byte 0x04 (https://) followed by www.instagram.com/yourcafe/. Every mainstream writer app does this for you when you choose "URL" or "Link". In NFC Tools it's Write → Add a record → URL/URI.

One record only. Don't add a text record "for context" next to it. Some readers show a chooser or ignore the URL when there are several records, and that's the opposite of a one-tap experience.

3. NTAG213 vs NTAG215 vs NTAG216

Chip	User memory	Fits an Instagram profile URL?
NTAG213	144 bytes	Yes, easily
NTAG215	504 bytes	Yes, with lots of headroom
NTAG216	888 bytes	Yes, but you're paying for memory you won't use

After the 0x04 prefix byte, www.instagram.com/yourcafe/ is around 27–40 bytes depending on the handle. The NDEF and TLV overhead adds a handful more. Any of the three works. Pick on price, availability and card format, not memory.

4. Lock it after you test it

A card on a café counter is a public object. If the tag is unlocked and has no password, anyone with a writer app can overwrite it with their own link. Most people never would. It only takes one.

Testing order:

Write the URL.
Test it on an iPhone and an Android phone (see the matrix below).
Lock it. In NFC Tools this is Other → Lock tag.

Locking is permanent. You can't unlock it, and you can't change the link afterwards. If you ever change your handle, you replace the card. Treat that as a feature on a public counter.

5. Add the QR fallback

NFC covers most phones, but not every customer:

iPhone XS or newer reads tags in the background. Older iPhones need the NFC reader in Control Center, and most people don't know it's there.
On Android, NFC can be switched off in settings.
Some people just prefer the camera.

So print a QR code of the same trimmed URL on the card or holder. A few practical notes:

Make it at least about 2 cm (0.8 in) across for a counter-distance scan.
Use dark on light with a quiet zone around it. Don't put the code over your logo art.
Scan it from roughly where the customer will stand, not from 10 cm away.

The printed line under it can be as plain as "Tap or scan to follow."

6. Placement at a coffee counter

What I've seen work at counters:

Near the register, not on the payment terminal. A customer who's just tapped their card to pay shouldn't have to guess which thing to tap next. Keep a hand's width between the terminal and the follow card, and label the follow card clearly.
Not on bare metal. A tag lying flat on a stainless counter can read badly or not at all. Use an acrylic or wood holder, or a small stand, so there's a few millimetres of air or plastic underneath.
One card, one job. If you also want Google reviews or tips, use separate cards with separate labels: follow at the register, review at pickup, tip link on the jar. One tag can only open one URL, and that's a good thing.
Where people wait. The moment between paying and getting the drink is when people have a free hand and nothing to do.

A card or a stand? A stand reads from a step back and explains itself at a self-serve shelf. A card is flatter, cheaper, and fits next to a card reader on a crowded counter. Both run on the same chip and the same URL. I wrote a longer comparison of Instagram stands vs tap cards for coffee shops that includes other sellers.

7. Test matrix

Run this once before you lock the tag, and once after you place it in its holder:

Test	Expected
iPhone XS or newer, screen on, Instagram installed	Banner appears; tap opens your profile in the Instagram app
Same iPhone, Instagram not installed (or a friend's phone)	Banner appears; opens instagram.com/yourcafe in Safari
Android with NFC on, Instagram installed	Opens the profile in the app (or a chooser the first time)
Android with NFC off	Nothing happens. This is why the QR code is there
QR scan from customer distance	Opens the same profile
Phone in a thick case	Still reads within about 1–2 cm; if not, move the tag up in the holder
Tag sitting in the holder on the actual counter	Same result as on the desk. If not, check for metal underneath

8. If you'd rather not build it

The DIY route is a blank NTAG213 card, a free writer app and ten minutes. It's the cheapest option and works fine if you follow the steps above.

If you want your logo printed on the card, the link written and locked before it arrives, and the QR printed on the back, that's what my company does. Pocket Factory makes personalized NFC cards that open your Instagram, starting at $19 for one card with no subscription.

A printed QR backup is included by default.
No battery or charging is needed.
Cards work with iPhone XS or newer and NFC Android, with the QR backup for everything else.
Cards ship from the USA, locked.
Most standard orders are expected to be produced and shipped within approximately 3–5 business days; delays are possible.

Stand-style products from other sellers are a good fit if your counter has room and you want something readable from further away.

Questions about NDEF records, a phone that won't read a tag, or a counter that's eating your signal? Ask in the comments. I'll answer the technical ones whether or not you're a customer.

Writing a Google review link to an NFC tag (NTAG213/215/216) with a QR fallback

Pocket Factory — Sat, 24 Oct 2026 00:07:30 +0000

Plenty of small businesses want a "tap here to review us" card or sticker at the counter. Doing it yourself takes a few dozen lines of JavaScript, a few cheap NTAG stickers and an Android phone. You do have to watch a few details: which URL you write, whether it fits on the chip, whether you lock the tag, and what happens when someone's phone has no NFC.

This post covers:

Getting the review link (and the writereview URL format)
NDEF byte math: will the URL fit on an NTAG213, 215 or 216?
Writing the tag from a web page with Web NFC (NDEFReader)
Locking the tag read-only
Testing on iPhone and Android
Generating a QR fallback with an open-source library
Google's review rules in plain words

Disclosure: I run a small shop that sells pre-programmed NFC cards (details at the end). Everything below works with any blank NTAG tag and free tools.

1. Get the review link

The official way

Google Business Profile gives you the link directly. Google's help article Create a Google link or QR code to request reviews describes it: open your Business Profile, choose Read reviews → Get more reviews, then Copy the link or save the QR code. The same page notes that review QR codes can currently only be generated from a computer browser, not a phone.

Use this link if you can. Google issues it, it points at your profile, and it's short, which matters for NFC (see section 2).

The `writereview` URL (backup option)

You'll also see this format used all over the web:

https://search.google.com/local/writereview?placeid=YOUR_PLACE_ID

It opens the "write a review" box for the place with that Place ID. Two caveats:

Google's review-link help page doesn't document this format. It's widely used and it works today, but it's community knowledge, not a promise. If Google changes it, every tag you've written with it breaks.
You need the right Place ID. Google's Place ID page has a finder; search your business name and copy the ID exactly. Google says a truncated or modified Place ID is invalid, and that Place IDs can change over time.

My suggestion: write the link Business Profile gives you. Keep writereview as a fallback for when you can't get into the profile (for example, you're setting up a tag for a friend's shop).

Before writing anything, open the link on a phone that's not signed in as the business owner. You should land on the review form or the profile with a review button, not on a sign-in wall or a "page not found."

2. Will it fit? NDEF byte math

NTAG213, 215 and 216 have 144, 504 and 888 bytes of user memory, per NXP's NTAG213/215/216 product documentation. A URL is stored as an NDEF URI record, wrapped in a TLV block. For a short URL, the bytes look like this:

03 LL                 TLV: type 0x03 (NDEF message), length LL
D1 01 PL 55           record header: MB+ME+SR, TNF=1 (well-known), type length 1, payload length PL, type "U"
04                    URI prefix code (0x04 = "https://")
67 2E 70 61 ...       the rest of the URL as UTF-8 ("g.pa...")
FE                    terminator TLV

The URI record type replaces common prefixes with one byte. The four you'll use:

Code	Prefix
`0x01`	`http://www.`
`0x02`	`https://www.`
`0x03`	`http://`
`0x04`	`https://`

So for a short record the overhead is 2 (TLV) + 4 (header) + 1 (prefix code) + 1 (terminator) = 8 bytes. The https:// prefix is 8 characters and gets replaced by that one byte, so for an https:// URL the bytes on the tag come out equal to the URL's length (4 fewer if it starts with https://www., which has its own prefix code). On an NTAG213 that means an https:// URL of up to 144 characters fits.

Two thresholds add bytes on long URLs: once the record passes 254 bytes, the TLV length field grows to 3 bytes (+2), and once the payload passes 255 bytes, the record switches to the long format with a 4-byte payload length (+3). That only matters for NTAG215/216 and very long URLs.

Here's a helper that does the math:

// NFC Forum URI record prefixes we care about (index = prefix code)
const PREFIXES = ["", "http://www.", "https://www.", "http://", "https://"];

function ndefUriBytes(url) {
  // pick the longest matching prefix
  let code = 0;
  for (let i = 1; i < PREFIXES.length; i++) {
    if (url.startsWith(PREFIXES[i]) && PREFIXES[i].length > PREFIXES[code].length) code = i;
  }
  const rest = url.slice(PREFIXES[code].length);
  const payload = 1 + new TextEncoder().encode(rest).length; // prefix byte + URL bytes
  const header = payload <= 255 ? 4 : 7;                      // short vs long record
  const record = header + payload;
  const tlv = record <= 254 ? 2 : 4;                          // 1-byte vs 3-byte TLV length
  return tlv + record + 1;                                    // + terminator 0xFE
}

const CAPACITY = { NTAG213: 144, NTAG215: 504, NTAG216: 888 };

const url = "https://search.google.com/local/writereview?placeid=ChIJxxxxxxxxxxxxxxxxxxxxxxx";
const bytes = ndefUriBytes(url);
for (const [chip, cap] of Object.entries(CAPACITY)) {
  console.log(chip, bytes <= cap ? `fits (${cap - bytes} bytes left)` : "too big");
}

That example URL is 79 characters and needs 79 bytes, so it fits on all three chips. Review links are short, so an NTAG213 is enough almost every time. Pick 215 or 216 only if you plan to store something else alongside the URL.

One thing the math doesn't cover: whether your writing tool actually uses the prefix code. Most do, but check what landed on the tag with a reader app (section 5).

3. Write the tag from a web page (Web NFC)

Web NFC launched in Chrome 89 for Android. It doesn't exist on iPhone or desktop browsers, so the writing step needs an Android phone. Per Chrome's docs, it only works:

on HTTPS pages (or localhost), in a top-level frame,
when called from a user gesture like a button click,
while the page is visible and the phone is unlocked.

A minimal writer page:

<input id="url" type="url" placeholder="https://..." size="60">
<button id="write">Write tag</button>
<p id="log"></p>

<script>
const log = (msg) => (document.getElementById("log").textContent = msg);

document.getElementById("write").addEventListener("click", async () => {
  if (!("NDEFReader" in window)) {
    log("Web NFC isn't available here. Use Chrome on Android over HTTPS.");
    return;
  }
  const data = document.getElementById("url").value.trim();
  try {
    new URL(data); // throws on a malformed URL
  } catch {
    log("That doesn't look like a full URL.");
    return;
  }
  try {
    const ndef = new NDEFReader();
    log("Hold the tag against the back of the phone...");
    await ndef.write({ records: [{ recordType: "url", data }] });
    log("Written. Now test it with a different phone.");
  } catch (err) {
    log(`Write failed: ${err.name}: ${err.message}`);
  }
});
</script>

Notes:

Use recordType: "url", not "text". A text record shows the URL as text; it doesn't open it.
write() overwrites whatever is on the tag by default. If you're writing a batch and want to skip tags that already have data, pass { overwrite: false } and the promise rejects if the tag already holds an NDEF message.
The browser asks for NFC permission the first time.
Where the antenna sits varies by phone. If nothing happens, slide the tag slowly around the back of the phone.

4. Lock the tag (optional, permanent)

A tag sitting on a counter can be rewritten by anyone with an NFC app, unless you lock it. Chrome 100+ on Android adds makeReadOnly():

<button id="lock">Lock tag (permanent)</button>

<script>
// reuses log() from the writer page above
if ("NDEFReader" in window && "makeReadOnly" in NDEFReader.prototype) {
  document.getElementById("lock").addEventListener("click", async () => {
    try {
      const ndef = new NDEFReader();
      log("Hold the tag against the phone to lock it...");
      await ndef.makeReadOnly(); // resolves after the user taps the tag
      log("Tag is now permanently read-only.");
    } catch (err) {
      log(`Lock failed: ${err.name}: ${err.message}`);
    }
  });
} else {
  document.getElementById("lock").disabled = true; // needs Chrome 100+ on Android
}
</script>

This can't be undone. Only lock a tag after you've tested it on both platforms and you're sure the URL won't change. If you think you might switch links later, leave it unlocked, or point the tag at a URL on your own domain that redirects to Google, so you can change the destination without touching the tag. Keep the redirect a plain redirect, with no rating screen in between (see section 7).

5. Test on iPhone and Android

Android: NFC has to be switched on in settings. With the screen on and unlocked, a tap on a URL tag opens the link.

iPhone: According to Apple's background tag reading docs, iPhone XS and later read NDEF tags in the background, without an app, while the iPhone is in use (screen on). Apple lists exceptions: not before the first unlock after a restart, not while Apple Pay, Wallet or the camera is in use, and not in Airplane Mode. A banner appears and tapping it opens the URL. Older NFC-capable iPhones (7, 8, X) don't read tags in the background; they need the NFC Tag Reader control in Control Center (iOS 14 or later) or a reader app. Phones without NFC can't tap at all, which is what the QR fallback in section 6 is for.

A checklist I use:

Read the tag with a reader app (NXP's TagInfo or NFC Tools) and confirm the record is a URI record with the exact URL, with no extra spaces or a stray http:// prefix.
Tap with an Android phone that has never visited the link.
Tap with an iPhone XS or newer, unlocked.
Tap through a phone case and, if the tag will be stuck on something, on that surface. Metal behind an ordinary tag can stop it from reading; use on-metal tags there.
Do it signed out of Google, so you see what a customer sees.

6. QR fallback

Some phones don't have NFC, some have it switched off, and some people just don't know to tap. Put a QR code of the same URL next to the tag.

The node-qrcode library (MIT licensed) does this in a few lines:

npm install qrcode

const QRCode = require("qrcode");

const url = "https://search.google.com/local/writereview?placeid=ChIJxxxxxxxxxxxxxxxxxxxxxxx";

// PNG for quick printing
QRCode.toFile("review-qr.png", url, { errorCorrectionLevel: "M", margin: 4, width: 600 });

// SVG for print shops (scales without blurring)
QRCode.toString(url, { type: "svg", errorCorrectionLevel: "M", margin: 4 })
  .then((svg) => require("fs").writeFileSync("review-qr.svg", svg));

Tips:

Keep the quiet zone (margin: 4). Cropping the white border is the most common reason printed codes won't scan.
Dark modules on a light background. Inverted codes fail on some scanner apps.
Don't print it tiny. Test-scan the printed code from the distance people will actually stand.
Add a short line like "Tap or scan to leave a review", so people know both options exist.
Google's Business Profile can also give you a ready-made review QR code (from a computer browser), if you'd rather not generate one.

For more on how tap cards behave on different phones, I wrote up which phones read NFC review cards and why some don't.

And if you're still deciding whether a printed review card is worth it at all, I also wrote up what a Google review card is, and what it doesn't do.

7. Google's review rules in plain words

The tech is the easy part. What gets reviews removed is how you ask. From the Maps user-generated content policy and the review link help page:

No incentives. No payment, discounts, or free goods or services in exchange for a review, or for changing or removing a negative one. Google calls this fake engagement, and those reviews get removed.
No gating. Don't ask only the customers you think are happy, and don't put a "How did we do? 1–5 stars" screen in front of the link that sends only 4–5 star people to Google. Google doesn't allow merchants to "selectively solicit positive reviews."
Don't pressure or script. Don't require a review on the spot, don't tell people what to write, and don't give staff review quotas.
Do ask everyone the same way. Hand the card to every customer, or leave it at the counter. That's fine and it's what Google's own help page suggests (receipts, thank-you emails, a QR code in the store).

In practice: write the plain review URL to the tag, with no intermediate rating page, and offer it to everyone.

Wrap-up

Get the link from Business Profile → Get more reviews. writereview?placeid= is a backup.
For https:// URLs, the bytes on the tag ≈ the URL length. NTAG213 = 144 bytes.
NDEFReader.write({ records: [{ recordType: "url", data }] }) on Android Chrome 89+.
Test on both platforms, then makeReadOnly() (Chrome 100+) if you won't need to change the URL.
Print a QR code of the same URL as a fallback.
No incentives, no gating.

If you'd rather not program tags yourself

I run Pocket Factory, which makes personalized NFC cards with your logo, pre-programmed with your link (a Google review link, booking page, website or menu). They use an NTAG215 chip and ship locked, so the link can't be changed later; a new link means new cards. No battery or charging is needed, and a printed QR backup is included by default. The DIY route above works just as well if you have an Android phone and some blank tags.

If you build a small writer page from this, I'd like to hear what tags and phones you tested on.