OPEN-SOURCE ANDROID NFC DIAGNOSTIC

One tap.
One key.
One clear answer.

TapDance tests whether a MIFARE Ultralight AES tag still accepts the factory DataProtKey. It makes one explicit, read-only authentication attempt—nothing is written to tag memory.

Download APK View source

Tests the card, not the door reader · Android device with NFC required

TAPDANCE · ARMED

Now tap the card

Hold an authorized Ultralight AES tag to the back of your phone.

ONE ATTEMPT · NO AUTOMATIC RETRIES
HOW IT WORKS

A narrow test with a hard boundary.

No key recovery, no cloning, and no reader interaction. TapDance answers one specific configuration question about the tag in your hand.

1

Install

Download the APK built and published by the repository's GitHub Actions workflow.

2

Arm and tap

Explicitly arm one test, then hold a compatible, authorized tag against your phone.

3

Read the result

See the outcome, or open the memory-only diagnostic report for the exact failing phase and timing.

DATAPROTKEY UNDER TEST00000000000000000000000000000000

TapDance does

  • Test the physical card itself
  • Attempt the factory AES key once
  • Report the result and exchange trace locally

TapDance does not

  • Brute-force or recover keys
  • Clone or emulate credentials
  • Test a door reader
  • Write tag memory or upload NFC data
RESULTS

Precise language, no false confidence.

Factory key accepted

The tag completed mutual authentication using the all-zero factory key.

Factory key rejected

Android exposed an explicit rejection. This does not prove the system is secure.

Inconclusive

The diagnostic report can distinguish RF loss from a proof-stage failure strongly consistent with Android hiding the card's short NAK.

Please read before tapping

Use TapDance only with tags you own or are explicitly authorized to test. TapDance never writes tag memory, but a failed authentication may still advance a tag's configured authentication-attempt counter. It performs no automatic retries.

PRIVATE BY DESIGN

Your tag stays between you and your phone.

The Android manifest contains no Internet permission. The app has no analytics, advertising, telemetry, crash-reporting SDK, or persistent NFC storage. A report leaves the app only when you explicitly copy or share it.

  • No Internet permission
  • No tag writes
  • No automatic retries
  • No UID or NFC data saved to disk
  • Open source and CI-built
LATEST BUILD

Get TapDance 0.1.0-alpha.3

Android 8.0 or newer · Published 2026-08-03

Download APKRelease notes
APK SHA-2567b80b21de31c0e2b680bd9e57b37fd6218918e708e67dbfc3b5aee6fdb1570fc

Build-specific alpha signer

This ephemeral key does not support in-place updates or prove publisher identity. Uninstall an older alpha before installing a new one; verify the GitHub release and provenance.

SHA-256 4fddf58e1f07da19e9764412b4c5fdf82fe4f08ef40dd2333bd2a71f15f073c1
Installing from GitHub

Android may ask you to allow installs from your browser or file manager. Grant it only for this installation, then disable that permission again afterward.

FAQ

The important edge cases.

Does this test my door reader?

No. TapDance tests the physical card presented to the phone.

Why can a wrong key still say “Inconclusive”?

Stock Android can recognize the tag's four-bit rejection below the public app API and replace it with a generic I/O failure. TapDance shows that evidence in the diagnostic report but does not call it cryptographic proof.

Does “Rejected” mean the system is secure?

No. It means only that Android exposed an explicit rejection for the one all-zero DataProtKey attempt.

Can it discover my AES key?

No. TapDance performs no recovery or dictionary search.

Can it alter the tag?

It sends no memory-write command. A failed authentication can still affect a configured attempt counter on the tag.

Why isn't it on the Play Store?

TapDance is currently distributed directly as a small, auditable, open-source diagnostic utility.