A Philips Sonicare Brush Head Is a Password-Protected NFC Chip That Locks Itself Forever After Three Wrong Guesses

The page is titled “Hacking my ‘smart’ toothbrush,” and Künzi is an electrical engineer in Zurich. He identified the head’s chip as an NTAG213, a password-protected NFC tag. To see what the handle says to it, he used a HackRF software-defined radio with gqrx and GNU Radio, then NFC-laboratory to read the tag. The password question had a short answer: “Luckily it turns out that the required password is sent over plain text!”

Each head has its own password, so there is no universal key. But a handle that sends its head’s password over the air in plain text gives a radio listener the password every time it’s used.

The timer is the funny part. Künzi writes: “Looks like addr. 0x24 saves the number of seconds that the brush head was in use.” A fresh head reads 00:00:02:00 there, and after a five-second test it read 05:00:02:00. That counter is what the brush handle uses to decide when a head is worn out. A toothbrush that nags you about replacing a head you’ve used for 90 days is reading a number off a chip.

Then comes the booby trap. The tag is set “to permanently disable all write access after three wrong password attempts.” He found this out the hard way. His first brush head locked him out, and he bought a second one. As he explains it: “This means that not even the toothbrush handle itself can write to this head again.” Three bad guesses, and a $10 or so part is a read-only brick.

His page carries an update dated August 16, 2023. In it he credits Aaron Christophel, known online as atc1441, who dumped the Philips firmware, wrote a password generator and made a Rick Roll. The page doesn’t say any more about that than that.

What’s missing is worth noting. Künzi’s page covers the password, the timer and the lockout, and nothing about computers or unlock tricks. Whatever people have since done with Sonicare chips is separate from what’s on his page, and this story only vouches for what the page says.

That keeps the claim small and checkable. A brush head holds one password, one seconds counter and one counter-protected lock. Anyone with a cheap NFC reader and a spare head can repeat the first two steps without risking the third, as long as they stop guessing before the third wrong try.

The detail the page leaves open is the one a lot of people would care about: how many of these heads are sitting in drawers, counting seconds that nobody’s reading.

Somewhere out there, a bin of used brush heads is full of perfectly good NFC tags.