← All resources

What is a PUF (physically unclonable function)?

By TrustMarx Team · Published on May 12, 2026

A physically unclonable function (PUF) is a physical structure whose fine details are created by uncontrollable randomness during manufacturing, so that no process — not even the original one — can reproduce it. Because the structure cannot be cloned, it can serve as a fingerprint for a physical object.

The core idea

When certain materials are printed, etched or deposited, microscopic variations appear that nobody chooses and nobody can repeat: fiber positions in paper, particle distribution in ink, micro-roughness in a coating. Two labels printed by the same machine, one second apart, differ at this microscopic level in ways that are stable, measurable and unique.

A PUF-based authentication system does three things:

1. Enrolls the structure: at production time, a camera captures the label's micro-texture and the server stores a mathematical template of it.
2. Challenges it in the field: when someone verifies the product, their phone captures the same region again.
3. Matches the two: the server compares the fresh capture against the enrolled template and decides whether it is the same physical object.

Why a photocopy fails

A photocopy or a high-resolution scan reproduces the information printed on a label — the barcode, the text, the artwork. It does not reproduce the physical randomness of the substrate, because the copying process introduces its own new randomness. The copy therefore fails the physical match, even if every printed pixel looks identical to the eye.

This is the crucial difference between a PUF and every data-only identifier (QR codes, barcodes, serial numbers, NFC UIDs that can be emulated): data can be duplicated perfectly; physical randomness cannot.

What a PUF does not do alone

A PUF proves this is the same physical label that was enrolled. It does not by itself prove who enrolled it, or stop someone from harvesting valid labels and re-attaching them. That is why production-grade systems, including TrustMarx, pair the PUF with a cryptographic identity (a token signed by a key held in a hardware security module) and server-side scan intelligence that watches for abuse patterns such as one label being verified in two countries on the same day.

Summary

• A PUF is manufacturing randomness used as an unclonable fingerprint.
• Copies reproduce data, never structure — so they fail verification.
• PUFs answer "is this the same object?"; cryptography answers "is this identity genuine?"; analytics answers "is this pattern of scans plausible?". Strong product authentication uses all three.