A touch attack is a special attack that only needs to touch its target to have an effect. (A normal attack needs to hit its target solidly to do damage. A character who swings a sword that glances off an opponent's shield has touched his target, but the swing is considered a miss since it could not inflict damage. In game terms, this attack roll was less than the target's armor class (AC) by virtue of the shield's contribution.)
Touch attacks can be either ranged or melee. One example of a ranged touch attack is an ettercap's web bolt attack. The web bolt merely has to touch the target to attach itself and bind the target to the ground.
A touch attack denies the defender their armor and shield AC (base and bonus), as well as their natural armor bonus to AC. All other armor class modifiers, such as the size modifier, dexterity modifier, and deflection/dodge bonus apply (or don't apply, e.g. if flat-footed) normally. Consequentially, touch attacks sometimes have a significantly better chance of hitting than regular attacks.
The attacker's touch attack bonus is as follows.
- BAB + strength modifier (only if positive) + nature sense + epic prowess (unless a ranged weapon is equipped) + unarmed weapon focus feats (if unarmed or using a creature weapon) + effects
- BAB + dexterity modifier + weapon attack bonus + effects
No other modifiers ever apply to these rolls, nor are the ability modifiers changed due to weapon finesse or zen archery. As usual, a natural roll of 20 (before adding the attack bonus) is automatically a hit, and a natural 1 is automatically a miss. Critical hits are only threatened on a natural 20, and the confirmation roll is always the same as the attack roll (i.e. the confirmation roll is always a natural 20). Immunity to critical hits does not apply against touch attacks. Touch attacks never qualify as sneak attacks.
Touch attacks are used for all scripted attacks–even those that do not fit the touch attack concept–and only used for such attacks. (This is a consequence of how Neverwinter Nights was designed.) As such, the consequences for a miss, hit, and critical hit are completely determined by the script that invoked the touch attack.