Key Cards for Access Control Systems

Keycards have many different names. From prox cards, swipe cards to fobs or magnetic cards, to RFID cards—even the simplistic: ID cards. People give them many different names. The main provider of these key cards is HID Global who manufactures, distributes and sells access cards using their proximity readers.

The problem with those keycards is that they can get easily hacked using $10 devices. Typically, most common cards run on the vulnerable Wiegand protocol, which allows hackers to copy cards very fast.

If you're looking for a tutorial guide on how to copy ID cards, here is one. Most of these cards use facility codes that can be calculated using free facility code calculators, like these

Key Card Types

What is a keycard? How does a keycard work with a reader?

A keycard is a security token that grants you access through electronically-powered doors. They require a keycard reader to be installed on the door, and you gain access by either tapping your card on the reader (proximity reader), swiping it (swipe reader), or inserting it (insert reader).

With keycards, users no longer have to insert a metal or traditional key into a tumbler lock to enable an unlock. Instead, there is an embedded access credential on the key card magstripe, and this is read by the keycard reader each time you attempt an unlock. If the unique code on your card is recognized by the reader, permission is granted for access.

Advantages of Keycard Entry Systems

  • Can easily be activated for different access points
  • Can provide restrictions for certain times, certain access levels, or even certain numbers of unlocks 
  • Provides remote deactivation capability
  • Fits snuggly into your wallet or card holder
  • Can configure and reconfigure access using the same card (unlike a
    metal key where new keys need to be issued and old keys have to be

Disadvantages of Keycard Entry Systems

  • A key card cannot be used as a remote, mobile access badge for offices,
    buildings and homes; it still needs to be up close to the reader for it
    to work
  • Physical token still required - losing your key card
    still compromises access to your space, but to a lesser extent as
    compared to a metal key 

Alternative to Keycard Entry Systems

Given the disadvantages of keycard entry systems, it's imperative to identify better alternatives that can address these disadvantages. An attractive option would be mobile access control. This means using the credentials on your mobile phone to unlock doors. 

Kisi is a cloud-based mobile access control system. This means that the management, or admins, will be able to reap the benefits of having a cloud-based system (as opposed to a traditional local-hosted system), while end-users are able to unlock doors easily with something that they are already carrying with them all the time—their smartphone.

Get a quote from us, and experience the ease and security of a cloud-based mobile access control system.

Kisi Products
Regain Full Control the Easy Way

Discover what makes Kisi the most advanced cloud access control solution.

What are RFID keycards?

RFID cards are most widely used in commercial office spaces. These cards (or tags or fobs as they are sometimes referred to) can be classified by the range they communicate (low, high or ultra high) and the way the communication happens with the reader (active or passive).

How are permissions encoded on a magnetic keycard?

Each keycard system comes with a key encoding machine, which will configure the permissions granted to your card. The system should allow you to grant permissions for multiple doors, configure date and time for access, and even the number of times a user can access the space.

All these details are built into a very complicated algorithm, which is written into your keycard’s magstripe. This magstripe contains thousands of tiny magnetic bars, each can be polarized either north or south. Polarizing these magnets creates a sequence that is encoded on your card. 

There are other ways to encode a keycard, but those are usually used for corporate spaces. These include newer models that have radio-frequency identification (RFID), or “smart cards,” which contain an embedded micro-controller to handle security. RFID key cards will be covered below.

Your RFID reader can operate on different frequency ranges:

- Low Frequency (LF) RFID operates around 30 KHz to 300 KHz and has a maximum range of 10cm. Your conventional office access card usually utilizes LF range.

- High Frequency (HF) RFID operates around 3 MHz to 30 MHz and provide distances between 10cm and 1 meter. Examples of access cards that use HF RFID are NFC cards.  Smart cards like MIFARE are also based on this standard.

- Ultra High Frequency (UHF) RFID ranges between 300 MHz and 3 GHz and reads up to 12 meters. They are typically used for parking solutions or similar wide range applications. 

Now that we covered the different types of RFID frequency, there is another parameter to consider. RFID can be distinguished into two broad categories: Passive or active tags (or cards). 

- Active RFID tags have their own transmitter (and power source). Active RFID tags are used for cargo, machine or vehicle tracking.

- Passive RFID tags do not require a battery. The reader on the wall sends a signal to the tag. That signal is used to power the tag and reflect the energy back to the reader.

These proximity cards are low frequency and mostly fall under the category of passive RFID cards.

How do RFID keycards work?

- Passive cards have three components sealed in the plastic: An antenna (mostly coil or wire), a capacitor and an integrated circuit (IC), which contains the user’s ID number.

- The RFID reader on the wall has an antenna, which continuously emits a short range radio frequency (RF) field. 

- When you hold the card on the reader, the card absorbs the energy from the RF field generated by the reader. This energy is creating a current powering the integrated circuit, which in turn makes the chip emit its ID number.

- The reader check sends the ID back to the server closet or IT room, where the main access control system panel usually resides. The sent ID signals that this user wants to unlock the door. The format the reader communicates is often using the Wiegand protocol.

DID YOU KNOW: RFID technology is being used on credit or debit cards as well, creating a contactless form of transaction.

Types of HID cards

HID Indala is a great access card for advanced needs in access control and security. 

Types of cards

- CX Series CASI Compatible Prox Credentials

- FlexISO Imageable Card

- FlexISO XT Durable Composite Card

- FPMXI FlexPass MIFARE / Indala Combo Smart Card

- FlexCard

- FPDXI FlexPass DESFire / Indala Prox Combo Card

HID's iClass SE Seos ID card

HID's iClass Seos ID cards are due to their "SIO" (Secure Identity Object) enablement one of the more secure cards. 

They are typically used with UHF (Ultra High Frequency) applications such as for gates or garages.

iClass SE runs on 13.56 MHz but can be used in "dual technology" mode essentially incorporating 125 KHz Proximity.

- 3350 iCLASS SE Clamshell Card

- 600x SIO Enabled UHF Card

- 601X SIO Enabled UHF/iCLASS Card

- 300x iCLASS SE Card

- 310x iCLASS SE + Prox Card

- 325x iCLASS SE Key Fob II

- 340x - MIFARE Classic SE Card

- 350x SIO Technology-Enabled MIFARE + Prox Card

- 370x - MIFARE DESFire EV1 SE Card

- 38xx SIO-Enabled MIFARE DESFire EV1 + Prox Card

HID iClass is the top model of HID Global. It is available in 2k bit (256 Bytes), 16 bit (2K Bytes) or 32k bit (4K Bytes) configurations.

HID's iClass ID card 

HID's iClass badges are MIFARE Desfire EV1 or MIFARE Classic based cards - in part also with prox backwards compatibility.

  • 232, 242 & 243 iCLASS + MIFARE Classic or MIFARE DESFire EV1213x iCLASS Embeddable & iCLASS Prox Embedded Card
  • 252, 262 & 263 iCLASS + MIFARE Classic or MIFARE DESFire EV1 + Prox202x iCLASS + HITAG2 Card200x iCLASS2080 iCLASS Clamshell Card
  • 202x iCLASS + HITAG1 Card202x iCLASS + Prox Card HID's Prox ID card HID Prox is an entry level keycard for getting started with access control or basic needs. Types of cards 1386 ISOProx II Card 1326 ProxCard II Clamshell Card 1336 DuoProx II Card 1351 ProxPass II Active Tag 1597 Smart ISOProx II Card 1598 Smart DuoProx II Card HID's FlexSmart, MIFARE, DESFire ID card HID's FlexSmart badges are MIFARE or DESFire compatible. 
  • Types of cards 1451x SIO Solution for MIFARE DESFire EV1 + HITAG1 Card 1431 MIFARE / HID Prox Combo Card 1455 DESFire Tag FPMXI FlexPass® MIFARE / Indala® Combo Smart Card 1450 MIFARE DESFire EV1 Card 1451 MIFARE DESFire EV1 / HID Prox Combo Card 272, 282 & 283 MIFARE Classic solution + MIFARE DESFire EV1 solution FPDXI FlexPass® DESFire / Indala® Prox Combo Card 
Here is a full overview of the different types of HID cards

ID Card Wholesellers

Identicard not only sells ID card but also software like PremiSys. It allows to grant and restrict access to doors, lock down facilities, view integrated video, create detailed reports and more.

Popular blank cards

Standard ID cardsProximity CardsSmart CardsBadge Buddies / role - recognition cards

Give your organization a simple, professional badging solution with a variety of customizable PVC and Teslin® substrate identification cards.

ID Card Group offers a full line of ID card equipment, supplies, and accessories – from identification and access control products, to promotional products for loyalty or membership programs, to gift, payment, or phone cards and systems.

Popular blank cards

HID Prox & HID iClass—The gold standard in access control technology offers a wide range of prox credentialsGeneric Brand—Low-priced alternative to brand-name credentials can be used in your existing access control system XceedID—Emerging industry leader in compatible proximity credentials (Formerly Schlage)Indala—FlexSecure proximity cards and fobs are manufactured by HID GlobalCASI-Compatible—CASI-Compatible prox cards by Indala work with CASI ProxLite Readers.Keri Systems—For Keri Tiger Controllers, IntelliProx 2000, NexTreme (NXT) and Pyramid Series Readers. 

AlphaCard has been a trusted provider of secure ID solutions since 1998. As one of the largest photo identification solution providers in the USA, we inventory over 98% of the product we ship in our own warehouse. 

Standard Blank PVC Cards, CR80Blank Color PVC Cards, CR80 30mil - 100

Hi-Co Magnetic Stripe Blank PVC Cards, CR80 30mil - 100 / 500 countStandard Blank PVC Cards, CR80 30mil

Alphacard offers ID card printers and supplies from industry-leading companies such as Magicard, HID / Fargo, Zebra, Evolis, Datacard, and many more


Swipe cards

Swipe cards or magnetic stripe cards work by storing data in a magnetic layer placed on a card. This magnetic layer is capable of data storage by altering the tiny magnetic particles. In case you wondered how your credit card works - that was the answer.

Swipe card access with is used in physical security, but also for credit card payment or identity verification. You must pull through or swipe the card through a magnetic reader to be able to confirm the data stored on it and enable the card access system to do its work.

A swipe card door access control system is a common security solution for premises that need to continually let it and out many same people, such as employees in a large organization. Although the magnetic stripe is the key differential that makes them what they are, swipe cards can contain additional means for storing, reading and writing data, such as RFID tags or microchips. Swipe cards are a convenient and an affordable solution to control access, but they usually provide limited security protection that needs to be supported by extra technology or authentication factor to suffice for top security requirements.

How do swipe cards work in access control?

Magnetic swipe card door access control systems use magnetic strips at the back of the card to encode data. The magnetic reader’s head reads the data when you swipe the card through it and enables access.

This is the most common technology used when you are doing your shopping for groceries, when you pull some cash out of an ATM machine or when you present your license as an ID document on specific locations.

When the card access system is made of a standalone reader, all swipe cards will be connected to that single access control device. This is rarely the case, though, as most organizations need either more cards or require additional security which can be obtained from several units distributed in a network. Network or PC-based card access combine multiple magnetic readers in a joint software that can be used to monitor the access events from all readers from a central point.

Advantages of Swipe Card Entry Systems

Swipe card access control systems have a number of advantages that make them convenient for access control over other technologies, such as RFID or NFC (proximity) cards, smart cards or combination cards:

  • Swipe card access is cheaper than other technologies. The technology to store data in magnetic cards that can be used in hundreds of cards at a low cost.
  • Magnetic cards are interoperable. Unlike RFID devices, which use radio frequencies to connect devices and can incorporate a range of frequencies, swipe cards are applicable in a wide variety of industries and vendors, since they are based on the same technology.
  • Swipe cards are an exclusive security tool. When a magnetic card is lost, the user can ask for a new one to be issued in a short time because it controls clearly defined access points. If a user loses a mobile with an app that controls the swipe card access control system, getting a new phone will usually be needed to put the system in full use.
  • Physical possession of the swipe card is necessary so that the invader can compromise the magnetic stripe and steal data. Most attacks on swipe card data compromise the readers at ATMs or the stored data records with suppliers. For RFID or NFC cards, violations can be made with interception and interference, and the attacker doesn’t need to get to the card.
  • Swipe card access is read-only. Owners can use it only in passive mode, without deployingwriting capabilities and changing the data in a system. Smart cards, on the other hand, use both reading and writing modes.
  • Magnetic stripe cards enable individual tracking and audit trails.

Disadvantages of Swipe Card Entry Systems

As the most simple and traditional access control method, swipe card access control has some disadvantages over the alternative forms of access control.

  • Swipe cards can be unreliable. Sometimes, the magnetic stripe can get damaged or corrupted, in turn making the data unreadable and creating difficulties for the person using the card, who will have to swipe multiple times until the data is read properly.
  • In general, magnetic access cards are considered less secure than the alternatives, because it takes less advanced technology to copy the device data and misuse it for theft or stolen identity purposes. These cards are basically most similar to mechanical keys.
  • Magnetic cards cannot cover a range of industries. For example, NFC is increasingly present not only in access control systems, but also in mobile payments, transports, redeeming rewards and many other consumer uses.
  • Swipe card access systems cannot provide multi-technology authentication, unless they are upgraded with additional access control tools, for example, smart cards that can support telephone or Internet lines as backup supply solutions.

Key Fobs

A key fob is a type of access badge or security token. It acts as a wireless remote control device that allows users to access their buildings, offices, and cars. Such key fobs are usually utilized for locations with regular human traffic but requires entrants to authenticate their access, and it does that by initializing the built-in security access system each time the fob is activated.

Key fobs are used in apartment buildings, condominiums, offices and buildings worldwide, which often contain a RFID tag. It operates similarly to a proximity card, where they communicate access credential information (via a reader pad) with a central server for the building. Key fobs can be programmed to allow time restricted and location restricted access to permitted areas.

Locking and unlocking a door with a key fob usually only requires you to push a button on your fob. Some key fobs provides two-factor authentication where an user has a personal identification number (PIN), which authenticates them as the device's owner.

Key fobs are an integral component of keyless entry systems, especially in the automotive industry where they are used to unlock your car door from a distance. However, it still requires a physical object to be issued to users before they can begin electronically unlocking their doors. This means that losing your key fob is still a very real possibility that would prevent you from accessing your space, and undermine the security of your building or car.

How Does a Key Fob Work?

The key fob (or wireless remote) operates in conjunction with an electronic lock (e.g. an electric strike) for it to work. Most key fobs sends signals to an intermediary security access system, which in turn relays an instruction to your door to lock or unlock it.

A key fob communicates with the locks in your access control system using radio wave signals, or RFID technology. Here’s how it works:

Both the key fob on your keychain and the access control system have memory chips that allow the fob to work. When the button is pressed on the fob, it sends a code to the door with the instructions as to what the door should do, whether that is to lock or unlock the door. If the code sent to the access control system matches, it will perform that action and unlock the door. The code is randomly generated each time the fob is used.

This code utilizes a 26-bit wiegand protocol put when communicating instructions from the fob to the system. It is a binary code with 256 different possible combinations per fob, and there can be up to 65,535 ID numbers that would work for each code. Matching each code with each ID, you can issue up to 16,711,425 fobs without ever duplicating a user. Programming the key fob is essentially making sure that the access control system and the fob are synchronized so that the door would recognize the codes the fob is sending.

The frequency of the transmitter determines the maximum distance that will allow the key fob to send a code to the door. Quick note: if your fob only works when you get near the access badge, it might be utilizing a simple coil e.g. a 125kHz "transmitter". Therefore, it only works near the transmitting coil as the magnetic field decays very fast.

For more information:

Starting a new project?
Download our Physical Security Guide

Get the full guide and other great security content from Kisi. 

Download Guide
Kisi Physical Security Guide