MIFARE Card Guide 2026: Classic vs Plus vs DESFire vs Ultralight

What is Mifare?

Mifare is NXP Semiconductors' family of contactless smart card chips, launched in 1994 (originally under Philips Semiconductors) — which makes it older than Google and considerably harder to avoid. Over the next three decades it became the default chip behind public-transit ticketing, hotel locks, gym lockers, campus cards, cashless venue payment and event wristbands. If you tapped anything on your way to work today, odds are you greeted a member of this family: NXP estimates 10+ billion Mifare credentials are in active use across 150+ countries.

Mifare runs at 13.56 MHz HF and complies with ISO/IEC 14443. The product line covers four security tiers — four relatives who share a surname and not much else: Classic (legacy / Crypto-1, broken in 2008 — the proud grandparent), Plus (drop-in upgrade with AES-128 ready — the diplomatic middle child), DESFire (full enterprise security — the one with the vault job), and Ultralight (low-cost disposable — the cheerful intern). Project teams pick a tier based on threat model, memory needs and reader compatibility — covered in the comparison sections below.

Mifare Classic

Mifare Classic is the most widely deployed contactless smart card technology — and, since 2008, also the most widely picked lock in the business. It comes in two main variants:

Mifare Classic 1K (S50)

Features 1024 bytes of EEPROM memory organized in 16 sectors of 4 blocks each — a filing cabinet with 16 drawers, each drawer with its own tiny lock. The first block of each sector is a key block containing access keys and conditions. It supports Crypto-1 authentication and has a unique 4-byte serial number. Reading distance is typically 10 cm.

Mifare Classic 4K (S70)

Offers 4096 bytes of memory organized in 40 sectors (32 sectors of 4 blocks and 8 sectors of 16 blocks). It provides the same security features as the 1K version but with significantly more storage capacity for applications requiring more data. Same tiny locks, bigger cabinet.

Mifare Plus

Mifare Plus is the successor to Mifare Classic and the designated peacemaker of the family: modern security in one hand, backward compatibility with the old readers in the other. It comes in two variants: Mifare Plus S (simplified) and Mifare Plus X (extended).

Key features include AES-128 encryption (compared to Crypto-1 in Classic), multiple security levels (SL0-SL3), backward compatibility with Mifare Classic infrastructure, and available in 2K and 4K memory options. In practice, Plus exists so you can upgrade a Classic estate without one dramatic forklift weekend.

Mifare DESFire

Mifare DESFire represents the highest security level in the Mifare product line — the family member with the vault job and the tailored suit. It features an open architecture with a flexible file structure supporting multiple applications on a single card.

DESFire EV2

Available in 2K, 4K, and 8K memory options, DESFire EV2 supports DES, 2K3DES, 3K3DES, and AES-128 encryption. It features multi-application support, transaction MAC for securing payment transactions, and MISmartApp for hosting web applications.

DESFire EV3

The latest generation offers improved security features, faster communication speeds, support for Secure Messaging (SDM) for NFC interaction, and enhanced privacy features with optional random UID.

Feature	Classic 1K	Plus S/X	DESFire EV3	Ultralight EV1
Memory	1 KB	2 / 4 KB	2 / 4 / 8 KB	48 / 128 bytes
Encryption	Crypto-1	AES-128	AES-128 / 3DES	None / AES
Security Level	Low	Medium–High	High	Low
Multi-App	No	No	Yes	No
Best For	Basic access	Upgrades	Transit, payments	Tickets, events

Mifare Ultralight

Mifare Ultralight is the family’s cheerful intern: cost-effective, built for limited-use applications, and gone by Monday without hard feelings. It features 64 bytes of memory with no encryption (Ultralight) or with AES authentication (Ultralight C/EV1). Common applications include event tickets, single-use transit tickets, and loyalty cards. RFIDAK offers RFID paper cards with Ultralight chips for disposable ticketing projects.

NTAG vs MIFARE: Where the Lines Cross

Buyers often confuse NTAG (NXP’s NFC tag family for smartphone tap interaction) with the MIFARE smart-card family. Both are NXP, both run on 13.56 MHz HF, and both are dispatched under ISO/IEC 14443 Type A — but they answer different commands and target different deployments. Same maker, different day jobs: specify the wrong one and your tap-to-info campaign becomes a box of very quiet stickers.

Family	Standard	Designed For	Smartphone Read?
MIFARE Classic / Plus / DESFire	ISO 14443-3/4 + NXP custom	Reader-side auth: payment, transit, access	Read UID only (most phones)
MIFARE Ultralight	ISO 14443-3	Disposable tickets, event passes	Yes (NDEF readable)
NTAG 213/215/216 / 424 DNA	ISO 14443-3 + NFC Forum Type 2	Tap-to-info, anti-counterfeit, marketing	Yes (full NDEF)

If you need an iPhone or Android phone to read your tag without an app, you almost always want NTAG — not MIFARE Classic. If you’re building a closed-loop system with proprietary readers (transit gate, hotel lock, office door), MIFARE DESFire is the right family. (A phone can wave at a DESFire card all day; without the keys, the card waves back politely and says nothing.) Read the NTAG 424 DNA guide for the smartphone-secure use case.

The Crypto-1 Break (2008): What Actually Happened

MIFARE Classic uses a proprietary stream cipher called Crypto-1 with a 48-bit key — designed in the 1990s when 48 bits was considered hard to brute-force in real time. The 1990s, it turns out, do not offer extended warranties. Two academic teams independently broke it in 2008:

• USENIX Security 2008 — Karsten Nohl, Henryk Plötz and Starbug reverse-engineered the Crypto-1 algorithm by reading the chip’s photographic die layer-by-layer, then published the cipher.
• CARDIS 2008 — Garcia, de Koning Gans, Muijrers et al. demonstrated a practical key-recovery attack: capture a single legitimate authentication exchange, then derive the 48-bit key in under 1 second on commodity hardware.
• 2010 onwards — "MIFARE Classic offline cracker" tools (mfoc, mfcuk) made the attack push-button. By 2012 Dutch transit operator OV-chipkaart had migrated away from Classic; London Oyster moved to DESFire by 2010.

The practical takeaway: any new project that needs cryptographic security must avoid Classic. Classic 1K is still produced because billions of legacy readers exist — the retirement keeps getting postponed, like a rock band’s farewell tour — and many low-risk applications (gym lockers, library cards, school IDs) tolerate the weakness. For payment, transit, hotel keys, or corporate access, DESFire EV2/EV3 is the only defensible default.

MIFARE Migration Path: Classic → Plus → DESFire

If you operate a Classic 1K install base and want to upgrade without forklifting every reader and card in one heroic, career-defining weekend, MIFARE Plus is the explicit migration product. The migration runs through five practical steps:

An SL1-to-SL3 transition requires compatible readers and application software, an approved key plan, credential issuance and revocation procedures, and tested fallback. Set the schedule from the installed fleet and cutover plan rather than a generic cardholder-turnover estimate.

How to evaluate a MIFARE migration

Obtain the installed reader and controller models, firmware, credential format, key-management plan and approved chip articles from the system owner. Test enrollment, authorized and denied access, replacement and revocation with a small non-production card set. Public transport or hotel programs using a related chip family do not prove compatibility with your installed readers.

Choosing the Right Mifare Chip

The choice between Mifare variants comes down to three honest questions: what happens if a card is cloned, how much data needs to ride on it, and who signs the invoice. In other words — security requirements, memory needs, and budget, in that order.

MIFARE Cards FAQ

Sources

1. ISO/IEC 14443-1..4:2018 — Identification cards / contactless integrated circuit cards / proximity cards (HF 13.56 MHz). iso.org/standard/73598.html
2. Karsten Nohl, Henryk Plötz & Starbug — "Reverse-Engineering a Cryptographic RFID Tag." USENIX Security 2008. usenix.org
3. Garcia, de Koning Gans, Muijrers et al. — "A Practical Attack on the MIFARE Classic." CARDIS 2008. cs.ru.nl
4. NXP Semiconductors — MIFARE product family overview. nxp.com
5. NXP Semiconductors — MIFARE DESFire EV3 product datasheet. nxp.com/MIFARE-DESFire-EV3
6. Common Criteria — MIFARE DESFire EV3 EAL5+ certificate. commoncriteriaportal.org
7. NIST Special Publication 800-38B — CMAC mode of operation (used by DESFire AES-128 transactions). csrc.nist.gov/sp/800-38b

RFIDAK supplies RFID smart cards with all MIFARE chip variants and can help you select the solution for your application. We also offer MIFARE keyfobs and wristbands for alternative form factors. Contact us for samples and pricing.