RFID Access Control Cards 2026: Chip Selection, Encoding & Sourcing
How to choose RFID access control cards for offices, apartments, campuses and secure facilities, covering chip selection, credential formats, encoding and supplier evaluation.
Quick Answer
RFID access control cards run on LF 125 kHz (EM4100, T5577, HID Prox), HF 13.56 MHz (MIFARE Classic, MIFARE DESFire EV2/EV3, ICODE), or dual-frequency configurations. Chip selection determines security strength — Classic is broken since 2008 (legacy ID only); DESFire EV2/EV3 with AES-128 is the current default for office, campus, and high-security access. Card body in PVC, ABS clamshell, or eco materials.
Why chip selection drives the entire access control card decision
Access control projects succeed or fail at the chip compatibility stage. A card that looks right but carries the wrong chip will not authenticate with the installed reader. Before choosing print finish, branding or pricing, buyers must confirm the credential protocol required by their access control system.
The three most common frequency families in access control are LF (125 kHz), HF (13.56 MHz) and dual-frequency combinations. Each serves a different generation of reader hardware.
The Access Control Reader Ecosystem: HID, AMAG, Genetec, Lenel
Most access control buyers are not buying a "card" in isolation — they’re buying credentials that must work with an installed reader and access management software (ACS). The reader and ACS vendor decides which chip families and credential formats are acceptable. Five vendors dominate the global mid-to-enterprise market:
- HID Global — the largest vendor; their iCLASS, iCLASS SE, and SEOS credentials are proprietary HF formats. HID Prox (LF 125 kHz) is the legacy line. HID readers also accept generic MIFARE Classic / DESFire if firmware allows.
- AMAG Symmetry — mid-enterprise ACS popular in finance and government. Reader-agnostic via OSDP; commonly paired with HID, Identiv, or generic MIFARE DESFire credentials.
- Genetec Synergis — software-led ACS that works with any OSDP-compliant reader. The credential choice is wide open: any HF chip family the reader supports.
- Lenel S2 (Honeywell) — large enterprise ACS often deployed alongside Mercury Security boards. Compatible with HID, MIFARE, and OSDP credentials.
- Honeywell Pro-Watch & Bosch BIS — European-strong vendors with similar wide credential compatibility through Mercury or proprietary boards.
The practical workflow: identify the reader+ACS vendor first, get the supported credential list from your integrator, then source cards that exactly match. Generic MIFARE DESFire EV2/EV3 + OSDP-compliant readers is the most flexible new-build path. HID iCLASS SE / SEOS is more locked-in but offers strong vendor support.
Wiegand vs OSDP: Reader-Card Communication Protocols
How the reader talks to the access control panel matters as much as the chip on the card. Two protocols dominate the wire-side of access control:
- Wiegand 26-bit / 32-bit — the legacy standard since the 1980s. One-way communication, no encryption, vulnerable to tap-and-replay attacks via "ESPKey" devices. Most pre-2015 buildings run on Wiegand. Replacing requires re-cabling readers.
- OSDP (SIA Open Supervised Device Protocol) v2 — the modern standard since 2014, with encrypted reader-to-controller communication, supervised connections, and bidirectional data flow. SIA OSDP v2.2 (2020) added Secure Channel for end-to-end encryption.
For new-build access control in 2026, OSDP is the right answer. The cards themselves don’t change between Wiegand and OSDP — the difference is in the reader’s wire protocol back to the panel. New buildings should specify OSDP-capable readers; legacy buildings can swap readers without replacing card stock.
LF access cards - 125 kHz
Legacy proximity cards operating at 125 kHz remain installed in millions of buildings worldwide. Common chip types include EM4100, EM4200, T5577 and HID-compatible 26-bit formats.
- Pros: lowest cost, broadest legacy compatibility
- Cons: easily cloned, no encryption, short read range
- Best for: budget-sensitive replacements where the reader system is not being upgraded
RFIDAK supplies LF proximity cards, keyfobs and clamshell cards compatible with most 125 kHz reader systems.
HF access cards - 13.56 MHz
Modern access control systems increasingly use HF credentials for better security and multi-application support. The dominant chip families are:
MIFARE Classic
The most widely deployed HF access card chip. MIFARE Classic 1K/4K offers a cost-effective upgrade from LF with basic cryptographic authentication. Suitable for standard office, apartment and parking access where Crypto-1 security is acceptable.
MIFARE DESFire EV2/EV3
For high-security environments, including corporate campuses, government, healthcare and finance, DESFire provides AES-128 encryption, mutual authentication and multi-application support. A single DESFire card can combine building access, parking, cafeteria payment and time-and-attendance.
iCLASS and SEOS
HID Global's proprietary credential families for enterprise access control. If your system uses HID readers, confirm whether iCLASS SE or SEOS credentials are required.
Dual-frequency and mobile credentials
Many upgrade projects use dual-frequency cards (125 kHz + 13.56 MHz) to bridge legacy and new readers during a phased migration. Mobile credentials via smartphone NFC are also growing, but most deployments still issue physical cards as the primary or backup format.
Card format and customization options
| Option | Details |
|---|---|
| Standard PVC card | CR80 size (85.5 × 54 mm), 0.84 mm thick — most common |
| Clamshell card | Thicker, more durable, often used with LF chips |
| Photo ID badge | Direct-to-card or retransfer printed with employee photo |
| Custom shape | Die-cut or non-standard for branded programs |
| Printing | Offset (bulk), digital (short runs), or blank for on-site printing |
| Add-ons | Magnetic stripe, hologram, UID numbering, QR code, lanyard slot |
Encoding and credential management
Cards can ship blank (for on-site encoding by the access control system) or pre-encoded with site codes, facility codes or serialized credential numbers. Clarify with your integrator whether the system programs cards at the front desk or requires factory encoding.
Evaluating a card supplier for access control
- Can they provide the exact chip model required by your reader?
- Will they send free samples for compatibility testing?
- Do they support both small (100+) and large (50,000+) order volumes?
- Can they maintain consistent chip sourcing and print quality across reorders?
- Do they have export experience and relevant certifications (ISO 9001)?
For a detailed sourcing checklist, see our guide to ordering RFID cards from China.
When a keyfob or wristband is a better fit
Cards are the default format for access control, but not always the best one. Keyfobs work well for apartment residents and gym members. Wristbands are ideal for resorts and events. See our cards vs keyfobs comparison for decision guidance.
Real-World Access Control Deployments
The card-and-reader choices that work in production span four very different verticals. Each illustrates how the chip, card format, and reader vendor lock together:
Corporate enterprise (Big Tech & finance)
Microsoft, Google, and major banks standardised on HID iCLASS SE / SEOS + photo ID badges with OSDP readers since 2018–2022. Mobile credentials via Apple Wallet / Google Wallet are layered on top for hybrid issuance. Card lifecycle: 3–5 years per badge until employee turnover.
University campuses (US + Europe)
Most major universities standardised on MIFARE DESFire EV2/EV3 by 2018–2020. The card combines library access, dining, residence hall entry, printing credit, and athletic facility access on multiple DESFire applications. Single-card multi-application is the canonical DESFire use case.
Multi-family residential (apartment chains)
Apartment property managers commonly mix LF EM4100 keyfobs (legacy) for tenants in older buildings with HF MIFARE Plus or DESFire in newer builds. Mobile credentials via Salto KS or Latch are increasingly common for short-term rentals and Airbnb-style operations.
Healthcare facilities
Hospitals migrated heavily from MIFARE Classic to DESFire EV2/EV3 between 2018–2024 due to HIPAA-driven security audits. The same DESFire card now controls building access, EHR workstation login, drug cabinet access, and meal-plan payment — a multi-application convergence that justifies the higher per-card cost.
Final takeaway
Related guides
Mifare Classic vs DESFire • Keyfob buying guide • Hotel key card guide
Key Takeaways
- Reader-first: HID iCLASS, OMNIKEY, Indala, Awid, Lenel, Genetec, AMAG — verify protocol BEFORE ordering custom cards.
- LF 125 kHz: legacy installations (>5 years old) — EM4100/T5577 cards $0.05–$0.20.
- HF MIFARE Classic 1K: low-security ID, $0.10–$0.30 — Crypto-1 publicly broken, legacy only.
- HF DESFire EV2/EV3: AES-128 secure access, $0.50–$1.50 — payment + access dual-application.
- Dual-frequency (LF+HF combi): multi-system buildings during legacy-to-modern migration — one card opens both old and new readers.
⚠️ Common pitfall
Migrating from EM4100 (LF) to MIFARE DESFire (HF) requires verifying every reader supports HF. Not all legacy LF-only readers can read HF cards. Always test one reader-and-card pair before ordering bulk reissue.
Access Control Card FAQ
How do I identify my reader’s protocol and chip compatibility?
Three approaches: (1) read the reader label or datasheet — most readers list supported credentials on a sticker or in the manual; (2) send a sample card to your supplier for chip identification; (3) ask your access control integrator — they should know exactly which credentials are programmed in the panel. Don’t guess from reader appearance — LF and HF readers can look identical.
Can I issue access control cards from my own desktop?
Yes — this is the standard workflow for organizations issuing 100+ cards per year. You need a desktop reader-writer (D-Logic µFR Classic CS or Identiv uTrust) plus your access control software (HID Origo, AMAG Symmetry, etc.). For high-quality photo ID badges, add a card printer (Fargo HDP5000, Zebra ZC350, Magicard) for $1,500–$5,000.
Mobile credential vs physical card — which is better?
For new buildings, mobile credentials (Apple Wallet, Google Wallet, vendor app) are increasingly the default. They eliminate card issuance overhead and can be revoked instantly. Physical cards remain required for visitor access, contractors, retail/customer-facing roles, and as backup if a phone battery dies. Most modern deployments are hybrid: mobile primary, physical backup.
How long does an access control card last in daily use?
PVC photo ID badges typically last 3–5 years on a daily-carry lanyard before edge wear, print fade, or cracking around the chip cavity. Clamshell cards (thicker plastic shell) last 5–8 years. The chip itself is rated for 100,000+ read/write cycles — physical wear is the lifecycle limit, not chip lifetime.
What happens if I lose my access control card?
Standard procedure: report the loss to your facility / building manager, who deactivates the lost card’s credential ID in the access control system. The lost card stops working at all readers within minutes. A replacement card is issued with a new credential ID. For high-security environments, lost cards trigger an audit log review of recent attempted entries.
Sources
- HID Global — iCLASS SE & SEOS credential datasheet. hidglobal.com/credentials
- ISO/IEC 14443-1..4:2018 — HF proximity cards (13.56 MHz). iso.org/standard/73598.html
- ISO/IEC 15693:2018 — HF vicinity cards. iso.org/standard/73602.html
- SIA OSDP — Open Supervised Device Protocol. securityindustry.org/osdp
- NXP Semiconductors — MIFARE product family overview. nxp.com/mifare-ics
- NIST SP 800-116 — A Recommendation for the Use of PIV Credentials. csrc.nist.gov/sp/800-116
- IDTechEx — "RFID Forecasts, Players and Opportunities 2024-2034" (access control segment). idtechex.com
The right access control card matches your reader, security requirements and issuance workflow. RFIDAK manufactures RFID cards, keyfobs, and clamshell cards for access control. Contact us for compatibility testing samples.
Need help turning this guidance into a product shortlist?
Use this next step when the article has narrowed the direction and you now need help choosing chips, formats, samples or the closest product family.
Comparison Pages
Compare the closest alternatives before you request samples
Open one of these if the article clarified the topic but the team still needs a cleaner format, chip or frequency decision.
Quick FAQ
Questions buyers often ask after reading this guide
Which RFID chip works in my access control reader?
Send a live working credential to the supplier for chip identification before ordering new cards. HID Global readers typically require HID Prox (LF) or iCLASS SE/SEOS (HF). ASSA ABLOY, dormakaba and SALTO readers use MIFARE Classic, Ultralight C or DESFire EV3. Brivo and Genetec support mixed chip families per site configuration. Legacy buildings still use 125 kHz EM4100 with 26-bit Wiegand; confirm the specific format before ordering because EM4100 and HID Prox use different encoding.
Which is more secure: MIFARE Classic or DESFire EV3?
DESFire EV3 is significantly more secure. MIFARE Classic uses the broken Crypto-1 cipher (public attacks since 2008, card cloning with inexpensive hardware). DESFire EV3 uses AES-128 with mutual authentication and Common Criteria EAL5+ certification. For new regulated access, healthcare, government or data center projects, specify DESFire EV3 at $0.70-$2.50 per card. Classic 1K at $0.15-$0.25 remains acceptable for low-risk workflows like gym access where a cloned card causes no real damage.
Can I use one card for multiple access systems?
Yes, through two paths. Dual-frequency cards (125 kHz + 13.56 MHz) work on both legacy LF and modern HF readers during migration at $0.80-$1.80 per card premium. MIFARE DESFire EV3 supports up to 28 independent applications on one chip with per-application AES-128 keys, so a single card can carry access for office, parking, gym, cafeteria and time-and-attendance. Multi-application requires the reader fleet to support DESFire Security Level 3.
How much do RFID access control cards cost?
At 10,000+ unit volume: EM4100 LF $0.15-$0.30, T5577 LF $0.20-$0.40, HID Prox LF $0.80-$2.00, MIFARE Classic 1K $0.15-$0.25, MIFARE Plus SE $0.40-$0.70, MIFARE DESFire EV3 8K $0.70-$2.50, HID iCLASS SE $1.50-$3.50, HID SEOS $2.50-$4.00, dual-frequency $0.80-$1.80. Photo ID printing adds $0.20-$0.50 per card. Wood or metal premium materials add 30-100%. Custom print and UID serialization add 20-50%.
Should I buy blank or pre-encoded access cards?
Depends on the access management system. Blank cards ship fastest and cost least; on-site encoding via desktop reader/writer gives full control. Pre-encoded factory cards arrive with site code, facility code or serialized credential numbers ready for issuance; this saves training but requires AMS vendor sign-off on the encoding scheme. For multi-building enterprise rollouts with thousands of cards, pre-encoded batches save weeks of front-desk labor. For small offices, blank cards are usually better.
Can I print a photo on an RFID access card?
Yes. Standard PVC RFID cards work with direct-to-card (DTC) or retransfer photo ID printers from Fargo, Magicard, Zebra, Datacard and Evolis. Direct-to-card printing at $0.20-$0.40 per card is the most common. Retransfer printing at $0.40-$0.70 per card gives better edge-to-edge coverage. Clamshell cards (1.8 mm thick) do not fit standard card printers and typically carry a separate adhesive photo ID label. Test printer compatibility with the specific card chip before ordering bulk.
How do I migrate from 125 kHz to MIFARE DESFire access cards?
Use a three-phase approach over 12-24 months. Phase 1: audit reader firmware; most HID, ASSA ABLOY and dormakaba readers support DESFire with firmware update. Phase 2: issue dual-frequency cards (125 kHz + 13.56 MHz) so users work on both legacy and upgraded doors. Phase 3: upgrade reader firmware to DESFire native mode and retire LF credentials. Alternative: issue DESFire EV3 cards in Security Level 1 emulation mode (Classic-compatible) first, then upgrade reader firmware.
What is the minimum order for access control cards?
RFIDAK typical MOQ is 500 pieces for stock EM4100, T5577 and MIFARE Classic 1K PVC cards, 1,000 pieces for custom-printed PVC cards with full-color artwork, 500 pieces for DESFire EV3 with factory AES keys, 1,000 pieces for dual-frequency and 2,000 pieces for photo ID cards with variable printing. Sample quantities of 20-50 pieces free for B2B evaluation including reader compatibility testing. Lead time is 2-3 weeks for stock Classic and LF, 3-4 weeks for photo ID, 4-6 weeks for DESFire EV3 AES.
Author
Wei Chen
RFID Applications Engineer at RFIDAK
Wei Chen is an RFID applications engineer at RFIDAK with 10+ years in RFID card and tag manufacturing in Shenzhen, focused on chip selection, laundry RFID durability testing and access-control compatibility.
