
RFID Access Control Cards 2026: Chip Selection, Encoding & Sourcing
How to choose RFID access control cards for offices, apartments, campuses and secure facilities, covering chip selection, credential formats, encoding and supplier evaluation. Plus the questions to settle before ordering.
Quick Answer
RFID access control cards run on LF 125 kHz (EM4100, T5577, HID Prox), HF 13.56 MHz (MIFARE Classic, MIFARE DESFire EV2/EV3, ICODE), or dual-frequency configurations. Chip selection determines security strength — Classic is broken since 2008 (legacy ID only); DESFire EV2/EV3 with AES-128 is the current default for office, campus, and high-security access. Card body in PVC, ABS clamshell, or eco materials.
Why chip selection drives the entire access control card decision
Here is the uncomfortable truth of every badge project: the door does not care about your logo, your brand colors, or that very tasteful matte finish. It reads the chip, authenticates the chip, and judges you entirely on the chip. A card that looks right but carries the wrong silicon will be rejected with the quiet indifference only a wall-mounted reader can muster. So before choosing print finish, branding or pricing, confirm the credential protocol required by your access control system — everything else is upholstery.
Three frequency families do the actual door-opening: LF (125 kHz), HF (13.56 MHz) and dual-frequency combinations. Each serves a different generation of reader hardware — think of them as three eras of doorman, all still on the payroll.
The Access Control Reader Ecosystem: HID, AMAG, Genetec, Lenel
Nobody really buys a "card" in isolation — you buy a ticket into an ecosystem. Your credentials must work with an installed reader and access management software (ACS), the reader and ACS vendor decides which chip families and credential formats are acceptable, and your preferences are warmly noted and then ignored. Five vendors dominate the global mid-to-enterprise market:
- HID Global — the largest vendor; their iCLASS, iCLASS SE, and SEOS credentials are proprietary HF formats. HID Prox (LF 125 kHz) is the legacy line. HID readers also accept generic MIFARE Classic / DESFire if firmware allows.
- AMAG Symmetry — mid-enterprise ACS popular in finance and government. Reader-agnostic via OSDP; commonly paired with HID, Identiv, or generic MIFARE DESFire credentials.
- Genetec Synergis — software-led ACS that works with any OSDP-compliant reader. The credential choice is wide open: any HF chip family the reader supports.
- Lenel S2 (Honeywell) — large enterprise ACS often deployed alongside Mercury Security boards. Compatible with HID, MIFARE, and OSDP credentials.
- Honeywell Pro-Watch & Bosch BIS — European-strong vendors with similar wide credential compatibility through Mercury or proprietary boards.
The practical workflow: identify the reader+ACS vendor first, get the supported credential list from your integrator, then source cards that exactly match. Generic MIFARE DESFire EV2/EV3 + OSDP-compliant readers is the most flexible new-build path. HID iCLASS SE / SEOS is more locked-in but offers strong vendor support.
Wiegand vs OSDP: Reader-Card Communication Protocols
How the reader talks to the access control panel matters as much as the chip on the card — and the wire side is a two-horse race between a 1980s veteran who never learned to whisper and a modern professional with end-to-end manners:
- Wiegand 26-bit / 32-bit — the legacy standard since the 1980s. One-way communication, no encryption, vulnerable to tap-and-replay attacks via "ESPKey" devices. Most pre-2015 buildings run on Wiegand. Replacing requires re-cabling readers.
- OSDP (SIA Open Supervised Device Protocol) v2 — the modern standard since 2014, with encrypted reader-to-controller communication, supervised connections, and bidirectional data flow. SIA OSDP v2.2 (2020) added Secure Channel for end-to-end encryption.
For new-build access control in 2026, OSDP is the right answer — not a spicy take, just the industry consensus. Comfortingly, the cards themselves don’t change between Wiegand and OSDP — the difference is in the reader’s wire protocol back to the panel. New buildings should specify OSDP-capable readers; legacy buildings can swap readers without replacing card stock, so the card drawer survives the upgrade.
LF access cards - 125 kHz
The 125 kHz proximity card is the office veteran: hired decades ago, still clocking in, and installed in millions of buildings worldwide. Common chip types include EM4100, EM4200, T5577 and HID-compatible 26-bit formats — names your reader learned young and never forgot.
- Pros: lowest cost, broadest legacy compatibility
- Cons: easily cloned, no encryption, short read range
- Best for: budget-sensitive replacements where the reader system is not being upgraded
RFIDAK supplies LF proximity cards, keyfobs and clamshell cards compatible with most 125 kHz reader systems.
HF access cards - 13.56 MHz
HF 13.56 MHz is where access control went after it discovered cryptography. Modern systems increasingly use HF credentials for better security and multi-application support — and the cast list is short:
MIFARE Classic
The most widely deployed HF access card chip. MIFARE Classic 1K/4K offers a cost-effective upgrade from LF with basic cryptographic authentication. Suitable for standard office, apartment and parking access where Crypto-1 security is acceptable.
MIFARE DESFire EV2/EV3
For high-security environments, including corporate campuses, government, healthcare and finance, DESFire provides AES-128 encryption, mutual authentication and multi-application support. A single DESFire card can combine building access, parking, cafeteria payment and time-and-attendance.
iCLASS and SEOS
HID Global's proprietary credential families for enterprise access control — the walled garden with excellent landscaping. If your system uses HID readers, confirm whether iCLASS SE or SEOS credentials are required before ordering anything generic.
Dual-frequency and mobile credentials
Dual-frequency cards (125 kHz + 13.56 MHz) are the bilingual diplomats of a phased migration — one card that greets legacy readers in LF and new readers in HF, so nobody gets locked out mid-upgrade. Mobile credentials via smartphone NFC are also growing, but most deployments still issue physical cards as the primary or backup format, because phone batteries have strong opinions about 6 pm.
Card format and customization options
Once the chip is settled, the fun part begins — deciding what the plastic itself should be:
| Option | Details |
|---|---|
| Standard PVC card | CR80 size (85.5 × 54 mm), 0.84 mm thick — most common |
| Clamshell card | Thicker, more durable, often used with LF chips |
| Photo ID badge | Direct-to-card or retransfer printed with employee photo |
| Custom shape | Die-cut or non-standard for branded programs |
| Printing | Offset (bulk), digital (short runs), or blank for on-site printing |
| Add-ons | Magnetic stripe, hologram, UID numbering, QR code, lanyard slot |
Encoding and credential management
Cards can ship blank (for on-site encoding by the access control system) or pre-encoded with site codes, facility codes or serialized credential numbers. It is a one-question decision with a two-week consequence: ask your integrator whether the system programs cards at the front desk or requires factory encoding — and ask before the cards are on a boat.
Evaluating a card supplier for access control
Five questions separate a credential partner from a vendor with a spreadsheet:
- Can they provide the exact chip model required by your reader?
- Will they send free samples for compatibility testing?
- Do they support both small (100+) and large (50,000+) order volumes?
- Can they maintain consistent chip sourcing and print quality across reorders?
- Do they have export experience and relevant certifications (ISO 9001)?
For a detailed sourcing checklist, see our guide to ordering RFID cards from China.
When a keyfob or wristband is a better fit
Cards are the default format for access control, not a law of physics. Keyfobs work well for apartment residents and gym members who already carry keys everywhere. Wristbands are ideal for resorts and events, where pockets are optional. See our cards vs keyfobs comparison for decision guidance.
Illustrative access-control evaluations
For an office badge program, obtain the installed reader and controller models, supported credential profile, key plan and issuance policy. For a campus, list each proposed access or service application and confirm which system owner can authorize it. For housing or healthcare facilities, test enrollment, denied access, lost-card revocation and emergency fallback on the actual doors before ordering. These are evaluation scenarios, not claims about named employers, universities or hospitals. A credential does not by itself satisfy a privacy or healthcare regulation.
Final takeaway
Related guides
Mifare Classic vs DESFire • Keyfob buying guide • Hotel key card guide
Key Takeaways
- Reader-first: HID iCLASS, OMNIKEY, Indala, Awid, Lenel, Genetec, AMAG — verify protocol BEFORE ordering custom cards.
- LF 125 kHz: inspect the installed reader and exact credential protocol; frequency alone does not ensure compatibility.
- HF MIFARE Classic 1K: a legacy Crypto-1 credential with published weaknesses; evaluate continued use against the site threat model.
- HF DESFire EV2/EV3: evaluate the exact supported AES credential, keys, reader firmware and issuance software before ordering.
- Dual-frequency (LF+HF combi): multi-system buildings during legacy-to-modern migration — one card opens both old and new readers.
⚠️ Common pitfall
Migrating from EM4100 (LF) to MIFARE DESFire (HF) requires verifying every reader supports HF. Not all legacy LF-only readers can read HF cards. Always test one reader-and-card pair before ordering bulk reissue.
Access Control Card FAQ
How do I identify my reader’s protocol and chip compatibility?
Three approaches: (1) read the reader label or datasheet — most readers list supported credentials on a sticker or in the manual; (2) send a sample card to your supplier for chip identification; (3) ask your access control integrator — they should know exactly which credentials are programmed in the panel. Don’t guess from reader appearance — LF and HF readers can look identical.
Can I issue access control cards from my own desktop?
In-house issuance requires a supported reader-writer, access software and any necessary photo-card printer. Confirm chip commands, keys, print quality and operator workflow with the installed system, then obtain current equipment and card quotes.
Mobile credential vs physical card — which is better?
For new buildings, mobile credentials (Apple Wallet, Google Wallet, vendor app) are increasingly the default. They eliminate card issuance overhead and can be revoked instantly. Physical cards remain required for visitor access, contractors, retail/customer-facing roles, and as backup if a phone battery dies. Most modern deployments are hybrid: mobile primary, physical backup.
How long does an access control card last in daily use?
PVC photo ID badges typically last 3–5 years on a daily-carry lanyard before edge wear, print fade, or cracking around the chip cavity. Clamshell cards (thicker plastic shell) last 5–8 years. The chip itself is rated for 100,000+ read/write cycles — physical wear is the lifecycle limit, not chip lifetime.
What happens if I lose my access control card?
Standard procedure: report the loss to your facility / building manager, who deactivates the lost card’s credential ID in the access control system. The lost card stops working at all readers within minutes. A replacement card is issued with a new credential ID. For high-security environments, lost cards trigger an audit log review of recent attempted entries.
Sources
- HID Global — iCLASS SE & SEOS credential datasheet. hidglobal.com/credentials
- ISO/IEC 14443-1..4:2018 — HF proximity cards (13.56 MHz). iso.org/standard/73598.html
- ISO/IEC 15693:2018 — HF vicinity cards. iso.org/standard/73602.html
- SIA OSDP — Open Supervised Device Protocol. securityindustry.org/osdp
- NXP Semiconductors — MIFARE product family overview. nxp.com/mifare-ics
- NIST SP 800-116 — A Recommendation for the Use of PIV Credentials. csrc.nist.gov/sp/800-116
- IDTechEx — "RFID Forecasts, Players and Opportunities 2024-2034" (access control segment). idtechex.com
The right access control card is the one your reader recognizes on the first tap: matched to your reader, your security requirements and your issuance workflow, in that order. RFIDAK supplies RFID cards, keyfobs, and clamshell cards for access control. Contact us for compatibility testing samples.
Need help turning this guidance into a product shortlist?
Use this next step when the article has narrowed the direction and you now need help choosing chips, formats, samples or the closest product family.
Comparison Pages
Compare the closest alternatives before you request samples
Open one of these if the article clarified the topic but the team still needs a cleaner format, chip or frequency decision.
Quick FAQ
Questions buyers often ask after reading this guide
Which RFID chip works in my access control reader?
Obtain the exact reader and controller model, enabled credential technology, site format and key-management requirements from the system owner. Check a working credential where authorized, then test the proposed card end to end. Brand names or a shared frequency alone do not establish compatibility.
Which is more secure: MIFARE Classic or DESFire EV3?
MIFARE Classic Crypto-1 has known weaknesses; DESFire EV3 supports modern AES-based application security when configured and managed correctly. Select a credential with the access-system provider’s threat model, reader support and key plan. Even a low-value gym or school credential can be misused, so do not treat cloning as harmless.
Can I use one card for multiple access systems?
A multi-application or dual-frequency card may be possible only when each system owner approves the chip, reader, encoding, security domains and key custody. Test every application on the installed readers and agree how credentials are issued and revoked; a DESFire chip by itself does not bridge unrelated access systems.
How much do RFID access control cards cost?
Unit price depends on the exact chip and inlay, finished construction, approved quantity per design, printing, encoding, packaging and QC requirements. Request a dated itemized quote showing sample and setup charges, unit tiers, freight and lead time; a generic chip or tag price does not establish the cost of the approved product.
Should I buy blank or pre-encoded access cards?
Depends on the access management system. Blank cards ship fastest and cost least; on-site encoding via desktop reader/writer gives full control. Pre-encoded factory cards arrive with site code, facility code or serialized credential numbers ready for issuance; this saves training but requires AMS vendor sign-off on the encoding scheme. For multi-building enterprise rollouts with thousands of cards, pre-encoded batches save weeks of front-desk labor. For small offices, blank cards are usually better.
Can I print a photo on an RFID access card?
Photo printing depends on the finished card surface, thickness, printer technology and chip/antenna placement. Ask the printer vendor for supported card stock and run print and read tests on a finished sample. Quote the chosen print and encoding configuration.
How do I migrate from 125 kHz to MIFARE DESFire access cards?
Start by auditing each installed LF reader, controller, credential format and access application. A dual-frequency credential can be considered while old and upgraded readers coexist, but both sides must be configured and tested. DESFire EV3 does not emulate 125 kHz credentials or MIFARE Classic Security Level 1. Upgrade or replace readers and software where needed, pilot the chosen DESFire credential on actual doors, then retire the LF path after all users and sites have migrated.
What is the minimum order for access control cards?
RFIDAK's published standard card MOQ baseline is 500 pieces. Confirm the exact chip, card construction, printing, encoding and quantity per design in a written quote. Free stock samples (up to 5 pieces) — buyer covers DHL/FedEx freight ($25–60), refunded 1:1 against the first production order over $500. Larger evaluation lots, custom samples, production timing and delivery are agreed separately for the selected configuration.
Author
RFIDAK RFID Editorial Team
RFID supply editorial team
RFIDAK publishes practical RFID guides to help buyers compare chips, product formats, sampling plans and sourcing options before production.

