Access Control Cards and Fobs Explained: Paxton, HID, MIFARE and Salto

Almost every access card or fob has to work with a system that is already on your doors. Choosing the card is the easy part. Matching it to the system is where most problems start. This guide explains the technologies, shows you how to tell which system you have and lists what we need from you to supply cards that work first time.

What is an access control card or fob?

An access control card or fob carries a chip and an antenna. When you hold it near a reader, the reader powers the chip by radio and reads a number from it. The access control system then checks that number and decides whether to open the door. A proximity card (often called a prox card) is the 125kHz version. A smart card is the 13.56MHz version, with memory a system can write its own data to.

The rule that makes the rest easy: the system decides the card

The same chip can sit inside two cards that only work on two different systems, because each system writes its own data to the card. So the brand of the chip tells you very little. What matters is the system, the reader and (for some cards) the way the number is programmed (the format).

Find out the system before you trust a description of the card. Phrases such as "a HID card", "a fob" or "a MIFARE card" are not enough to choose the right product.

125kHz, 13.56MHz and UHF: three frequencies that never mix

A reader only reads its own frequency and technology. A proximity card will not work on a smart-only reader. The reverse is also true.

Dual-technology cards carry a 125kHz chip and a 13.56MHz MIFARE chip in one card, so one card can work on a 125kHz door and on a 13.56MHz system.

There are two low-frequency exceptions. Cotag cards and tags work at 132kHz and the PAC ISO card at 153kHz, so a 125kHz reader will not read them. Buy the genuine token for these systems.

For a closer look at the differences between the chips, see our guide to proximity vs MIFARE vs DESFire.

The chip maker does not tell you the frequency either. NXP makes Hitag (125kHz), MIFARE (13.56MHz) and UCODE (UHF) chips.

How to find out which system you have

• Look for the name on the software, the door reader or the controller. It often gives the model as well, for example Net2 or Switch2, Salto KS or Space.
• Check the back of an existing card or fob for a part number, such as 692-500, 820-010, 4262-0245 or 2000PGGMN.
• Find the label on the original box or a previous invoice. These are often more useful than a photo of the card.
• Ask your installer, who will know the system and the format.
• Still unsure? Send us a card and we will test it to identify the chip and, where it can be read, the format. A few, such as Cotag and some PAC cards, cannot be read this way.

Paxton: three systems, not one

Paxton is one of the systems we are asked about most. It is really three systems that all run at 125kHz. Browse our Paxton fobs and Paxton cards.

• Net2 uses its own cards (692-500, 692-448) and fobs (695-644). Net2 cards carry a unique 8-digit ID and can be enrolled by presenting them at the reader.
• Switch2 needs 820 fobs or 830 cards. Net2 fobs are not compatible with Switch2.
• Paxton10 has its own fobs (010-170) and cards (010-427). Net2 tokens work on Paxton10. Paxton10 tokens do not work on Net2.

How to tell them apart: Switch2 uses "shadow" cards. Switch2 fobs come in green, amber or red. Blue fobs mean Net2 or possibly Paxton10. If in doubt, check the system or the box.

Most Paxton cards and fobs are sold in packs of 10 or 50, so "50 cards" may mean 5 packs. It is worth checking before you order.

HID Prox, iCLASS and Seos: three technologies under one name

"HID" can mean HID Prox at 125kHz. It can also mean iCLASS and Seos at 13.56MHz. HID also offers its own MIFARE products. Ask for the HID part number on the back of the card or on the box label.

HID cards are programmed with your format, site code and number range before they are delivered, so they enrol straight onto your system. See our HID proximity cards, HID iCLASS cards and our guide to access control cards from HID.

Formats in one minute

A format is how the number on a prox card is laid out, like the spaces in a phone number. The common one is 26-bit H10301: a site (facility) code from 0 to 255 and a card number from 0 to 65,535.

• Open formats such as H10301 can be bought by anyone. You choose the site code and the number range. H10320 is also open but has no site code.
• Tracked formats such as H10302 are managed by HID, which never issues the same number twice, so no site code is needed. You get the next numbers available.
• Restricted formats such as H10304 and Corporate 1000 are controlled by a partner or by your own organisation. Corporate 1000 needs written authorisation from the format owner before anyone can supply it.

The same format, site code and number on a different technology is still the wrong card. An iCLASS card can carry exactly the same number as a Prox card and still not work on a Prox system.

MIFARE, DESFire and Fudan: a chip, not a system

MIFARE is a family of 13.56MHz chips made by NXP. Salto, TDSi, PAC and others build systems that use MIFARE chips. Each one writes its own data. A plain MIFARE card will not open a Salto door until it has been encoded for Salto.

• MIFARE Classic 1K and 4K have a factory number (UID) in every chip. Many systems use that UID as the identifier, so there is nothing to program. The 1K memory is split into 16 sectors of 4 blocks. A system can lock each sector with its own keys.
• MIFARE Ultralight is the simplest option. Its memory is very small but every chip has a 7-byte UID.
• MIFARE DESFire (EV1, EV2 and EV3, in 2K, 4K and 8K) is the higher-security family. EV3 is designed to be backwards compatible. A small number of systems expect a particular version, so check first.
• Fudan cards are MIFARE-compatible, made by a different chip maker. They work on most 13.56MHz systems and can be encoded in the same way. If your system checks for genuine NXP chips, choose NXP MIFARE. Browse our MIFARE cards and Fudan cards.

MIFARE Classic 1K and 4K are usually supplied with a 4-byte UID, known as an NUID (non-unique ID), because so many chips have been made. A 7-byte UID can be supplied to order where uniqueness matters.

Salto key cards: several systems that need different cards

Salto KS, Space, Homelok, IDM, HAMS and XS4 can need different tokens. Salto part codes tell you a lot:

The digit after the letters is the memory (2 = 2K, 4 = 4K). Anything 2K is Space only, a code ending KS is for KS. EM means it also has a 125kHz chip. Browse our Salto cards. If your site has a Salto SAM encoder, you can encode standard MIFARE Classic or DESFire cards yourself when you issue them.

PAC, KeyPAC, TDSi, Cotag and others

• PAC and KeyPAC cover KeyPAC tokens at 125kHz, the PAC ISO card at 153kHz, PAC MIFARE and PAC Ops DESFire at 13.56MHz. PAC has changed its part codes several times, so give us your old code and we will find the current one. See our PAC cards.
• TDSi uses 125kHz prox (4262-0245 card) and MIFARE cards encoded in sector 4 (2920-3004). The part number on the back tells you which. See our TDSi cards.
• Cotag works at 132kHz. Buy genuine Cotag cards and tags.
• Kantech ioProx, ACT, Controlsoft and Honeywell each have their own tokens. Depending on the reader, a compatible card programmed to the same format can often be used. We can confirm this before you order.
• Impro, Keri, Urmet, Nedap, AA Prox and others are best matched with their own tokens. Whether anything else works depends on the reader.

UID, CSN and programmed numbers: three different things

If you need a "specific number" on a card, that means programming a format. The factory UID stays as it is. For 13.56MHz cards we can capture UIDs into a data file or print them on the card in decimal or hexadecimal.

Can you copy my card or fob?

Not usually. A factory UID cannot be changed. Encrypted or proprietary cards cannot be copied either. What we can often do is supply new cards that work on your system, programmed to the same format and the next numbers in your range.

Genuine or compatible?

For many systems there is a compatible card that does the same job as the branded one, for example compatible HID Prox cards programmed to H10301 or H10304. There are also compatible Paxton Net2 cards. Compatible cards are not available for every system. Switch2, iCLASS, Seos, PAC and Cotag need the genuine token. Compatible Net2 cards also work on Paxton10.

Printing on access control cards

Most flat ISO access cards can be printed with photo ID, a logo and numbering. Retransfer printing is the best choice for chip cards because the chip can leave a slightly uneven surface. Clamshell cards are too thick to print. An adhesive printed card can be stuck to the front instead. Larger runs can be litho printed.

Wristbands and UHF

Silicone wristbands with a chip inside work well where a card is awkward to carry, such as leisure centres and secure wards. They can carry 125kHz, MIFARE, Salto or DESFire chips. Dual-frequency bands can also be made to order.

UHF is not a door technology. UHF badges and windscreen tags are read from metres away by UHF readers, which suits events, car parks and stock tracking. A door reader will not see them.

What to have ready when you order

1. The system name and model.
2. A photo of the back of a card, the box label or a previous invoice.
3. Whether the system reads the factory UID or a programmed number. If programmed: the format, site code and number range.
4. Card, fob, sticker, clamshell or wristband, plus any colour coding.
5. Printing needs: photo ID, design, numbering, one side or two.
6. Whether you need UIDs captured or printed.
7. If you print your own cards, the printer and software you use.
8. Quantity and the date you need them.

Programmed and printed cards are made to your details and cannot be returned unless they are faulty (see our delivery and returns page), so it pays to confirm everything first.

Frequently asked questions

Will your cards work with my system? Only if they match the system, the reader and, for prox cards, the format. Tell us the system or send a sample to test.

Can you carry on my number range? Yes, for open formats. Give us your site code and the next card number.

Do Paxton Net2 fobs work on Switch2? No. Switch2 needs 820 fobs or 830 cards.

Is MIFARE an access control system? No. MIFARE is a chip. The system decides how it is used.

Can UHF tags open doors? No. Door readers are 125kHz or 13.56MHz.

What frequency are Paxton fobs? Paxton Net2, Switch2 and Paxton10 fobs are all 125kHz. They still are not interchangeable, because each system uses its own tokens.

How do I find my HID facility code? Check your access control software, the label on the original box or a previous invoice. Your installer will also know it. Without it, send us a card to test.

What is the difference between MIFARE Classic and DESFire? Both are 13.56MHz chips from NXP. DESFire offers stronger security and is used where the system is set up for it. Classic is simpler and widely used for ID cards, printing and cashless systems.

Are Paxton cards sold singly or in packs? Most Paxton cards and fobs are sold in packs of 10 or 50, so check the pack size before you order.

If you are not sure what you have, get in touch and send us a sample. We will tell you what it is and what will work.