How RFID Keyfobs Work For Access Control?

 

The Four Layers Between a Fob and an Open Door

 

Each layer owns a different decision, fails in a different way, and is fixed by a different party. Reading this table top to bottom is the fastest way to know who you should be calling.

 

Layer	The decision it owns	What it looks like when this layer refuses	Who can change it
The credential (the fob)	Which chip, which frequency, and what data the chip will hand back when asked.	No reaction at all. No beep, no LED change, as though nothing was presented.	The credential supplier, at order time. Fixed chips cannot be changed afterwards.
The reader	Which RFID technologies it can energise and interpret, and in what format it forwards the result.	A reaction but no transmission, or an inconsistent one - reads at one door, not at another with a different reader model.	The installer, through reader model selection or firmware and output configuration.
The controller and software	Whether the received number belongs to an enrolled user with rights to this door at this time.	A clean read - beep and LED - followed by a denial. Often an event appears in the log.	The system administrator, through enrolment, formats, schedules and door groups.
The lock, relay or barrier	What physically happens once authorisation is granted.	A granted event in the log, but the door still does not move.	The door hardware contractor, through wiring, power supply and fail-safe/fail-secure behaviour.

 

The order matters. A layer can only refuse something that reached it, so a failure at the credential layer never produces a log entry, and a failure at the lock layer always does.

 

What Happens in the Half Second at the Door

 

Most door-entry fobs are passive: there is no battery inside. The reader continuously emits a radio field, and the antenna coil inside the fob draws enough energy from that field to power the chip for as long as it stays in range. That is why presentation distance, orientation and nearby metal all change behaviour - they change how much energy the coil can collect.

 

1. The reader generates a low-frequency or high-frequency field around the presentation area.
2. The fob enters the field, its antenna harvests energy, and the chip powers up.
3. The chip answers according to its protocol. For 13.56 MHz proximity credentials, the transmission protocol and the activation and deactivation sequence are defined by ISO/IEC 14443-4:2018, published in 2018 and covering Type A and Type B proximity objects. Low-frequency 125 kHz chips such as EM4200 or T5577 follow their own simpler schemes.
4. The reader converts that answer into whatever output format it has been configured for and sends it up the wire.
5. The controller or management software checks the received value against enrolled users, door groups, schedules and status rules.
6. If the check passes, the controller closes a relay and the lock, gate, turnstile or elevator responds.

 

Steps one to three are radio. Steps four to six are data. Confusing the two is the single most common reason a compatibility discussion goes in circles.

 

The Number Printed on the Fob Is Not Always the Number the Controller Sees

 

Three different numbers are usually in play at once, and treating them as one number is what turns a correct order into a batch that reads but is never recognised.

 

The number	Where it lives	Why it causes confusion
The chip UID or serial	Fixed in the chip at manufacture, or programmed into a writable chip.	Often displayed in hexadecimal by one tool and in decimal by another, producing two "different" numbers for the same fob.
The credential value the controller stores	In the access database, usually as a facility or site code plus a card number, in a defined bit length.	It is derived from the chip data through the reader's output format. Change the format and the same chip produces a different stored value.
The number printed or lasered on the shell	On the outside of the fob, for humans issuing and recovering it.	It is whatever the supplier was told to print. It may match the UID, the card number, an employee ID, or nothing at all.

 

A replacement order should therefore say which of these three the printed number must equal, and whether the encoded value is supplied as a range, a list, or an import file for the software. "Make the same number as this sample" is not enough information to manufacture from.

 

Frequency Is the Fob-to-Reader Link. Wiegand and OSDP Are the Reader-to-Controller Link.

 

These are two different layers and they are chosen independently. Frequency describes how the fob and reader talk over the air. Wiegand, OSDP, RS-485 or TCP/IP describe how the reader talks to the controller over a cable. A 125 kHz reader and a 13.56 MHz reader can both output a 26-bit Wiegand number, and they still cannot read each other's credentials.

 

OSDP is the modern option at the cable layer. According to the Security Industry Association's OSDP standard, which maintains the specification, OSDP is an open communications standard used between access-control panels and peripheral devices such as card readers; it was approved by the IEC in May 2020 and published as IEC 60839-11-5:2020, and version 2.2.2 was released in October 2024. Its Secure Channel mode supports AES-128 encryption. Legacy Wiegand offers none of that, which is why a reader-to-controller upgrade is a separate project from a credential upgrade, with its own wiring and firmware implications.

 

125 kHz, 13.56 MHz and dual-frequency

 

125 kHz (LF). The right answer when the installed reader base is low-frequency and the risk profile is low - apartment lobbies, gyms, storage, shared amenity doors. Many common LF credentials return a fixed identifier with no authentication step, so they should not be the only control on a server room, laboratory or cash-handling area.

 

13.56 MHz (HF). The smart-card family, including MIFARE, DESFire, NTAG and ICODE products across the ISO/IEC 14443 and ISO/IEC 15693 families. HF makes stronger authentication and read/write memory possible, but it does not deliver them automatically - the specific chip and the reader's application configuration decide that.

 

Dual-frequency. One fob carrying both an LF and an HF chip, used when a site is upgrading readers in phases and one credential has to work on old and new doors during the transition. Both sides must be encoded and tested against the real readers before mass production; dual-frequency key fobs that carry both a 125 kHz and a 13.56 MHz chip are typically supplied with a defined chip pairing, so the pairing has to be specified rather than assumed.

 

For a fuller treatment of the trade-offs and migration paths, see the guide to choosing the right frequency for RFID key fobs.

 

What the Security Tier Actually Changes

 

The plastic housing decides nothing about security. What decides it is how much work the reader makes the chip do before it accepts an answer.

 

Tier	What the reader checks	Where it is a reasonable choice	The condition that makes it a bad choice
Fixed identifier only	A static value the chip returns to anyone who asks.	Low-risk perimeter doors, basic attendance, simple membership.	Any door where being read by a passer-by is equivalent to being copied.
Formatted credential number	Facility code, card number and bit length interpreted through a defined output format.	Standard commercial door systems with managed enrolment.	It constrains who is enrolled, not who can reproduce the value.
Protected memory or sector data	Configured blocks or sectors released only against a key or password.	Membership, hotel, campus and multi-use systems.	Default or shared keys left in place, which removes the protection entirely.
Authenticated application	Mutual authentication against a secure application before any data is released.	Enterprise access and higher-security sites.	Requires reader-side support, an application file design and controlled key management - it cannot be added to the fob alone.

 

The top tier is a concrete specification, not a marketing tier. NXP's published specification for MIFARE DESFire EV3 states a contactless interface compliant with ISO/IEC 14443-2/3 A, support for DES, 2K3DES, 3K3DES and AES with hardware AES using 128-bit keys, and Common Criteria EAL5+ certification for hardware and software. Those properties only take effect if the reader is configured to use them; a DESFire fob read as a bare UID is a fixed-identifier credential in an expensive shell.

 

For how authentication, encryption and memory locking differ in practice, and what key management a buyer should ask for, see how authentication, encryption and key management differ.

 

Why "It Reads" and "It Opens" Are Two Different Events

 

A beep confirms that the radio layer worked. It says nothing about whether the controller accepted what arrived. Matching the symptom to the layer removes most of the guesswork.

 

What you observe	Most likely layer	Typical cause	What to check next
No beep, no LED, no log entry, at any door	Credential or reader radio layer	Wrong frequency, or a chip family the reader does not support. A 13.56 MHz fob is invisible to a 125 kHz-only reader.	Confirm the reader's supported technologies against the chip actually fitted in the fob, not against the product name.
Reads at one door, nothing at another	Reader	Mixed reader models or firmware across the site, common during phased upgrades.	Record which reader models work and which do not before changing anything about the fob.
Beep and LED, then denied, with an event in the log	Controller or software	Bit format, facility code, number range or decimal/hex conversion differs from what is enrolled; or the user, schedule or door group is wrong.	Compare the raw value in the log against the value enrolled in the database.
Beep and LED, denied, and nothing appears in the log	Reader-to-controller interface	Output interface or wiring mismatch - the reader answered but the controller never received a usable message.	Verify the reader's output setting and the controller's expected interface, Wiegand bit length or OSDP address.
Secure HF fob denied while a basic fob works on the same door	Reader application configuration	The reader does not hold the application ID, keys or memory locations the secure credential requires.	Confirm the reader was provisioned for that application, not only for the chip family.
Works only when held very close, or slowly	Physical layer	Metal keyrings, phones or a small antenna in a compact housing reducing coupling.	Retest the same fob alone, away from metal, before concluding anything about the batch.
Granted in the log, door does not move	Lock, relay or power	Wiring, power supply, or fail-safe/fail-secure behaviour.	This is door hardware, not a credential problem.

 

Finding the Failing Layer on Your Own Door

 

Work outward from the fob and stop at the first step that changes the result. Testing in this order avoids the common trap of changing three things at once and learning nothing.

 

1. Present a known-good existing credential at the same door. If it also fails, the problem is not the new fobs.
2. Present the new fob on its own, off the keyring and away from a phone. This isolates physical coupling.
3. Present the new fob at a second door with a different reader model, if the site has one. A difference here points at the reader layer.
4. Open the event log immediately after a failed attempt. Presence or absence of an entry splits the problem into "the controller heard it" or "it never arrived".
5. If an entry exists, compare the raw value recorded against the value enrolled for that user, in the same number base. Most denials with a log entry are a format or conversion difference.
6. If no entry exists, check the reader's output configuration and the controller's expected interface before touching the credential specification.

 

Whatever the outcome, record the reader model, the controller's expected format, the enrolled value and the raw value observed. That set of four facts is what a credential supplier needs in order to reproduce a working fob, and it is the same set that approving a sample key fob before mass production is designed to lock down before a batch is made.

 

 

Specifying an access control key fob starts at the installed system, not at the fob. Reader model, controller format, chip protocol, credential value and enrolment method decide whether it works; housing, printing, numbering and packaging decide how convenient it is to live with. Getting the first list right is what prevents the most expensive outcome - a batch that looks correct in the box and is refused at the door.