Access Control Cards: EM 125 kHz vs MIFARE vs DESFire

Many business owners treat access cards as a cheap commodity: if it opens the door, it's fine. In practice the card technology often decides your real security level more than the reader does. Some cards can be copied with a pocket device in a few seconds, and the cardholder never knows.

Here is how the three common technologies differ, and when a cheap card becomes a real risk.

EM cards at 125 kHz

EM cards (EM4100 and similar chips) are the most common in Egypt because they are inexpensive. The card holds a fixed ID number and nothing else: no writable memory, no encryption. Present it, and the reader passes the number to the controller.

That number can be read and written to a programmable blank (such as a T5577 card) with low-cost copiers. EM cards are fine for low-risk doors: a residential building entrance, a gym, attendance in a small workshop. Not for a server room or a cash office.

Read range on typical readers is a few centimetres, and nearby metal reduces it.

Watch the number printed on many EM cards: it is often the same ID the card transmits, so a clear photo of the card can be enough to program a copy. For sensitive sites, order cards without a printed number.

MIFARE Classic at 13.56 MHz

MIFARE Classic follows ISO/IEC 14443-A. The popular 1K version has 1 KB of memory in 16 key-protected sectors. On paper that beats EM, but two facts matter:

• Its Crypto1 cipher was publicly broken in 2008, and key recovery tools are widely known.
• Many budget readers only read the chip UID and ignore the encrypted sectors. Cards with a changeable UID are on the market, which makes copying as easy as with EM.

So "we use MIFARE" does not automatically mean secure. The right question is what the reader actually reads from the card.

DESFire when security really matters

MIFARE DESFire runs on the same 13.56 MHz but supports AES-128 and splits memory into separate applications, each with its own keys. EV2 and EV3 are what we recommend for sensitive sites, provided the system reads the encrypted application, not just the serial number.

One card can also serve several purposes (doors, printing, canteen), each in its own application. MIFARE Plus is a middle option that also supports AES and is often used to upgrade Classic installations.

The reader link matters too

Most readers talk to the controller over Wiegand. The common Wiegand 26 format carries 24 data bits: an 8-bit facility code and a 16-bit card number, plus two parity bits.

Quick maths

16 bits gives 65,536 card numbers per facility code; 8 bits gives 256 facility codes. That is 256 × 65,536 = 16,777,216 combinations. Sounds large, but budget cards ship by the million, so duplicate numbers across batches do happen. Larger sites should use longer formats such as Wiegand 34.

Wiegand is also unencrypted: anyone who reaches the reader cable behind the wall can capture numbers. OSDP is the modern alternative, with a secure channel and reader supervision, and support for it is growing.

Tip for facility managers: before buying cards, ask two questions. Does the reader read only the UID or an encrypted sector? Does the controller support a format longer than Wiegand 26? The answers tell you more about your security than the technology name on the box.

Formats: cards, fobs, stickers, wristbands

• Thin ISO card: bank-card size, about 0.8 mm thick, printable on a card printer for staff ID badges.
• Clamshell card: cheaper and tougher, but not directly printable.
• Key fob: the favourite for residents of buildings and compounds.
• Sticker: sticks on a phone or another card. On metal it needs an anti-metal type or it won't read.
• Silicone wristband: waterproof, ideal for pools and gyms.

Moving off EM without a big bang

Install dual-frequency readers that read both 125 kHz and 13.56 MHz, replace staff cards gradually, then delete the old cards from the system. Combo cards carrying both chips help where old and new systems share a building. For sensitive doors, pair the card with a PIN or face, because cards get lent and lost.

Card administration matters as much as technology. One card per named person, lost cards deleted immediately, and a monthly check of active cards against the current staff list close most of the gaps we find on existing systems.

How Do Link helps

We stock readers, cards and fobs in our ZKTeco access control, Hikvision access control and Uniview access control ranges, plus SIB products and card-based time attendance terminals. Our technical team checks card, reader and controller compatibility before you buy, with special pricing for quantities and projects and delivery across Egypt.

Test a sample first

Ordering cards in bulk? Test a sample on your actual reader first. Reach us through the contact page or visit our Bab El Louk branches, and see our access control solutions for the full system.

Recommended products from Do Link

ZkTeco Proximity Card Reader – Waterproof Door Lock Card Reader with External LED Control and External Buzzer ControlKR602-EHikvision DS-K7P03A Touchless Exit & Emergency Push ButtonDS-K7P03AUniview Four Doors Recognition Access Control ControllerOER-SR42SIB TF2LCD EM-W (Tuya) Fingerprint Access Control, Tuya Wi-Fi, IP68, EM 125KHzTF2LCD EM-W (Tuya)

Browse more in the Do Link shop