RFID Key Fob: A Practical Guide to Access Control Credentials, Frequencies, and Chip Security

2026-10-19

What Is an RFID Key Fob?

An RFID key fob is a small, sealed, passive credential that carries a chip and antenna inside a plastic body, and is presented to a reader to unlock a door, gate, locker, or terminal. It needs no battery. The reader's electromagnetic field powers the chip, the chip returns an identifier or an authenticated response, and the access controller decides whether to release the lock.

Key fobs matter because they are the cheapest, most durable credential format in most access-control deployments: there is no card to bend, no magnetic stripe to wear out, and no screen to break. A fob typically survives a keyring, a pocket, and daily handling for years.

The important point for buyers is this: the plastic shell is not the product decision — the chip, the frequency, and the security model are. Two fobs that look identical can differ by a factor of ten in security.

The Three Frequency Bands (and Why One Is Obsolete)

Frequency determines which reader ecosystem a fob can join. A 13.56 MHz reader physically cannot communicate with a 125 kHz fob, so the choice locks you into a supply chain.

Property	125 kHz (LF)	13.56 MHz (HF)	860–960 MHz (UHF)
Typical read range	1–10 cm	1–10 cm (up to ~1 m with large antenna)	3–15 m; up to 20 m at high gain
On-tag cryptography	None	AES-128, 3DES, ECC	Optional (Gen2v2 and later)
Security posture	Weak — plaintext UID, trivially cloned	Strong with modern chips	Weak without Gen2v2 crypto suites
Best fit	Maintaining legacy systems	Modern building and enterprise access	Vehicle gates, yard and perimeter access

Modern access-control readers operate at 13.56 MHz using ISO/IEC 14443-compliant credentials, with MIFARE DESFire EV2/EV3 and AES-128 mutual authentication as the secure default. Legacy 125 kHz systems transmit UIDs in plaintext and can be cloned with inexpensive commodity tools, so they should be maintained rather than extended into new builds.

Practical takeaway: specify 13.56 MHz, ISO/IEC 14443 Type A, unless you are adding fobs to an existing 125 kHz estate.

Which Chip Should the Fob Carry?

The chip decides what security the deployment can actually achieve. The table below summarizes the common families and their standing.

Chip family	Frequency	Cryptography	Security verdict	Typical use
EM4100 / EM4102	125 kHz	None (plain UID)	Broken	Legacy LF access
HID ProxCard II	125 kHz	None	Broken	Legacy offices, campuses
MIFARE Classic 1K/4K	13.56 MHz	CRYPTO1 (proprietary)	Broken since 2008	Older building access, hotel keys
MIFARE Ultralight C / EV1	13.56 MHz	3DES or password	Low–medium	Transit tickets, hotel cards
NTAG 424 DNA	13.56 MHz	AES-128 + SUN	Strong	Tap-to-authenticate, IoT pairing
MIFARE DESFire EV2	13.56 MHz	AES-128, CMAC, Proximity Check	Strong	Enterprise access, transit
MIFARE DESFire EV3	13.56 MHz	AES-128, Transaction Timer, SUN	Current standard	Enterprise access, government ID
HID Seos	13.56 MHz	AES-128 diversified	Strong	Enterprise physical and logical access

Where RFID Key Fobs Are Used

Office and commercial buildings — employee credentials, multi-tenant lobbies, server rooms
Hotels and short-stay properties — reusable guest fobs with per-stay validity windows
Gyms, clubs, and leisure facilities — member check-in, locker allocation, attendance logs
Residential and gated communities — pedestrian gates, parking barriers, elevator floor permissions
Industrial and logistics sites — personnel gates, restricted zones, contractor time windows
Campus and institutional — staff access, equipment cabinets, laboratory doors
Time and attendance — tap-based clock-in where the same credential doubles as the access token

In practice, most buyers deploy one credential type across several of these uses, which is why the reader standard matters more than the fob appearance.