Saflok Hotel Key Cards

Saflok lock generations and what they accept

Saflok is a dormakaba brand with locks spanning three decades. The installed generation dictates which card technology is accepted. And often which encoder firmware must be paired with which chip family. Identifying the generation is the first diagnostic step before any card specification discussion.

A property rarely runs a single Saflok generation cleanly. Refurbishments, partial upgrades and suite renovations leave most estates with two or three generations coexisting. The card SKU that ships to the property must be the lowest common denominator across the active door controllers, which usually pushes the decision towards MIFARE Classic 1K or a dual-track (magstripe + RFID) card during migration windows.

The table below maps the most common Saflok generations to their native credential technology and the encoder family that typically ships with them. Firmware updates released after 2023 shift some of these boundaries. Always confirm the door controller firmware line and not just the mechanical model.

Chip-family compatibility per generation

The practical consequence of the generation split is that a single card SKU cannot cover every Saflok estate. This section summarises which chip families drop in cleanly and which require firmware uplift or encoder replacement.

• MIFARE Classic 1K — the widest compatibility envelope across Saflok. Works on Confidant, MT RFID, Quantum IV, Quantum RT, Messenger LENS and (via compatibility mode) most Quantum Plus door controllers. Sector 0 (manufacturer block) is reserved; Saflok typically writes access data to sectors 1 and 2.
• MIFARE Plus (SE / S / X). Accepted by Quantum RT and later in SL1 mode; SL3 AES-128 mode requires Messenger LENS or Quantum Plus with a post-2020 firmware line. Most properties deploy Plus as a migration step, not as a permanent target.
• MIFARE DESFire EV1/EV2/EV3 — native on Messenger LENS and Quantum Plus; not readable by Confidant or early MT RFID hardware. DESFire on a mixed estate requires either a controller firmware uplift on legacy doors or a dual-chip card during migration.
• Magstripe (Track 2 / Track 3 ISO 7811). Accepted by MT magstripe, Quantum IV combo locks and some Quantum RT variants with a magstripe read head; used as a fallback during migration windows or when a subset of the estate has not been upgraded.
• 125 kHz proximity (HID Prox, EM4100). Not natively supported on Saflok hospitality locks; appears only on hybrid access-control integrations using a separate reader head.

System 6000, Ambiance and Messenger LENS — the encoder stack

Saflok has used three generations of front-desk encoder stack. The chip-family support of the card must align with the encoder, not just the lock. Ordering DESFire stock for a property that still runs an early System 6000 encoder produces silent encoding failures even when the doors themselves would accept DESFire.

• Saflok System 6000 — the longest-serving Saflok PMS/encoder platform. Runs on Windows Server, drives desktop encoders via serial or USB-to-serial adapters, and natively supports MIFARE Classic 1K encoding. dormakaba now lists System 6000 under its legacy-products catalog and offers a migration path to Ambiance. DESFire encoding on System 6000 requires a specific encoder firmware revision; most estates still on System 6000 should specify Classic cards.
• Ambiance — dormakaba's current hospitality back-end. Runs under Windows and supports MIFARE Classic 1K, MIFARE Plus EV2 and MIFARE DESFire EV1/EV2/EV3 encoding via PC/SC-class encoders. Originally announced at HITEC for global availability to System 6000 users. The Aava mobile tablet companion (paired with Ambiance) supports curbside check-in and group-issuance workflows.
• Messenger LENS — the online/offline hybrid platform that pairs with Messenger LENS locks. Combines BLE, Wi-Fi and NFC into a credential orchestration layer; encodes physical cards and BLE mobile keys from the same reservation.
• Encoder hardware lifecycle: the desktop RFID Encoder Gen II (dormakaba model 75720) supersedes the Gen I 74750. Gen II is PC/SC compliant, supports USB (5 V) or PoE power, exposes a TCP/IP interface, and is rated for MIFARE Ultralight C, MIFARE Plus EV2 and MIFARE DESFire EV3 over ISO/IEC 14443 Type A.
• Encoder firmware (not PMS version) is the most common limiting factor for DESFire support on legacy installs. Verify the encoder firmware revision with dormakaba service before ordering DESFire EV2/EV3 stock.

Mobile Access — LEGIC Connect, BLE and digital wallets

Recent Saflok generations (Messenger LENS, Quantum Plus, Quantum Pixel) issue mobile credentials in addition to physical cards. The mobile track is a separate procurement decision from card stock; this section exists so card buyers can flag mobile-track dependencies before they become surprises.

• Saflok Mobile Access Solutions is dormakaba's umbrella programme for BLE mobile keys. Credential delivery uses LEGIC Connect as the secure provisioning backbone; the lock-side keystore is managed by Ambiance or Messenger LENS.
• Quantum Pixel is the dormakaba flagship marketed with explicit Apple Wallet and Google Wallet compatibility, alongside BLE mobile keys and physical Classic/DESFire cards in the same estate.
• HID Origo is not natively integrated into Saflok at the time of writing. Properties wanting HID Mobile Access on dormakaba locks should expect a separate integration project rather than a drop-in.
• The OpenKey mobile-key platform was deployed across AMResorts properties on dormakaba locks (announced 2018) and continues as one of the established third-party mobile-key integrations for Saflok estates.
• Mobile-only properties still need a physical card stock for backup issuance: ADA accessibility, mobile-device failures, walk-in guests without the property app, and front-desk operational overrides all require a card-stack baseline.

PMS integration — OPERA, Mews, Protel, Agilysys

Saflok integrates with the major PMS platforms through certified interface drivers that sit between the PMS and the Saflok encoder service. Compatibility is usually a question of driver version, not card chip. But the driver still dictates the payload structure that is written to the card.

• Oracle OPERA: the most common PMS pairing for Saflok; uses the certified OPERA Interface for Electronic Locking. Both OPERA 5 (on-premise) and OPERA Cloud are supported when the Saflok-side driver is on a current revision.
• Mews: integrates via Mews Connector with Ambiance and Messenger LENS platforms; batch encoding for group check-in is supported where the encoder firmware permits.
• Protel: supported on both System 6000 and Ambiance via the protel.I/O or legacy serial interface; some properties on Protel Air (cloud) use a local Saflok encoding agent on the front-desk PC.
• Agilysys (LMS / rGuest): common in resort and casino estates; supported via Agilysys certified interface on Ambiance and Messenger LENS.
• Cloud-based PMS platforms usually rely on a local Saflok encoding agent (Windows service) that bridges the cloud PMS to the USB encoder hardware. The agent must run on the same workstation as the encoder.

Security update — Unsaflok / CVE-2024-29916

In March 2024 a research team led by Lennert Wouters (KU Leuven COSIC) and Ian Carroll publicly disclosed a key-derivation weakness affecting Saflok lock firmware lines built on MIFARE Classic. The disclosure is tracked as CVE-2024-29916 and was branded “Unsaflok”. Every Saflok procurement conversation in 2025–2026 now opens with this question, so card-stock buyers should understand exactly what changed.

The vulnerability lies in dormakaba's proprietary key-derivation function (KDF) for some Saflok MIFARE Classic sectors: the KDF used only the card's Unique IDentifier (UID) as input, so an attacker who could read a single legitimate card could forge a write-pair that reprogrammed the lock's internal state and then opened any door at the property. The attack uses two MIFARE Classic write-capable cards (or a Flipper Zero-class tool) and completes in seconds.

Affected lock platforms reported by the researchers include Saflok System 6000 and Ambiance estates running Confidant, RT, Saffire, Saflok MT and Quantum-series controllers. Across roughly three million doors at 13,000+ properties in 131 countries, the original research disclosure (Sept 2022 to dormakaba, public March 2024) cited an estimated 36% of locks remediated by the time of disclosure. dormakaba began shipping a remediating firmware update in November 2023; the remediation is a door-controller firmware change plus, where applicable, an encoder/back-end update — not a card swap.

For card procurement: ordering new card stock does not by itself mitigate the issue, but choosing the right card family does interact with the remediation timeline. New estates standardising on MIFARE DESFire EV3 with AES-128 authenticated sessions sidestep the Classic KDF surface entirely. Mixed estates still on Classic should sequence the firmware rollout ahead of bulk card refresh so the post-fix card writes happen against remediated controllers.

Common field failure modes

Field failures on Saflok estates follow a predictable pattern. Understanding where the break usually happens shortens the troubleshooting cycle and prevents unnecessary card replacements.

• Silent DESFire rejection on a Quantum IV lock. The door controller does not support DESFire; verify generation before blaming the card batch.
• Sector-key mismatch on Classic cards. Saflok-specific sector keys were not loaded into the encoder, usually after a PMS reinstall or workstation image refresh.
• Magstripe-only fallback re-engaging unexpectedly. The RFID chip is reachable but the lock's RFID module is disabled in firmware; check the door controller configuration profile.
• Bent or delaminated cards. Saflok antennas are tolerant but not immune to damage; delamination from lanyard punch holes or wallet wear causes intermittent reads.
• Sector 0 collision — a third-party loyalty or access application writing to sector 0 breaks Saflok's UID-based authentication flow; always reserve sector 0 for Saflok on shared-card estates.
• Encoder firmware older than required for DESFire write. Card reads but does not encode; firmware update rather than a card change is the fix.

Card material and thickness constraints

Saflok readers are relatively permissive on card material but there are real limits that appear only at scale. These are the constraints that most often surface in a pilot-to-production transition.

• Standard ISO/IEC 7810 ID-1 thickness (0.76 mm ± 0.08 mm) is the safe default for all Saflok lock generations.
• Thicker cards (1.0–1.2 mm) (common for premium PVC or printed eco-material cards) read reliably on Quantum RT and newer; Confidant RFID readers can be marginal above 0.9 mm.
• Bamboo and wood cards. Acceptable on Messenger LENS and Quantum Plus when the embedded inlay is a Classic 1K or DESFire EV3 reference; pilot a production sample before committing to a full order.
• Metal-edge or anti-metal cards. Not recommended for Saflok; the shielding detunes the antenna and produces intermittent reads on Confidant and Quantum IV hardware.
• Transparent PVC: read-compatible but loses the printed branding surface; usually used as a second-key card rather than the primary guest card.
• Dual-interface (magstripe + RFID) cards. Add roughly 0.05 mm to the card stack; still within ISO tolerance but should be validated on the specific lock generation.

What to validate before scaling

A Saflok pilot should exercise both the hardware path (chip, antenna, lock) and the operational path (encoder, PMS, front-desk workflow). Scaling before both paths are proven is the most common source of pilot regret.

• Test one baseline Classic 1K card on at least three different door generations before approving DESFire for the estate.
• Run a full check-in, extend, re-encode and cancel cycle on a live PMS reservation (not just a test reservation) to surface driver edge cases.
• Log the encoder firmware version and the door controller firmware version for every tested door; these are the two numbers dormakaba support will ask for first.
• If magstripe is still in active use, confirm the magstripe track format matches the existing estate. Saflok has used two proprietary Track 3 layouts over the years.
• Plan a small (100–200 card) first production batch before scaling to the full property order; most field failures show up in the first 30 days of live issuance.

FAQ