HITAG 2 Card

HITAG 2 card specifications

Chip figures come from NXP’s HITAG 2 data sheet. Card material, size, printing and read distance are confirmed for your order, and checked on a sample with your reader.

What is a HITAG 2 card?

HITAG 2 is a 125 kHz transponder IC from NXP (originally Philips), introduced in 1996. A HITAG 2 card is an ISO ID-1 card, key fob, epoxy tag or glass tube with that chip and a coil inside. It has no battery: the reader’s field powers the chip, and the two exchange data in half-duplex, the reader modulating its field to send commands and the chip answering by modulating that field in turn. NXP supplies the IC as sawn wafer and in two plastic module packages (HT2MOA4S20 and HT2DC20S20); the PCF7936 is its HITAG 2 security transponder for vehicle immobilisers.

NXP now lists the HITAG 2 transponder IC as not recommended for new designs, as it does HITAG 1 and HITAG S. HITAG 2 cards are still ordered because systems built around HITAG readers need replacement cards that speak the same protocol and mode.

HITAG 2 memory map

The 256-bit EEPROM is divided into 8 pages of 32 bits: 128 bits of control data and secrets in pages 0–3, and 128 bits of user data in pages 4–7. What pages 1 and 2 hold depends on the mode (NXP HT2x data sheet).

The configuration byte selects the mode and the access rights. Memory flags can make pages read-only or block reading altogether, so a card can be locked after personalisation and its key pages kept unreadable.

Password mode, crypto mode and public modes A, B and C

In a public mode the chip simply broadcasts the contents of its user pages as soon as it is powered, with no password and no encryption, so any compatible reader can read it. Data from the chip are Manchester or biphase coded, data to the chip use pulse-duration coding, and the link uses amplitude-shift keying. The mode is set in the configuration byte at encoding time to match your reader, which is why we need the reader type or a working card before production.

Is HITAG 2 secure?

Not by current standards. HITAG 2 uses a proprietary stream cipher with a 48-bit key. Its design was reverse-engineered in 2007, and in 2012 Roel Verdult, Flavio Garcia and Josep Balasch published three practical attacks that recover the secret key using only radio communication (“Gone in 360 Seconds: Hijacking with Hitag2”, USENIX Security 2012). The most serious needs a valid transponder ID and 136 partial authentication attempts, collected in about a minute from the reader (in the paper, the car) by an emulated card, and then less than five minutes on an ordinary laptop. The same paper found that the transponder has no random-number generator, which leaves its authentication open to replay; that password mode exchanges passwords in the clear; and that the tag password has only 24 bits of entropy.

In practice, a card in public mode can be read by anyone with a compatible reader and duplicated; in password mode the passwords can be captured and replayed; and in crypto mode the key can be recovered with the published attacks. Use HITAG 2 to stay compatible with readers you already run, or for low-risk identification such as asset, tool or gas-cylinder ID where the site accepts that cloning risk. Do not use it as the security layer of a new system.

For a new access-control system, or whenever the readers are being replaced anyway, choose a 13.56 MHz card with AES-based authentication such as MIFARE DESFire; our guide to RFID key fobs for access control compares 125 kHz and DESFire credentials. For immobilisers, the same paper notes that NXP’s HITAG AES / HITAG Pro transponders use AES.

How far can a HITAG 2 card be read?

NXP’s public short data sheet gives no read range for HITAG 2, only that the reading and writing distances are the same, so a card can be encoded at the distance at which it is read. Range is set by the reader’s antenna and power and by the size of the coil in the card or tag. On typical desk and wall readers an ID-1 card reads at about 2–10 cm; long-range 125 kHz readers with large antennas, and thicker clamshell cards with a bigger coil, read further. Test a sample on your own reader before writing a distance into a specification.

Where HITAG 2 is used: immobilisers, access control and industry

Car immobilisers are HITAG 2’s best-known use. When Verdult and colleagues studied it in 2012 it was the most widely used immobiliser transponder, fitted by at least 34 car makes in more than 200 models: a transponder in the key head authenticates in crypto mode to a reader coil around the ignition, and the engine starts only after a correct response. That installed base is why HITAG readers are common and why the protocol still turns up in vehicle and fleet systems. We supply cards, fobs and tags; for the automotive transponder see our car transponder chip page, and for gate and fleet set-ups the vehicle RFID identification guide.

In access control, HITAG 2 cards and fobs serve sites whose readers were installed for HITAG, working in password or crypto mode, or read in public mode A by EM-format readers. A replacement credential has to match the reader’s chip family, mode and data layout, which is why we ask for a working card.

NXP lists logistics, livestock tracking, asset tracking, gas cylinder ID, casino and gaming, and industrial automation among HITAG 2 applications. For tags fixed to metal or embedded in plastic, such as gas cylinders, tools, moulds and returnable containers, tell us the reader, the mode and the mounting surface, and we confirm the construction and test a sample before production.

HITAG 2 reader compatibility

A HITAG 2 card works only with a reader whose firmware supports HITAG 2 in the mode the card is set to; NXP’s own reader IC for the HITAG family is the HTRC110. Mode matters as much as chip: a reader that expects a public-mode broadcast gets nothing from a card in password or crypto mode, because the card then answers only HITAG 2 commands, and a password-mode reader cannot authenticate a card personalised with a crypto key.

Readers are rarely interchangeable across chip families. A HITAG 2 reader does not read HITAG 1 or HITAG S unless it supports several HITAG modes, and an EM4100-type reader can read a HITAG 2 card only in public mode A, which emulates EM H400x-type tags; confirm that on a sample with your reader. If your readers are EM-format readers, an EM4200 card, EM4305 card or T5577 card is the simpler order.

HITAG 1, HITAG 2 and HITAG S compared

The families are not interchangeable at the reader. HITAG µ is a further NXP family, aimed at ISO 11784/11785 and ISO 14223 animal identification, and is not read by a HITAG 2-only reader either. Figures are from NXP’s HITAG 1, HITAG 2 and HITAG S product pages.

Form factors and construction

• ID-1 card: 85.6 × 54 mm PVC, PET, PETG or ABS, printable with your artwork and numbering. Thicker ‘clamshell’ versions give a longer read range because they carry a larger antenna.
• Key fob: ABS fobs in several shapes and colours for residents and drivers; see our proximity fobs.
• Epoxy tag: an epoxy-domed tag, with a metal eyelet for a key ring (as shown below) or an adhesive back for phone cases and badges.
• Glass tube and industrial tag: for animal identification and for embedding in tools, moulds and containers.
• Transponder: HITAG 2 transponders for keys and your own housings are covered on our car transponder chip page; the exact part and its availability are confirmed per order.

HITAG 2 key fob

ABS key fob for access-control readers.

HITAG 2 epoxy tag

Epoxy-domed key tag with a metal eyelet and a printable face.

HITAG 2 transponder module

HITAG 2 transponder modules (NXP SOT385-1 package shown).

Before you order

1. The reader or system brand, or a working card, so we can confirm HITAG 2 and the mode (password, crypto, or public mode A, B or C).
2. Whether you need the serial number only, or a specific configuration and user data written and locked.
3. Form factor, material, artwork and printed numbering.
4. Quantity and delivery date. Samples are available for reader testing before a production run.

What Proud Tek produces and supplies

We produce the cards, fobs and tags in our Shenzhen factory, configured to the system owner’s specification; numbered cards are delivered with an Excel, CSV or XML file listing each card’s 32-bit serial number beside the number printed on it. We do not supply access-control readers or software and do not duplicate credentials from systems the buyer does not administer. Related pages: 125 kHz RFID cards, vehicle RFID identification and RFID key fobs for access control.

Sources: NXP HITAG 2 transponder IC data sheet (HT2x, Rev. 3.1) and product pages for HITAG 2, HITAG 1 and HITAG S; R. Verdult, F. D. Garcia and J. Balasch, “Gone in 360 Seconds: Hijacking with Hitag2”, USENIX Security 2012. Chip documentation describes IC capabilities; it does not establish stock or a finished card’s compatibility with your system.