Hotel Key Cards

Hotel key card procurement in 2026 — what changed since 2023

The 2024 disclosure of the Unsaflok master-key attack (CVE-2024-29916) and the August 2024 Quarkslab analysis of the Fudan FM11RF08 / FM11RF08S MIFARE Classic clone backdoor changed the procurement-narrative for hotel key cards. A 2026 buyer can no longer treat "MIFARE Classic 1K, same as last time" as a safe default — it now needs an explicit security-posture conversation alongside the standard compatibility check.

Three structural shifts are driving the change. First, the Unsaflok researchers (Lennert Wouters of KU Leuven COSIC and Ian Carroll) demonstrated that the Saflok proprietary key-derivation function for MIFARE Classic sectors used only the card UID as input, allowing an attacker who could read any legitimate guest card to forge a write-pair that opened every door at the property. Roughly three million doors at 13,000+ properties in 131 countries were affected; remediation requires a door-controller firmware update that dormakaba began shipping in November 2023. As of disclosure in March 2024 the researchers estimated 36% of locks were remediated.

Second, Quarkslab's August 2024 disclosure of a hardware backdoor in the Fudan FM11RF08 and FM11RF08S MIFARE Classic clones widely used in the hospitality supply chain meant that even a fully-remediated Saflok property could still be exposed if the card stock itself was Fudan-cloned. The Fudan backdoor allows brute-force recovery of sector keys in roughly two minutes on consumer hardware.

Third, the Crypto-1 cipher used to authenticate every MIFARE Classic card across every hotel-lock vendor (not just Saflok) has been publicly broken for over a decade — independent of either the Unsaflok or Fudan disclosures. The procurement consequence is that any new hotel-key card programme in 2026 that wants AES-128-grade security in its physical card stack needs to specify either MIFARE Plus EV2 in SL3 mode, MIFARE DESFire EV3, or MIFARE Ultralight AES (Common Criteria EAL3+, announced 2024).

Chip-family decision — Classic, Plus, DESFire, Ultralight C, Ultralight AES

Five chip families ship on hotel key cards today. The decision matrix below maps each chip to its security tier, the lock generations that accept it, the encoder firmware required, and the price-per-card range. For non-trivial estates this is rarely a single-chip choice — most properties run a phased migration that issues two or three chip families in parallel for 12–24 months.

• MIFARE Classic 1K (ISO/IEC 14443A, 13.56 MHz, Crypto-1 cipher) — the historical default across every major hotel-lock vendor. 1 KB memory, 16 sectors of 4 blocks. Crypto-1 is broken industry-wide. Lowest cost (~$0.30–0.60/card MOQ 500). Specify only as a transitional refresh on properties with a documented migration plan.
• MIFARE Classic 4K — same Crypto-1 surface as 1K, 4 KB memory, 40 sectors. Used where the property's encoder writes additional data (loyalty, room-spend, amenity-zone access).
• MIFARE Plus EV1 / EV2 — accepted by Saflok (Quantum RT and later), Vingcard (current eStore SKU is Plus EV1 4K), SALTO (XS4 Original+ and later), Onity (integra and Trillium). SL1 mode is Classic-compatible (still Crypto-1 surface); SL3 mode brings AES-128 authenticated sessions. Practical migration step from Classic.
• MIFARE DESFire EV1 / EV2 / EV3 — the recommended target for new estates on Saflok Messenger LENS / Quantum Plus / Quantum Pixel, Vingcard Signature / Allure / Essence reader-type 3G or newer, SALTO XS4 One / Mini / AElement Fusion / Neo BLE, MIWA ALV3M / ALV3MA / V3HTM. EV3 ships in EV2/EV1 backwards-compatible default per the NXP datasheet. AES-128 authenticated sessions; Common Criteria EAL5+.
• MIFARE Ultralight C — supported on most modern reader heads; standard choice for hotel paper guest-key cards (lowest cost, single-use disposable). 3DES authentication (weaker than DESFire).
• MIFARE Ultralight AES — announced 2024. Common Criteria EAL3+ certified; 128-bit AES key length; secure messaging over RF. Vingcard documented compatibility 2024; first vendor to publicly support. Same paper-card form factor as Ultralight C, materially higher security.

Cross-vendor compatibility matrix — choosing once, sampling many

Most multi-property operators run two or more hotel-lock vendors across their portfolio — the legacy of acquisitions, renovations and whichever brand the last GM swore by. The card-stock decision needs to work across all of them simultaneously. This section is the entry point — each vendor's full compatibility detail (lock generations, encoder lifecycle, PMS connectors, security disclosures) lives on its dedicated /compatibility/{vendor}/ page.

• Saflok (dormakaba) — Quantum IV / RT, Messenger LENS, Quantum Plus, Quantum Pixel. System 6000 → Ambiance back-end. CVE-2024-29916 firmware remediation status. See full guide: /compatibility/saflok-hotel-key-cards/
• Vingcard (ASSA ABLOY Global Solutions, rebranded April 2024) — Classic / Essence / Signature / Allure / Flex marine. Vision → Visionline → Vostio Access Management lifecycle. F-Secure 2018 InsecureKeys disclosure on Vision. See full guide: /compatibility/vingcard-hotel-key-cards/
• SALTO Systems — XS4 family + Neo Cylinder. SALTO Space → SALTO KS cloud. 2019 ProAccess SPACE CVE cluster (CVE-2019-19457 through 19460). See full guide: /compatibility/salto-hotel-key-cards/
• Onity (Honeywell Building Automation, acquired June 2024; planned Automation spin-off H2 2026) — HT / ADVANCE / integra / Trillium + DirectKey BLE. 2012 Brocious DEF CON 20 disclosure (no public CVE assigned). See full guide: /compatibility/onity-hotel-key-cards/
• MIWA — ALV2 / ALV3 / V3HTM + AL5H magstripe hybrid + PiACK. Unique FeliCa IDm support for Japanese transit IC cards. See full guide: /compatibility/miwa-hotel-key-cards/
• Häfele Dialock — DT 100 → DT 750 door terminals plus WT wall, FT furniture, EFL / LL locker terminals on one credential. Single-credential door + furniture + locker integration is unique to Dialock. See full guide: /compatibility/hafele-dialock-hotel-key-cards/
• Be-Tech — BASE / SHADOW / VISUAL / GUARDIAN. BIS HOTEL back-end. 11 free MIFARE Classic sectors reserved for All-in-One programmes. See full guide: /compatibility/be-tech-hotel-key-cards/

Encoder hardware + PMS integration — the workflow path

Picture the sample cards arriving at the front desk, the encoder humming, and the first test card refusing to open anything. The instinct is always to blame the chip — which is almost always innocent. The encoder at the front desk constrains which chips can actually be issued (not just which the lock accepts). The PMS connector version constrains whether issuance / extend / re-encode / cancel actions round-trip cleanly. Most card-sample failures trace back to one of these two pieces being out of sync, not to the chip itself.

1. Step 1
   Vingcard — Encoder 4010 (current, USB + Ethernet) supersedes the model 681001025C1 on FCC record. Drives Visionline on-premise or Vostio Access Management cloud back-ends.
2. Step 2
   Saflok — RFID Encoder Gen II (model 75720) supersedes Gen I (74750). Supports MIFARE Ultralight C, Plus EV2, DESFire EV3. Pairs with Ambiance or Messenger LENS; System 6000 properties typically still issue MIFARE Classic.
3. Step 3
   SALTO — EC904B0 NCoder is current; EC90ENUS is the predecessor; legacy PPD covers Classic / Plus SL1 only.
4. Step 4
   Onity — Encoder 4000 (current desktop, PC/SC, BLE mobile-key issuance) supersedes Encoder 2100 (integra-era) and 1100 (Classic-only). PP32 portable programmer commissions Trillium / HT24 / HT28 / ADVANCE.
5. Step 5
   MIWA — Card Issuing System USB encoder (single SKU; no Gen I / Gen II distinction; supports MIFARE 1K + 4K + optional BLE).
6. Step 6
   Häfele Dialock — ES 110 Encoding Station + MDU 110 Mobile Data Unit. Five-language UI, USB and IR connectivity.
7. Step 7
   Oracle OPERA Cloud — integrate via the `roomKeysOutbound` configuration with the GUESTKEY_GENERIC outbound type. Supported actions: New, Duplicate, One-shot, Read, Delete key. Same shape across all major hotel-lock vendor connectors.
8. Step 8
   Mews Open API — verified pairings with Saflok, Vingcard, SALTO, Onity, Häfele Dialock and MIWA. Requires the vendor-specific connector (Saflok HMS, Dialock HMS, etc.) co-installed on the front-desk PC.
9. Step 9
   Apaleo, Cloudbeds, Hotelkey — listed on Vingcard's VConnect integrations hub launched 2024.

Mobile Access coexistence — Apple Wallet, Google Wallet, BLE apps

Every major hotel-lock vendor now offers a mobile-access track. Every few years, someone declares the plastic key card dead; it keeps not dying. Mobile credentials do not replace physical cards in practice — most properties run mobile keys as a guest-choice overlay, with physical cards remaining the operational baseline for ADA accessibility, mobile-device failures, walk-in guests without the property app, and front-desk override scenarios.

• Apple Wallet — supported on Vingcard Signature / Allure / Essence (via Vostio), SALTO XS4 One + AElement Fusion + Neo BLE, Saflok Quantum Pixel, Onity Trillium with current firmware. Hyatt is a documented Vingcard adopter; Club Quarters rolled out wallet keys across all properties January 2025.
• Google Wallet — Vingcard added 2024; SALTO supports via wallet bridge. Coverage matrix is narrower than Apple Wallet today but expanding.
• First-party BLE apps — Vingcard Mobile Access (current iOS id 1403770732 supersedes legacy 1017290566); SALTO JustIN Mobile; Saflok Mobile Access Solutions via LEGIC Connect; Onity DirectKey (Hilton Honors Digital Key precedent, 100+ properties since Feb 2016); MIWA KEYMO; Häfele Dialock Smartphone Key; Be-Tech Mobile Key Android.
• Third-party mobile-key bridges — OpenKey (long-running multi-vendor), FLEXIPASS (multi-brand chain deployments), HID Origo via Avigilon Unity Access (mixed-vendor estates with corporate access overlap).
• Physical-card baseline — AHLA 2026 State of the Industry reports 70% of guests prefer mobile check-in, but physical cards remain the operational baseline because ADA accessibility, mobile-device failures, walk-ins and overrides all require a fallback credential.
• Multi-credential reader requirement — a single property running Apple Wallet + Google Wallet + first-party app + physical card needs a reader head that accepts all four. Verify with the lock vendor before scaling a wallet-key programme.

Card material decision — PVC, FSC bamboo, FSC wood, PLA, metal, paper

Material is the last decision in the procurement sequence, not the first. The chip and the encoder firmware decide whether the card opens the door at all; the material decides how the card feels, how durable it is, what brand story it carries, and whether it survives the sustainability-audit clause in the chain's RFP. Cite the certification body rather than the supplier on any material claim destined for an enterprise RFP response.

• Standard PVC (ISO/IEC 7810 ID-1, 0.76 mm ± 0.08 mm) — the workhorse default. Lowest cost, widest material tolerance across all reader heads. Carbon-footprint baseline: roughly 0.21 kg CO₂e per card per supplier lifecycle data.
• Recycled / eco PVC — Global Recycled Standard (GRS) certification requires ≥50% post-consumer recycled content for the product-level claim. Common 65–80% recycled formulations. ~10% cost premium vs virgin PVC.
• FSC bamboo — Forest Stewardship Council chain-of-custody (FSC-STD-40-004). Approved vendor lists exist for ASSA ABLOY and SALTO. ~30–50% cost premium vs PVC at MOQ 1,000. Read distance on bamboo with MIFARE Classic / DESFire inlay is typically 0.85–0.95× of PVC baseline.
• FSC wood (birch, maple, walnut) — similar certification stack to bamboo. Premium hospitality / luxury positioning. Production cycle longer (~3-week lead time vs 2 weeks for PVC). "Approved Vingcard vendor" / "Approved ASSA ABLOY vendor" badges are real procurement signals in chain RFPs.
• PLA bio-based — TÜV Austria OK biobased certification (EN 16640); BPI ASTM D6868 compostable. Sugar-cane- or corn-starch-derived. 100% biodegradable in industrial composting per ASTM D6400. Quality varies by supplier; pilot before scaling.
• Metal (brushed aluminum, stainless) — premium luxury positioning; requires ferrite isolator behind the chip for iPhone read reliability. Read distance halved vs PVC. ~$3–8/card at MOQ 1,000.
• Paper guest cards — Ultralight C or Ultralight AES inlay laminated in coated paper. Lowest disposable cost; standard at high-throughput conference and arena hotels.
• Dual-interface (magstripe + RFID) — adds ~0.05 mm to card stack, still within ISO 7810 tolerance. Required during magstripe-to-RFID migration windows on legacy Onity HT, Saflok MT and Vingcard Classic dual-track estates.

Standards anchor — ISO/IEC 7810, 14443, 7811, 7816

Every spec sheet referenced on this page is anchored by an ISO/IEC standard. Procurement teams writing an RFP for hotel key cards in 2026 should require vendor responses to cite the standard directly rather than vendor-specific marketing language.

• ISO/IEC 7810:2019 "Identification cards — Physical characteristics" — defines the ID-1 hotel-card form factor (85.60 × 53.98 mm, 0.76 mm ± 0.08 mm thickness, corner radius 3.18 mm). Universal baseline.
• ISO/IEC 14443 Type A — the 13.56 MHz contactless air interface used by MIFARE Classic, Plus, DESFire and Ultralight. Reader-to-card data rate 106 kbit/s baseline, higher rates negotiated.
• ISO/IEC 14443 Type B — alternative 13.56 MHz air interface used in some Onity and government-card deployments. Hotel locks are almost exclusively Type A.
• ISO/IEC 7811 (parts 1–9) — the magstripe standard. Track 2 / Track 3 layouts used in legacy Onity HT, Saflok MT and Vingcard Classic dual-track variants. Magnetic stripe is not native on SALTO, Häfele Dialock or current Be-Tech.
• ISO/IEC 7816-4 — the APDU command set used by DESFire EV1 / EV2 / EV3 over the contactless air interface. Encoder firmware writes data to DESFire applications via SELECT-AID and READ/WRITE DATA APDUs.
• ISO/IEC 15693 — the vicinity-coupling standard used by Texas Instruments Tag-it HF-I; native on Häfele Dialock multi-chip reader heads alongside MIFARE.

Pricing tiers, MOQ floors and lead times — what to expect on a 2026 RFQ

Hotel key card pricing has three drivers in 2026: chip choice (Classic vs Plus vs DESFire vs Ultralight AES), material choice (PVC vs FSC vs metal vs paper), and order volume. The table below gives indicative ranges for each combination — actual quotes vary by supplier MOQ, artwork complexity, and pre-encoding scope.

• Pre-encoding (writing site-specific keys at the factory) adds 5–10% to the per-card cost but removes a labour step at the front desk on arrival. Typical for branded chain rollouts.
• Custom artwork (full-colour CMYK, foil stamping, embossing) typically adds $0.10–0.40 / card depending on technique.
• Sample lead time — most suppliers ship samples in 6–10 working days; allow 12–15 working days for premium materials (metal, hardwood).

Pilot validation checklist — what to test before scaling

A hotel key card pilot should exercise the chip, the encoder firmware, the back-end software version, the PMS connector, the lock-controller firmware, and the front-desk operational workflow. Scaling before all six are proven is the most common source of pilot regret.

• Test the chip / material combination on at least two lock generations in scope before approving any bulk order. ADVANCE / integra / Trillium readers tune differently; same for Quantum IV / Messenger LENS / Quantum Plus, XS4 Original / One, etc.
• Run a full check-in, extend, re-encode and cancel cycle on a live PMS reservation (not a test reservation) to surface PMS-connector edge cases.
• Log the lock-controller firmware, encoder firmware, back-end software version and PMS connector version for every tested unit — these are the four numbers vendor support will ask for first.
• For any property on Saflok with MT / Confidant / Quantum-era controllers: confirm CVE-2024-29916 remediation status with dormakaba service before scaling card stock.
• For any Classic / Classic 4K stock: request written attestation that the card supplier ships NXP-fab silicon, not Fudan FM11RF08 clones (the August 2024 Quarkslab disclosure is real).
• Plan a 100–200 card first production batch before scaling to the full property order. Most field failures show up in the first 30 days of live issuance.

FAQ