How an access-control fob works
The fob is a passive transponder: a chip and an antenna sealed in a plastic body, powered by the reader's field when presented. The reader takes the fob's identifier or the result of an authentication and sends it to the door controller, which decides whether to unlock. The fob itself holds no schedule and no door list; those live in the access-control software.
Two frequencies dominate. Low-frequency 125 kHz proximity fobs (EM4200, T5577, HID-compatible formats) transmit a fixed ID and are read from a few centimetres; they have been installed for decades and are still common in residential buildings. High-frequency 13.56 MHz fobs use ISO/IEC 14443 chips such as MIFARE Classic, Plus and DESFire; they can authenticate with the reader and store data, and they are the standard for new commercial installations.
The reader determines which of these a door accepts. Some readers support both, which is what makes migrations possible.
Chip choice by access-control stack
The chip follows the system you have or are moving to.
| Situation | Chip | Security | Note |
|---|---|---|---|
| Existing 125 kHz readers, no upgrade planned | EM4200 / T5577 proximity | Fixed ID, copyable | Lowest cost; acceptable for low-risk doors only |
| Existing MIFARE Classic system | MIFARE Classic 1K | Crypto-1, broken | Keep for continuity; plan a migration |
| Migrating Classic to AES on the same readers | MIFARE Plus | AES-128 in level 3 | Runs in compatible mode during transition |
| New commercial installation | MIFARE DESFire EV2/EV3 | AES-128, mutual authentication | Current baseline; supports multiple applications |
| Existing LEGIC system (common in Germany, Switzerland and Austria) | LEGIC advant | Per LEGIC segment and key configuration | Segments are initialised under the system owner's LEGIC authorisation; send the exact chip type from your integrator |
| Mixed estate, phased reader upgrade | Dual-frequency (125 kHz + 13.56 MHz) | As per the HF chip | One fob for old and new doors |
Verifying compatibility before you order
Fob orders go wrong when the chip is right but the details are not: a proximity format the reader's controller does not decode, a MIFARE fob without the sector keys the system expects, or an unusual bit length in the enrolment. The way to avoid this is the same as for any credential:
- Identify the reader model and the access-control software on each door type, including car park barriers and lifts.
- Send one working fob so the chip type, format and any encoded data can be read.
- Order a small pilot batch, enrol them in your system and test on every reader type.
- Confirm numbering: printed numbers, laser-engraved IDs or a pre-encoded facility code so enrolment matches your records.
- Place the production order to the same specification and keep it on file for reorders.
Elevator and floor access
Many fobs open a door and also authorise floors in a lift, because both readers hand the credential to the same access-control system. Restricting floors keeps a visitor who has cleared the lobby from reaching an executive floor, a plant room, a data centre or a residential level that is not theirs — which is why floor access is standard in multi-tenant towers, hotels and apartment blocks.
There are two ways the lift acts on the fob. In a conventional car the reader sits on the button panel and the controller enables only the buttons the credential is allowed to press; unauthorised floors stay dark. In a destination-dispatch system the rider presents the fob at a hall panel in the lobby and is assigned a car for an authorised floor before boarding — destination-dispatch systems from the major lift makers offer an access-control integration interface, arranged with the lift vendor and specified by your lift and access-control contractors. Behind the panel the reader connects either through a relay board that switches the floor buttons, which needs no lift-vendor API, or through a serial or IP link to the lift controller, which is what destination dispatch requires.
For the fob nothing changes: the same chip that opens the door works in the lift when both readers are on the same system. What has to be confirmed is on the building side.
- The floor list held in the access-control software and the fob enrolled the same way it is for doors.
- A reader interface — relay or high-level — matched to the lift controller.
- Fire-service recall wired to bypass every floor restriction on a fire alarm.
| Approach | How the reader connects | What the lift needs | Suits |
|---|---|---|---|
| Relay floor lockout (retrofit) | Relay board intercepts the button-panel wiring | Electrical work in the car; no lift-vendor API | Existing lifts, budget retrofits |
| Controller integration | Serial or IP link to the lift controller | A lift-vendor interface or API | New builds, destination dispatch |
Mixed estates: LF fobs, HF cards and dual-frequency
Real estates are rarely one technology. An apartment block might have 125 kHz proximity readers on gates installed years ago and new 13.56 MHz MIFARE readers on a refurbished entrance; an office may issue printed HF cards to staff and hand fobs to contractors. Because the reader decides what it accepts, the credential mix has to be planned so no one ends up carrying three things.
Three tactics cover most cases: dual-frequency fobs that hold a 125 kHz chip and a 13.56 MHz chip in one body, so a single fob works on old proximity doors and new MIFARE doors through a phased upgrade; multi-format reader heads that read both bands, so one reader accepts legacy proximity and modern encrypted credentials during the transition; and issuing cards and fobs on the same chip so one enrolment process covers both form factors. Staff who want a photo ID carry a card; residents and contractors carry a fob; the software sees only the credential.
The trap is assuming the same frequency means the same format. A 125 kHz EM4200 fob and a 125 kHz HID-format fob are both low-frequency and are not interchangeable; the reader has to decode the specific format and facility code. Fix the exact chip and format per reader type before ordering, and where you can choose, standardise new doors on DESFire so the estate converges on one clone-resistant credential over time. For the low-security legacy side, 125 kHz proximity fobs remain the cheapest match to existing readers.
Form factors and durability
The classic teardrop or rectangular ABS fob with a key ring hole covers most needs and is printed or laser-engraved with a logo and number. Where the fob is worn rather than carried there are other bodies: NFC rings for hands-free doors, silicone wristbands for gyms and pools, and epoxy or leather tags for premium residential schemes. Cards remain the choice where a photo ID is needed.
Durability is mostly about the seal and the ring hole. Fobs on a key ring take years of knocks and pocket abrasion, so the antenna joint is the weak point; ultrasonically welded ABS bodies outlast glued ones. For outdoor readers in cold climates check the fob at low temperature and with gloves, and choose a body that can be presented without fumbling.
Raising security without replacing every door
125 kHz proximity fobs and MIFARE Classic fobs can be cloned with cheap handheld copiers, and cloned fobs are a routine problem in apartment buildings. Moving to DESFire with keys your system controls closes that gap, but replacing all readers at once is often not affordable.
The workable path is phased. Replace readers on the doors that matter most (main entrances, plant rooms, server rooms) with units that read both the old and the new chip. Issue dual-frequency or DESFire fobs to everyone at the next natural point, such as a tenancy change or an annual audit. When the last old reader is gone, disable the old technology in the software. Throughout, keep the AES keys with the access-control administrator, not with the fob supplier.
Where readers and controllers are being replaced anyway, ask the installer for OSDP with secure channel between reader and controller instead of Wiegand. It stops the other common attack, which is capturing the credential data on the wire behind the reader.
What Proud Tek manufactures
We produce the fobs: ABS key fobs in a range of shapes and colours, 125 kHz proximity fobs, DESFire fobs and dual-frequency fobs for migrations, and also supply NFC rings. Options include printed or engraved logos, sequential numbering, pre-encoded facility codes or UIDs, and matching cards in the same chip so one enrolment process covers both. Readers, controllers and software come from your access-control provider; we verify the fob against them before you commit to a full run.
Published 2026-09-09 · Updated 2026-09-25
