Key takeaways
- NXP makes the MIFARE chips and lists the Classic chips for delivery as wafers and contactless modules; NXP's trademark guidelines show other companies naming their own products as products "with" a MIFARE chip.
- The current Classic chip comes with 1 kB or 4 kB of memory and uses the CRYPTO1 cipher; NXP recommends its DESFire Light chip for new designs instead.
- NXP files the product pages for the first two DESFire generations under "No Longer Manufactured" and points new designs to the third generation, though the second-generation page's own status label still reads "Active".
- MIFARE Plus EV2 security levels include a Classic-compatible level and an AES level, and NXP says an EV2 card can switch only to a higher level, never to a lower one.
- NXP's application note on MIFARE system security says Common Criteria certification of the Plus and DESFire chips "does not mean with absolute certainty that these chips can never be successfully attacked at any time in future."
Identify
What is a MIFARE card, and who makes it?
NXP describes MIFARE as its brand for contactless solutions, made up of IC and cloud products. Its security application note uses "MIFARE card" to mean a contactless card with an embedded MIFARE IC.
The MIFARE Classic data sheets list the chip's delivery options as bumped die on sawn wafer and as two types of contactless module.
NXP's trademark guidelines show how another company names a product that includes one of its chips: "<your company name> <your product name> with MIFARE Plus®." They allow the MIFARE marks only "in conjunction with products that are manufactured by NXP or products approved under license of NXP."
NXP's MIFARE page lists seven entries under MIFARE Product Families, including MIFARE DUOX, MIFARE SAM for reader systems and the MIFARE 2GO cloud service for phones and wearables. This page covers the four card families in its title.
For how proximity cards and smart cards differ on any brand, see the general guide to prox versus smart cards.
Source NXP's MIFARE (HF) product page, its MIFARE Classic EV1 data sheets, its application note on system-level security for MIFARE installations, and its MIFARE Trademark and Branding Guidelines.
Compare
How do the MIFARE families differ?
NXP says all MIFARE ICs are designed to be compliant to parts 2 and 3 of ISO/IEC 14443, the international standard for contactless proximity cards. Part 4 of the standard is the transmission protocol, and NXP says DESFire and Plus support it.
On its MIFARE page, NXP sums up Plus as easing "the migration from MIFARE Classic installations to higher security levels" and Ultralight as ICs for single-use tickets, replacing magnetic stripe, barcode and QR code systems. The table gives each chip's purpose, standard, security features and status in NXP's own terms.
| Chip | What NXP says it is for | Standard NXP names | Security NXP lists | Status |
|---|---|---|---|---|
| MIFARE Classic EV1 (1K and 4K) | Public transport ticketing; the product page also lists access control | ISO/IEC 14443 Type A | CRYPTO1 stream cipher, mutual three pass authentication, two keys per sector | Not Recommended for New Designs |
| MIFARE DESFire EV3 | High-security IC for contactless smart city services | ISO/IEC 14443 A 1-4 and ISO/IEC 7816 | DES, 2K3DES, 3K3DES or AES; Common Criteria EAL5+ | Active |
| MIFARE DESFire Light | Applications managed by one single entity | ISO/IEC 14443-4 and ISO/IEC 7816-4 | AES, with an alternative AES-based protocol called LRP; Common Criteria EAL4 | Active |
| MIFARE Plus EV2 | A gateway for new smart city applications and an upgrade for existing deployments | ISO/IEC 14443 A 1-4 and ISO 7816-4 | 48-bit Crypto-1, 128-bit AES; Common Criteria EAL5+ | Active |
| MIFARE Plus SE | AES security upgrade for MIFARE Classic installations | ISO/IEC 14443 Type A | AES-128 and MIFARE CRYPTO1 keys | Active |
| MIFARE Ultralight AES | Limited-use contactless tickets and RFID key cards managed by one single entity | ISO/IEC 14443-3 | 128-bit AES authentication; Common Criteria EAL3+ | Active |
| MIFARE Ultralight C | Limited-use applications such as public transport, event ticketing and loyalty | ISO/IEC 14443 Type A, parts 2 and 3 | 3DES authentication | Active label; the page also says not recommended for new designs |
| MIFARE Ultralight EV1 | Single trip or limited-use tickets, loyalty cards and day passes | ISO/IEC 14443 Type A | 32-bit password protection, ECC based originality signature | Active |
Source NXP's MIFARE (HF), MIFARE Classic, MIFARE DESFire, MIFARE Plus and MIFARE Ultralight product pages, the product pages and data sheets for each chip in the table, and NXP's application note on making reader infrastructure ready for multi-application cards.
Classic
MIFARE Classic: memory, security and status
NXP's current Classic chip is MIFARE Classic EV1, in a 1K and a 4K version. NXP says it "represents the highest evolution of the product family and succeeds in all previous versions."
Memory is split into sectors, and each sector has its own pair of keys. The chip authenticates with the reader in three passes and encrypts the exchange with the CRYPTO1 stream cipher.
The product page reads "Not Recommended for New Designs" and says: "This product is not recommended for new designs. Instead, we recommend to use our MIFARE® DESFire® Light IC." NXP's Classic family page adds: "For security-relevant applications, customers should refer to our MIFARE® DESFire® and MIFARE Plus® product families."
Operating distance is up to 100 mm, depending on antenna geometry, at a frequency of 13.56 MHz.
| Version | Memory | Identifier |
|---|---|---|
| Classic EV1 1K | 1 kB, organized in 16 sectors of 4 blocks; one block contains 16 bytes | 7-byte UID or 4-byte NUID (non-unique ID) |
| Classic EV1 4K | 4 kB, organized in 32 sectors of 4 blocks and 8 sectors of 16 blocks | 7-byte UID or 4-byte NUID (non-unique ID) |
Source NXP's MIFARE Classic family page, its MIFARE Classic EV1 1K - 4K product page, the MIFARE Classic EV1 1K and 4K data sheets, and NXP's application note on MIFARE UIDs.
DESFire
MIFARE DESFire: three generations and DESFire Light
NXP's DESFire family page lists access control among the uses of its DESFire products, and the first three generations hold several applications. On all three generations, each application can hold up to 32 files.
Common Criteria is an international security certification scheme, and EAL (evaluation assurance level) is the grade a product reaches; the table gives each generation's level.
NXP says MIFARE DESFire EV3 is functionally backward compatible with all previous DESFire generations. It can be used as a DESFire EV2 or EV1 in its default delivery configuration.
The EV3 page also lists a Transaction Timer "to mitigate man-in-the-middle attacks" and a Proximity Check "for protection against Relay Attacks".
NXP files both older product pages under "No Longer Manufactured", and both carry the note: "Not recommended for new designs. For new designs please use replacement product MIFARE DESFire EV3." The status label reads "Not Recommended for New Designs" on the first-generation page but "Active" on the second-generation page. For DESFire EV3 memory, NXP's product page and the data sheet's feature list give 2, 4, 8 or 16 kB, while a figure in the same data sheet shows 2, 4 or 8 KB; for DESFire EV1 the product page and comparison table give 2, 4 or 8 kB, while that figure also lists 256 B.
| Chip | Memory | Applications per card | Common Criteria | Status on NXP's product page |
|---|---|---|---|---|
| DESFire EV1 | 2, 4 or 8 kB | Up to 28 | EAL4+ | Not Recommended for New Designs; filed under No Longer Manufactured |
| DESFire EV2 | 2, 4, 8, 16 or 32 kB | As many as memory size supports | EAL5+ | Active label; filed under No Longer Manufactured; not recommended for new designs |
| DESFire EV3 | 2, 4, 8 or 16 kB | As many as memory size supports | EAL5+ | Active |
| DESFire Light | 640 bytes of user memory, which NXP says equals the user memory on a Classic 1 kB chip | One directory with six predefined files | EAL4 | Active |
Source NXP's MIFARE DESFire family page, its DESFire EV1, EV2, EV3 and DESFire Light product pages (including the comparison table on the EV3 page), and the DESFire EV3 and DESFire Light data sheets.
Plus
MIFARE Plus: the step up from Classic
NXP says MIFARE Plus EV2 is fully backward compatible with its predecessor and with MIFARE Classic EV1, and comes with 2 kB or 4 kB of memory. Plus SE, with 1 kB, is the entry-level version, designed for full functional compatibility with MIFARE Classic 1K.
For Plus EV2, NXP says switching, for the whole card or for chosen sectors, "is only possible to a higher security level and not to a lower security level."
Plus SE can store both CRYPTO1 keys and AES keys for each sector. NXP says its optional AES authentication in security level 1 "enables efficient detection of cards not belonging to the system."
For key fobs and wristbands, NXP offers Plus EV2 with 70 pF input capacitance (an electrical value matched to the size of the antenna), besides the 17 pF for standard card antennas.
| Level | What NXP says it is |
|---|---|
| SL0 | Initial delivery configuration, for card personalization |
| SL1 | 3-Pass CRYPTO1 Authentication (MIFARE Classic EV1 backwards compatibility mode) with optional AES authentication |
| SL3 | 3-Pass Authentication based on AES, new data manipulation commands secured by encryption and an AES-based MACing method |
Source NXP's MIFARE Plus family page, its Plus EV2 and Plus SE product pages, the MIFARE Plus EV2 short data sheet and the MIFARE Plus SE short data sheet.
Ultralight
MIFARE Ultralight: tickets and limited-use key cards
NXP's Ultralight page describes the family as a fit for "low-cost, high-volume applications such as public transport, loyalty cards and event ticketing." NXP says Ultralight AES serves limited-use applications for contactless tickets and RFID key cards managed by one single entity.
The Ultralight C page's status label reads "Active", but the page also says: "This page contains information on a product that is not recommended for new designs. The replacement for this product is the MIFARE Ultralight AES."
NXP offers Ultralight AES with 50 pF input capacitance for smaller form factors "for key fobs, tags or wristbands".
| Chip | Memory | Security NXP lists |
|---|---|---|
| Ultralight EV1 | 384 bit or 1024 bit free user memory, by version | 32-bit password protection to prevent unintended memory operations; ECC based originality signature |
| Ultralight C | 1536-bit total memory | 3DES authentication |
| Ultralight AES | 144 bytes total user memory | 3-pass mutual authentication based on AES with a 128-bit key; Common Criteria EAL3+ |
Source NXP's MIFARE Ultralight family page, its Ultralight EV1, C and AES product pages, and the data sheets for each.
Readers
What reads a MIFARE card?
NXP's documents call the reader a PCD (proximity coupling device) and the card a PICC. In its application note on readers, NXP recommends that all reader terminals strictly follow ISO/IEC 14443 "and to be non-restrictive regarding the parameters presented by the PICC."
NXP says DESFire EV3 is "fully interoperable with existing NFC reader for MIFARE infrastructure." NXP gives its operating distance as up to 100 mm, depending on power provided by the reader and antenna geometry.
For Plus EV2, NXP says ISO/IEC 7816-4 support in security level 3 makes it compatible with the majority of existing contactless infrastructure devices and with NFC devices, such as NFC enabled mobile handsets.
Source NXP's application note on making reader infrastructure ready for multi-application cards, its DESFire EV3 product page and data sheet, the MIFARE Plus EV2 short data sheet, and the MIFARE Ultralight EV1 data sheet.
Security
What NXP says about MIFARE security
NXP's application note on system-level security for MIFARE installations says the Plus and DESFire chips having Common Criteria certification "does not mean with absolute certainty that these chips can never be successfully attacked at any time in future."
The note adds that the Plus and DESFire chips "are as they are and new defenses can (and will) only be built into future generations of chips." It describes how a system can be designed so that the impact of a successful attack is limited and the damage can be repaired.
The note was written for Plus and DESFire. NXP says the same considerations hold for DESFire EV1 and Ultralight, and that MIFARE Classic has a separate document with countermeasures specific to that chip.
Source NXP's application note on system-level security measures for MIFARE installations (AN10969).
FAQ
NXP MIFARE questions
Is MIFARE Classic discontinued?
NXP's Classic EV1 product page gives the status "Not Recommended for New Designs" and recommends DESFire Light for new designs. That page, read on 10 November 2026, gives no date for the status.
Who makes MIFARE cards?
NXP makes the MIFARE chips and lists the Classic chips for delivery as wafers and contactless modules. Its trademark guidelines show other companies naming their own products as products with a MIFARE chip, and allow the MIFARE marks only on products manufactured by NXP or approved under its license.
Will a MIFARE Plus card work in a MIFARE Classic system?
NXP says Plus SE cards are easy to distribute into running MIFARE Classic systems, and that Plus EV2 is fully backward compatible with Classic EV1, with security level 1 as its Classic backwards compatibility mode.
What is the difference between MIFARE DESFire EV2 and EV3?
In NXP's comparison table, the second generation offers up to 32 kB and the third up to 16 kB, and only the third lists a Transaction Timer and SUN (Secure Unique NFC Message). NXP's second-generation page points new designs to the third.
What frequency do MIFARE cards use?
NXP lists an operating frequency of 13.56 MHz for the current MIFARE Classic chip and the first DESFire generation.
Service
Help with MIFARE cards and fobs
Elwin Security installs, repairs and supports card reader and key fob systems, including systems that use MIFARE cards and fobs, as part of its card reader and key fob access control service for commercial and multifamily properties in the San Francisco Bay Area. Calls are answered 8:00 AM-8:00 PM daily at (408) 539-0535.
Sources and further reading
These sources back up the general guidance. Your building and the people who approve the work decide the details for your doors.
- NXP Semiconductors: MIFARE (HF) product families page
- NXP Semiconductors: MIFARE Classic family page
- NXP Semiconductors: MIFARE Classic EV1 1K - 4K product page
- NXP Semiconductors: MF1S50YYX_V1 MIFARE Classic EV1 1K data sheet (Rev. 3.2, 23 May 2018)
- NXP Semiconductors: MF1S70YYX_V1 MIFARE Classic EV1 4K data sheet (Rev. 3.2, 23 November 2017)
- NXP Semiconductors: AN10927 MIFARE product and handling of UIDs (Rev. 4.1, 5 July 2018)
- NXP Semiconductors: MIFARE DESFire family page
- NXP Semiconductors: MIFARE DESFire EV3 product page
- NXP Semiconductors: MF3D(H)x3 MIFARE DESFire EV3 short data sheet (Rev. 3.1, 11 January 2024)
- NXP Semiconductors: MIFARE DESFire EV2 product page
- NXP Semiconductors: MIFARE DESFire EV1 product page
- NXP Semiconductors: MIFARE DESFire Light product page
- NXP Semiconductors: MF2DL(H)x0 MIFARE DESFire Light data sheet (Rev. 3.3, 5 April 2019)
- NXP Semiconductors: MIFARE Plus family page
- NXP Semiconductors: MIFARE Plus EV2 product page
- NXP Semiconductors: MF1P(H)x2 MIFARE Plus EV2 short data sheet (Rev. 3.1, 9 August 2021)
- NXP Semiconductors: MIFARE Plus SE product page
- NXP Semiconductors: MF1SEP(H)10x1 MIFARE Plus SE short data sheet (Rev. 3.1, 16 March 2017)
- NXP Semiconductors: MIFARE Ultralight family page
- NXP Semiconductors: MIFARE Ultralight AES product page
- NXP Semiconductors: MF0AES(H)20 MIFARE Ultralight AES data sheet (Rev. 3.3, 6 February 2026)
- NXP Semiconductors: MIFARE Ultralight C product page
- NXP Semiconductors: MF0ICU2 MIFARE Ultralight C data sheet (Rev. 3.5, 30 January 2026)
- NXP Semiconductors: MIFARE Ultralight EV1 product page
- NXP Semiconductors: MF0ULX1 MIFARE Ultralight EV1 data sheet (Rev. 3.3, 9 April 2019)
- NXP Semiconductors: AN12057 Making reader infrastructures ready for multi-application cards and devices (Rev. 1.2, 3 July 2026)
- NXP Semiconductors: AN10969 System level security measures for MIFARE installations (Rev. 2.1, 22 April 2020)
- NXP Semiconductors: MIFARE Trademark and Branding Guidelines (Rev. 5.2, 10.03.2025)