Key takeaways
- Prox means a low-frequency card that sends a fixed number. Smart means a 13.56 MHz card with a chip that can prove it holds a secret key.
- Shape doesn't tell you which you have. Both kinds come as thin cards, thick cards, fobs and stickers; the system's records do.
- A smart card adds protection only if the system checks its key. A system that reads only the card's serial number, or still accepts prox, keeps much of the old exposure.
- A new reader has to match the card's frequency, its number format and, for smart cards, its keys. Multi-technology readers accept both kinds during a changeover.
- Moving off prox often runs in order: list what you have, change readers, issue new cards, then switch prox off on a set date.
First distinction
Prox and smart cards at a glance
Both kinds are contactless: the reader's radio field powers the card, and the card answers. The difference is the frequency and what the card says back.
The names cause confusion. In the trade, "prox" means the low-frequency kind, yet the main smart-card standard, ISO/IEC 14443, calls its own 13.56 MHz cards proximity cards.
| Question | Prox card or fob | Smart card or fob |
|---|---|---|
| Frequency | Low frequency, usually 125 kHz in the US | 13.56 MHz |
| What it sends | The same number every time, to any reader that asks | Types built for security answer a fresh challenge using a secret key |
| What it holds | One ID number, often a site code plus a card number | A chip with memory; can hold keys and more than one application |
| Standards and formats | Data formats are often proprietary to a maker or site | Described by ISO/IEC 14443 (proximity cards) and ISO/IEC 15693 (vicinity cards) |
Source Frequencies and standards: NIST SP 800-98 and the Secure Technology Alliance's smart card standards summary.
Prox
What a prox card is
A prox card or fob has a coil antenna and a simple chip with no battery. When it comes near a reader, the reader's field wakes it, and it sends its number. The reader passes that number to the controller, which checks whether that card may open that door at that time.
Many older systems use a 26-bit number. It holds an 8-bit site code, a 16-bit card number and 2 parity bits that check for transmission errors. That allows 256 site codes and 65,536 card numbers per site, so two unrelated buildings can end up with cards carrying the same site code.
On a standard prox card the number is set when the card is made, and the card can't keep it secret. That is why the card's number, and a printed number that may match it, deserves the same care as a password.
Source The 26-bit layout and its limits: NIST SP 800-116 Revision 1, Appendix E.
Smart
What a smart card is
A smart card or fob has a chip with memory, and the types built for security can do cryptography. The reader sends a question that changes each time, and the card's answer depends on a secret key it holds. In a properly built system, a recording of one answer is no use for the next one.
Not every 13.56 MHz card is used that way. Some smart types are memory-only, and some systems read only the card's built-in serial number and skip the keyed exchange. Some older smart types also have published weaknesses, so the age of the card type matters.
Phones fit on this side of the line. Phone credentials use NFC, which works at 13.56 MHz, or Bluetooth, so they need readers and a system built for them.
Source NFC frequency: the Secure Technology Alliance's smart card standards summary (ISO/IEC 18092).
Identify yours
How to tell which kind you have
Start with what is printed on the card, then ask whoever runs the system. Shape and thickness are not reliable clues.
One card can carry both technologies. These dual cards are often used during changeovers, so a card that works on an old prox reader and a new smart reader is not unusual.
If you can't tell, ask the property manager or service company three things: what type of credential the system uses, what number format the controller expects, and whether the readers read both low-frequency and 13.56 MHz cards.
| What to check | What it can tell you | Limits |
|---|---|---|
| Words printed on the card or fob | "Prox" or 125 kHz points to low frequency; 13.56 MHz, NFC or an ISO/IEC 14443 or 15693 mark points to smart | Many cards carry no technology words, only a logo or a number |
| A maker or product name on the card | Lets you look up that maker's card on its own pages | Product names often don't say the frequency |
| Shape and thickness | Not much. Both kinds come as thin cards, thick cards, fobs and stickers | A thick card with a slot is often older, but don't decide from that |
| Numbers printed on the card | Can be the card number the system uses, an order code, or both | Only the system's records match a number to a card type |
| The reader on the wall | Its model decides which kinds it can read | The model label is often on the back. Getting to it means taking the reader off the wall, which is a job for the technician |
| The access system's records | Often list each credential's type or number format | Ask the property manager or the service company to look |
Read range
Read range and frequency
ISO/IEC 14443 smart cards are made for close reading, up to about 10 cm (3.94 in). ISO/IEC 15693 vicinity cards are described for up to about 1 meter. What you get at a door depends on the reader.
Prox range depends on the reader and the card together. Small door readers read only close up, and some readers built for vehicle gates read much farther.
A short range at one door can come from the mounting. Metal behind or around a reader can shorten it, so a reader that reads poorly on a metal frame may need a spacer or a different model rather than new cards.
Source Smart card ranges: the Secure Technology Alliance's smart card standards summary and NIST SP 800-98.
Security
What each kind exposes, and who decides
A prox card's number can be read by any compatible reader held close enough, and a copy sends the same number. The system normally can't tell a copy from the original. Federal guidance on building access says older cards in most cases can't answer a cryptographic challenge, and many can be copied easily.
A smart card set up with keys closes that gap, but only where the system uses it. Three situations keep much of the old exposure: readers that read only the serial number, prox still switched on at the same doors, and older smart types with published weaknesses.
The card is one link. The wire from the reader to the controller also carries the card's number. On a Wiegand connection, the one-way wiring many readers use, that number is sent without encryption.
For the wiring side, see Wiegand and OSDP. For copies and lost fobs, see copying and replacing building key fobs.
The building owner or manager decides which credential types stay in use and when old ones are switched off. The installer sets up the readers and keys to match. If you're a resident or tenant, the office is where to ask.
Source Legacy cards and copying: NIST SP 800-116 Revision 1, Appendix E.6.
Compatibility
Will my cards work on a new reader?
A card and reader have to share a frequency, but that alone doesn't make them work together. The card's design, its number format and, for smart cards, its keys all have to match what the reader and controller expect.
Card designs that belong to one maker often need readers from the same maker. The controller matters too: a system built around 26-bit numbers may not accept a longer number from a new card without changes.
| Your cards | New reader | What usually happens |
|---|---|---|
| Prox | Smart-only (13.56 MHz) | The reader doesn't see the card |
| Smart | Prox-only (low frequency) | The reader doesn't see the card |
| Prox | Multi-technology (reads both) | Can work if the reader is set to accept that prox type and the controller accepts its number format |
| Smart, read with keys | Another smart reader | Works only if the reader supports that card type and holds the right keys |
| Smart, read by serial number only | Another smart reader | Often reads, but the number may come out in a different format, so the system has to be checked |
| Dual-technology card | Either kind | Each reader reads the side it supports |
Source Reader and card standards, and number formats: NIST SP 800-98 and NIST SP 800-116 Revision 1.
Switching
Moving from prox to smart cards
A changeover often runs in this order, so nobody is locked out partway through.
Some buildings issue dual-technology cards first and change readers later; either way, the cut-off date comes last. Keeping prox running beside smart cards after the changeover keeps the prox exposure. Whether that trade is acceptable for a building is the owner's call.
If the cards are failing rather than due for an upgrade, start with apartment key fob not working.
- List what you have: every door, the reader model at each, the controller, and the card types and number format in use.
- Decide the new credential: which smart type, whether phones will be used too, and who will hold the keys the cards are made with.
- Check the controller and wiring. The controller may need a software or firmware update, and a change in how readers connect can mean new cable.
- Change readers first, to multi-technology readers that accept both the old and new cards.
- Issue new cards or dual-technology cards, door by door or group by group, and record who holds each.
- Set a cut-off date in advance, tell users, and switch prox off at every reader on that date.
Source Interface and wiring changes on upgrade: NIST SP 800-116 Revision 1, Appendix E.2 and E.5.
If you need help with your card system
Elwin Security installs, repairs and supports card reader and key fob access control for commercial and multifamily properties in the San Francisco Bay Area. Calls are answered 8:00 AM-8:00 PM daily at (408) 539-0535.
Common questions
Questions about prox and smart cards
Is a key fob a prox or a smart credential?
It can be either. Fobs are made in both kinds, and in dual-technology versions, so the fob's shape doesn't tell you. The building's access system records do.
Will my prox cards work on a smart card reader?
Not on a reader that reads only 13.56 MHz. A multi-technology reader can read both, if it is set to accept your prox type and the controller accepts your card's number format.
Is every 13.56 MHz card secure?
No. A smart card adds protection only when the system checks its secret key. Systems that read only the serial number, older smart types with published weaknesses, and doors that still accept prox keep much of the old exposure.
Can my phone replace my access card?
Only where the readers and the access system are set up for phone credentials. Phones use NFC, which works at 13.56 MHz, or Bluetooth, so a reader that reads only prox can't read a phone. The building office can tell you whether phones are offered.
Sources and further reading
These sources back up the general guidance. Your building and the people who approve the work decide the details for your doors.
- National Institute of Standards and Technology: Special Publication 800-98: Guidelines for Securing Radio Frequency Identification (RFID) Systems
- National Institute of Standards and Technology: Special Publication 800-116 Revision 1: Guidelines for the Use of PIV Credentials in Facility Access (June 2018)
- Secure Technology Alliance: About Smart Cards: Introduction: Standards