Key takeaways
- Wiegand can mean the wiring between a reader and a controller, a card number format such as 26-bit, or an old card technology.
- The standard 26-bit format holds a facility code up to 255 and a card number up to 65,535, and the format itself does not prevent the same pair appearing on more than one card.
- OSDP is the two-way alternative, and it can encrypt the link once Secure Channel, its encrypted mode, is set up. Both the readers and the controller have to support it.
- A Wiegand system that works does not need an emergency change. Raise the question when readers or controllers are being replaced, and earlier for exterior and high-risk doors.
First distinction
One word, three different things
Find out first which Wiegand the person meant. The three meanings lead to different questions.
The name comes from John Wiegand, who invented the technology in 1974. It is not a company or a product line, and readers for proximity fobs, smart cards and keypads can all use Wiegand wiring.
| Meaning | What it is | When someone means this |
|---|---|---|
| The wiring interface | The way a reader sends a card's number down a cable to the controller. The Security Industry Association (SIA) published a standard for it in 1996 | "Your readers are Wiegand". Often what is meant, and the one most of this page covers |
| A card format | The layout of the number stored on a card or fob, most often the standard 26-bit format | "Your cards are 26-bit Wiegand" or "what Wiegand format are they?" |
| The original card technology | A card with short pieces of special magnetic wire sealed inside, read by swiping it through a slot. The interface outlived these cards | Rarely, and mostly about very old systems |
The wiring and the number
How Wiegand wiring works, and what 26-bit means
The reader on the wall reads the card and decides nothing. It passes the card's number to the controller, usually in an equipment room, and the controller checks the number and releases the lock.
On a Wiegand reader, that number travels on two data wires, one for the zeros and one for the ones, as short electrical pulses that the controller counts and rebuilds. Power, the reader's light and its beeper each get their own wires, and some readers add one for a tamper switch, which signals if the reader is pulled off the wall. The light and beeper wires carry only plain on-and-off signals, not data, so the card data itself moves one way: the reader sends and the controller receives. For where the reader and controller sit among the other parts, see how commercial access control works.
The Security Industry Association says standard Wiegand-style readers need to be within 500 feet of the controller. The real limit for a given reader depends on its cable and power, and the reader's own installation guide sets it.
What 26-bit means
A format is the map that tells the controller which part of the number means what. A common example is the standard 26-bit format. A bit is a single one or zero. The format holds a facility code, a site number up to 255 that works like an area code, and a card number up to 65,535, often the number printed on the card or fob. The other two bits are simple error checks (parity bits). They catch some garbled reads and are not a security feature.
Many older systems use the 26-bit format, and it does not prevent repeats, so two buildings can end up with the same facility code and overlapping card numbers. The same pair can also turn up twice in one building when a new batch is ordered without checking the old one.
Longer formats exist. Some are managed by a card maker, or assigned to one customer, so that numbers are not repeated. The bit count alone does not tell you the format, because two formats of the same length can arrange their fields differently. The controller has to be set for the format the cards carry. The format is also separate from the card technology; for that, see prox cards vs. smart cards.
Security and upkeep
What the one-way, unencrypted link means
The pulses on the data wires are not encrypted. Anyone who can reach those wires, usually by getting behind the reader, can in principle record the card numbers passing through and send them again later. So the risk sits at the particular doors where that cable can be reached.
The controller also has little way to notice. On the Wiegand wires it only receives, so a replacement reader, or a device added to the cable, can look the same to it as the original. The same blind spot means a reader that has failed or been unplugged may only come to light when someone presents a card and nothing happens. A tamper switch helps only where it was wired to the controller and someone watches the alarm.
This is about the cable, not the card. A card that is hard to copy still has its number sent unencrypted once the reader has read it, and an easily copied card stays easy to copy whatever the wiring is. The two weaknesses are fixed separately.
Settings and software updates do not travel down Wiegand wiring. They are normally made at each reader.
For the card side, see copying and replacing building key fobs.
The alternative
Wiegand compared with OSDP
OSDP stands for Open Supervised Device Protocol. It is a newer standard, adopted by SIA, for the same link between reader and controller.
For how OSDP works and what Secure Channel is, see what is OSDP.
| What differs | Wiegand | OSDP |
|---|---|---|
| Direction | One way, reader to controller | Two way. The controller can send commands and questions to the reader |
| Encryption | None | Can be encrypted (AES-128) once Secure Channel, its encrypted mode, is set up. OSDP can also run without it |
| Checking on the reader (called supervision) | None on the data wires. A tamper switch needs its own wire | The controller can tell when a reader stops answering and report it |
| What changing over involves | Not a changeover. It is what many existing readers and controllers already use | A controller and readers that both support OSDP, and a check of the existing cable |
What you have
How to tell which one you have
You cannot tell from the front of a reader, because many readers can be wired and set up either way. Leave the reader on the wall and the controller cabinet closed: both carry power, and pulling a reader can set off a tamper alarm.
- Ask whoever installed or maintains the system. This is the reliable way.
- Check the paperwork. The reader's part number, from the original quote or the as-built drawings (the record of what was installed), leads to a data sheet that lists the outputs the reader supports.
- Ask the technician which terminals the readers land on. Terminals labeled D0 and D1, or Data 0 and Data 1, with separate ones for LED and beeper, point to Wiegand. A pair labeled A and B, or RS-485, points to OSDP.
- Don't go by the cable or the wire colors. Installers often pull cable with spare conductors, and wire colors vary between readers and installers.
Deciding
When it matters, and what to ask the installer
Find your situation in the table, then put the questions under it to the installer.
| Your situation | What to do about Wiegand |
|---|---|
| The system works and nothing is being replaced | There is no set date for a change. Note what you have and raise it at the next upgrade |
| You are buying new readers, new controllers or a whole system | Ask whether the readers and the controller support OSDP, even if some doors start on Wiegand |
| A reader is outdoors or in a public area, where someone could work behind it unseen | The cable can be easiest to reach at these doors. Put them first if you change over in stages |
| The door protects a server room, records or other high-value space | Treat the reader link as part of that door's security, and ask what it would take to encrypt it |
| You are upgrading to cards that are hard to copy | Ask about the wiring in the same conversation. The new cards' numbers still cross Wiegand wiring unencrypted |
- Are our readers Wiegand or OSDP today at every door, and can the existing cable be reused if we change?
- Does our controller support OSDP, and does it support the encrypted Secure Channel mode?
- Can our current readers be switched to OSDP, or would they be replaced?
- If we move to OSDP, will Secure Channel be turned on, and who keeps the keys?
If you want a second look at your readers
Elwin Security installs, repairs and supports card reader and key fob access control for commercial and multifamily properties, Santa Clara-based and serving the San Francisco Bay Area. Calls are answered 8:00 AM-8:00 PM daily at (408) 539-0535.
Common questions
Wiegand questions
Is Wiegand the same as 26-bit?
No. Wiegand often means the wiring between a reader and a controller, and 26-bit is one format for the number stored on a card. A reader on Wiegand wiring can carry other formats too.
Is Wiegand encrypted?
No. The card number travels from the reader to the controller as plain pulses. Someone would need physical access to the cable to take advantage of that, which is why readers in exposed places matter most.
What is a facility code?
The part of a card's number that marks which site a batch of cards belongs to, much like an area code. In the standard 26-bit format it goes up to 255.
Sources and further reading
These sources back up the general guidance. Your building and the people who approve the work decide the details for your doors.
- Security Industry Association: SIA AC-01-1996.10: Access Control Standard Protocol for the 26-Bit Wiegand Reader Interface (archived copy)
- Security Industry Association: Open Supervised Device Protocol (OSDP) (archived copy)
- Security Industry Association: There Is a Hole in the Boat: Why Access Control Professionals Need to Move From Wiegand to OSDP, 2021 (archived copy)
- National Institute of Standards and Technology: Special Publication 800-116 Revision 1: Guidelines for the Use of PIV Credentials in Facility Access
- Secure Technology Alliance: Using Smart Cards for Secure Physical Access, 2003 (archived copy)