Hotel key cards explained: magnetic, RFID and what hotels actually use

1. The 30-second answer

Hotels use three kinds of key: magnetic stripe cards (LoCo, rewritable, still everywhere in independent and mid-market properties), RFID/NFC cards at 13.56 MHz (the standard for new installations and chains) and mobile keys on the guest’s phone (a complement, because every hotel still needs a physical fallback). The lock system decides the card, never the other way round: confirm the stripe coercivity or the chip family with your lock vendor, then print. Lumacards produces both magnetic stripe key cards and RFID key cards, encoded and reader-tested, from 100 cards.

2. The three generations of hotel key cards

Three technologies coexist, often within the same hotel group, and each fails in a different way.

Magnetic stripe: why the hotel key is the canonical LoCo card

The stripe carries the room, the validity window and a sequence code. Because the card is wiped and rewritten for the next guest, hotels use low-coercivity (LoCo, 300 Oersted) stripes rather than the 2750 Oersted HiCo stripes of bank and loyalty cards: LoCo is deliberately easy to re-encode on the inexpensive encoder at reception. The price is that it is also easy to erase by accident, which is why a card left against a magnetic handbag clasp stops working. The physics are in our HiCo/LoCo guide; the wider stripe-versus-chip comparison applies to every other card on your property.

RFID / NFC at 13.56 MHz: MIFARE Classic, Ultralight C, DESFire

A contactless key card has an antenna laminated inside the PVC and a chip that talks to the lock over a few centimetres. Three NXP families dominate hotels:

• MIFARE Classic 1K/4K: the historical hotel chip, memory in sectors protected by pairs of keys. NXP’s product page now states it is not recommended for new designs.
• MIFARE Ultralight C: a small-memory chip with 3DES authentication, designed for limited-use applications; the chip several lock vendors adopted when they replaced MIFARE Classic in hotels.
• MIFARE DESFire EV3: the high-security option, Common Criteria EAL5+ certified with 128-bit AES, with a file system that lets one card carry room, lift, spa and parking as separate applications. Premium chains specify it when the card must also meet corporate access standards.

A chip is rewritten with new access data for the next guest, but the card itself circulates for years. For the basics, read what a smart card is.

Mobile keys: the phone as a key card

A mobile key delivers the same credential to the guest’s phone. Apple lists hotel room keys among the passes that work with Express Mode in Apple Wallet, so the phone opens the door without being unlocked; Google Wallet activates the key only once the guest has checked in and been assigned a room, then opens the room and card-protected areas such as gyms, pools and lifts. Two consequences: a mobile key needs a Bluetooth Low Energy or NFC lock, so it only exists on RFID-generation systems; and every hotel running mobile keys still issues cards to guests with a flat phone, an old OS, a family sharing one booking, or a preference for a card. The card becomes the fallback, not the exception.

3. How a hotel key card works, end to end

A key card does not store “the key to room 412”. It stores a short message that the lock on room 412 has been taught to trust for a limited time. That sentence explains most practical questions hotels ask.

• Reception encodes the card. The property management system tells the lock software which room, which dates and which extras (lift floor, spa, car park); the encoder writes that data plus a sequence number to the stripe or chip. Cards from the printer arrive unencoded.
• Offline locks trust the card, not a network. Most guest-room locks are battery powered with no live connection. The lock checks that the data came from the hotel’s own system, that the dates are valid and that the sequence number is newer than the previous guest’s. Presenting the new card is what invalidates the old one.
• Online locks add remote control. Connected locks can be cancelled from the front desk, report audit trails live and receive mobile keys, and still fall back to card logic if the network drops.
• Expiry is on the card. The check-out date and time are written to it, so a card that leaves the hotel is useless on its own. This is why the stripe, despite weak security, has served hotels for decades: the credential is short-lived by design.
• Master and staff keys use the same cards with access levels and time windows instead of a room. Print them differently, track them by number and revoke them first when someone leaves.

None of this depends on the card manufacturer. What does is whether the coercivity, the chip family and the memory layout match what your encoder and locks expect, which is the point of section 7.

4. Security: what public research says

The uncomfortable summary: the chip most hotels installed in the 2000s and 2010s was broken by academic researchers in 2008, and a practical attack on one of the largest hotel lock brands was disclosed in 2024. Neither is a reason to panic; both are reasons to ask your lock vendor precise questions.

MIFARE Classic: broken since 2008

In 2008, researchers at Radboud University Nijmegen published “Dismantling MIFARE Classic” at ESORICS, describing attacks that recover a card’s secret keys from a handful of exchanges with a reader. The chip has been considered insecure for anything sensitive ever since, and NXP no longer recommends it for new designs. Many hotels kept it, because a lock installed for 15 years is not swapped lightly.

Unsaflok (2024): what a real hotel disclosure looks like

In March 2024, security researchers published Unsaflok, a set of vulnerabilities in dormakaba’s Saflok RFID hotel locks. According to the disclosure, an attacker can open every room in a property with a single pair of forged key cards, starting from any card of that hotel, even an expired one from the express check-out box; over three million locks on more than 13,000 properties in 131 countries were affected. The issue was reported to the manufacturer in September 2022 and upgrades began in November 2023; the researchers note that an upgraded property can be recognised because its guest cards are MIFARE Ultralight C rather than MIFARE Classic. They add that other brands using MIFARE Classic are not affected by this specific flaw, while stating that MIFARE Classic is not recommended in a security-sensitive application.

What a hotel should ask its lock vendor

• Which chip family and memory layout do our locks accept, and is it still recommended by the chip manufacturer?
• Is our lock firmware on the version that addresses the published vulnerabilities for our brand, and when was it updated?
• Can our encoder issue Ultralight C or DESFire cards, and do all readers (lifts, back-of-house) accept them?
• How are master and staff keys revoked, and what audit trail does each lock keep?

Card security beyond the chip, from UV printing to numbering, is covered in secure card printing options.

5. The key card as a marketing object

The key card is the one printed item every guest carries for the whole stay, looks at several times a day and often takes home. A plain white card with a lock-vendor logo wastes the most-handled surface in the hotel.

• Printed design. Full-colour PVC printing costs the same whether the card is white or branded. A photograph of the property, the restaurant hours and the Wi-Fi name on the back answer the questions guests ask reception most.
• Sponsor advertising. Airport hotels sell the card face to car-hire and tour operators; resorts use it for the spa or golf course. Print in short batches so the advertiser can change each season.
• Sleeve or holder. The sleeve carries the room number (never the card: a lost card should not say which door it opens), breakfast times and the check-out procedure. A card holder suits long-stay and staff cards.
• Access as a visible benefit. On RFID systems the same card opens the spa, the club lounge or the car park; printing “Club floor” or “Spa access included” turns a setting into an upgrade.
• Loyalty tie-in. A tiered design (standard, Gold, Platinum) issued by programme status is a recognition gesture that costs a second print file, not a second system; the lock data is identical.

6. Sustainability: what actually gets reused

The most sustainable key card is the one issued many times. Both a LoCo stripe and an RFID chip are rewritable: a card returned at check-out is re-encoded for the next guest with no new material. Before changing substrate, a hotel gains more from raising the return rate (a visible drop box, one sentence at check-in, “please return” on the sleeve) than from any material choice.

• PVC is the default because it laminates a chip and antenna reliably, survives years of circulation and takes a stripe. Its weak point is end of life: it is not accepted in household plastic recycling in most European municipalities, as explained in are PVC cards recyclable.
• Wood and paper key cards avoid plastic and communicate well at check-in, but tolerate humidity, bending and repeated swipes less well, so they tend to become single-stay cards, which moves the question from material to quantity.
• PET and bio-sourced PVC keep the durability of a plastic card while changing its origin or recyclability; the pragmatic route when the card must carry a chip and be reused.

We publish no percentage claims here: the balance depends on how many stays a card serves before it is lost, and that number is set by the hotel’s process, not by the printer.

7. Ordering: quantities, stock and the compatibility checklist

A key card order is three decisions: how many, plain or printed, and exactly which encoding specification. The third one causes the reorders.

How many cards: a method, not a magic number

Cards per year = rooms × occupancy × (365 ÷ average length of stay) × cards per stay × loss rate, plus a working pool of rewritable cards at reception.

Worked example with assumed figures (replace them with your PMS data): a 120-room hotel at 70 % occupancy and a 2-night average stay handles about 120 × 0.7 × 182 = roughly 15,300 stays a year. Two cards per stay gives about 30,600 issues. If 30 % of cards are not returned or are damaged, consumption is around 9,200 new cards a year, about 770 a month. The working pool is typically several times the room count; three cards per room would be 360 cards on hand. The 30 % loss rate is an assumption for the example, and it is the variable a hotel can most easily improve.

Plain encodable stock or printed cards

All key cards are delivered unencoded; the hotel encodes them. The choice is between white stock and cards printed with your design. Printed cards cost more per unit, but staff recognise and recover them far more easily, and they carry the marketing value of section 5. Chains usually print guest cards and use plain, colour-coded cards for staff and master keys. Both are available from 100 cards in our PVC card range; our hospitality page lists the lock systems we encode for and test against.

Compatibility checklist to send to your lock vendor

• Lock brand and system version (Salto, ASSA ABLOY Vingcard, Onity, dormakaba Saflok and others) and encoder model.
• Magnetic stripe: coercivity (LoCo 300 Oe or HiCo 2750 Oe), which tracks the system writes, blank delivery or not.
• RFID: exact chip and variant (MIFARE Classic 1K/4K, Ultralight C, DESFire EV2/EV3 and memory size), any required UID length or pre-formatted memory layout.
• Whether room locks, lifts and car-park readers all accept the same chip, or whether a dual-interface card (stripe plus chip) is needed during a migration.
• A working sample card from current stock, so the new batch is read-tested against the same reference before dispatch.

If cards must also carry a printed guest or sequence number, our variable data printing guide explains how the file is prepared and checked.

8. Seven mistakes hotels make

• HiCo cards for a LoCo encoder. The encoder cannot write them and the batch is unusable. Confirm coercivity in writing.
• Ordering “MIFARE” without the variant. Classic 1K, Ultralight C and DESFire are three products; the lock accepts one.
• Printing the room number on the card. A found card should never reveal its door. The number goes on the sleeve.
• One design for guest, staff and master cards. Colour-coded staff cards are easier to count and revoke.
• Ignoring lock firmware. After a public disclosure the card is not the fix; the lock update is.
• One giant order. Designs, sponsors and lock systems change; a quarterly reorder from a file on record keeps stock current.
• No return process. Loss rate is the biggest lever on cost and environmental impact, and it is a reception habit.

9. Frequently asked questions

Are hotel key cards HiCo or LoCo?

Almost always LoCo (300 Oersted): the card is rewritten at every check-in and low coercivity is what makes the stripe easy to re-encode at reception. HiCo (2750 Oersted) is for cards that keep the same data for years. Confirm with your lock vendor.

Can a hotel key card be demagnetised by a phone?

A LoCo stripe is more sensitive to magnetic fields than HiCo, and magnetic clasps, some phone cases and other magnets can corrupt it. Keep the card in its sleeve and away from magnets. RFID cards carry no magnetic data and are immune.

What RFID chip should a new hotel installation use?

Whatever the chosen lock system supports at its highest security level, usually MIFARE Ultralight C or DESFire EV3 rather than MIFARE Classic, which NXP no longer recommends for new designs. The lock vendor decides; the card printer must match.

Do mobile keys mean we can stop printing key cards?

No. Mobile keys reduce the number of physical cards, but every property keeps cards for guests without a compatible phone, for families sharing a booking, for flat batteries and for staff. They also only work on RFID-era locks.

How long does a hotel key card order take?

Standard PVC key cards are produced in Europe in 6 to 10 working days after proof approval, with express options; a digital proof and a read-test against your reference card come first. Request a quote with your lock system and quantity and we confirm the encoding specification before production.