A key card entry system grants building access by reading a physical credential, usually a card or fob, and sending its code to a controller that decides whether to open the door. The card carries no identity information about the person holding it. It only proves that a specific credential was presented to a specific reader at a specific moment, which is why most security teams pair an access control platform with additional layers of verification rather than trusting the card alone.
- Low frequency proximity cards run at 125 kHz and transmit a static, unencrypted number every time they are read.
- High frequency smart cards use the ISO/IEC 14443 standard at 13.56 MHz and perform an encrypted challenge-response exchange instead of sending a fixed number.
- The original Wiegand card format encodes 26 bits of data and carries no encryption on the wire between reader and controller.
- OSDP, the Security Industry Association’s successor to Wiegand, supports AES-128 encryption between reader and controller in its Secure Channel mode.
- A key card system has 5 physical components: credential, reader, wiring, controller, and door hardware, and all 5 have to function together for a door to open correctly.
What Is a Key Card Entry System?
A key card entry system is a set of hardware and software components that authenticate a credential at a door and log the result. The core parts are the card, a reader mounted near the door, a controller that makes the access decision, an electric lock or strike, and a software platform that stores permissions and produces an audit trail. When a card is presented, the reader captures its number and passes it to the controller, which checks that number against the permissions for that door and releases the lock if the check passes.
The system exists to answer one question every time a door is tested: was this credential authorized for this door at this moment. It does not answer who is actually standing there. Key card readers are also only one layer of a wider deployment; see our building access control overview for how card readers, door hardware, and visitor management fit together as a single system.
How a Key Card Entry System Works
A key card entry system converts a stored number on a card into an electrical signal a controller can evaluate against a permissions database. Five components have to function together: the credential, the reader, the wiring between reader and controller, the controller logic, and the door hardware.
The Reader and the Controller
The reader sits on the wall next to the door and does one job: it powers the card, reads its number, and forwards that number to the controller. The controller holds the access list, the door schedule, and the rules for that opening, and usually sits in a locked panel away from the door. Older controller-to-panel wiring often runs on RS-485 serial connections, which the EIA-485 standard permits to run roughly 4,000 feet before a repeater is needed; newer controllers typically connect to the host software over standard IP networking instead. Every open and every denied attempt gets written to a log, the audit trail a security director reviews after an incident.
Wiegand and OSDP Wiring
The wire connecting the reader to the controller is where a meaningful security decision gets made. The older Wiegand interface sends the card number in the clear, in the common 26-bit format, with no encryption and no way to confirm the reader has not been swapped or tapped. OSDP, standardized by the Security Industry Association and now on version OSDP v2, encrypts that connection with AES-128 and lets the controller supervise the reader, so a cut wire or a spoofed device gets detected instead of ignored. A perimeter door still running Wiegand is trusting a wire anyone with access to the wall plate can intercept.
Types of Key Cards and Credentials
Key card systems rely on one of four credential families, and the choice between them is largely about how easily the credential can be copied. Low frequency proximity cards at 125 kHz were the industry default for decades and remain common in older buildings. High frequency smart cards built on the ISO/IEC 14443 standard, at 13.56 MHz, use a genuine cryptographic exchange rather than a static number, which is why they replaced proximity cards in most new installations; many of these cards use MIFARE DESFire EV3 or comparable chips, which support AES-128 encryption on the card itself. A related standard, ISO/IEC 15693, covers vicinity cards read from a greater distance and is used on some long-range badges rather than standard door readers. Magnetic stripe cards store data on a stripe a reader swipes rather than taps. Mobile credentials, delivered to a smartphone, use Bluetooth or near field communication and can be revoked instantly from software. Government facilities that must meet the FIPS 201 standard issue PIV credentials instead of a generic proximity or smart card, since FIPS 201 defines cryptographic and physical requirements the reader and controller both have to support.
Comparing the Four Credential Types
| Credential Type | Frequency or Method | Data Exchange | Common Use |
|---|---|---|---|
| Low frequency proximity card | 125 kHz | Static number, no encryption | Older office buildings |
| High frequency smart card | 13.56 MHz, ISO/IEC 14443 | Encrypted challenge and response, often AES-128 | New commercial installations |
| Magnetic stripe card | Swipe | Static data on a magnetic stripe | Hotels, some transit systems |
| Mobile credential | Bluetooth or NFC | Encrypted, tied to a registered device | New deployments seeking remote revocation |
Common Failure Modes in Key Card Systems
The failure modes of a key card entry system almost all trace back to the same limitation: a card proves that a card was presented, never who presented it. Low frequency proximity cards can be cloned with a handheld reader in seconds, because the card broadcasts the same static number every time and nothing on it resists copying. A cloned card passes every check the controller runs, since the controller cannot tell a copy from the original.
Tailgating and Shared Credentials
Tailgating, where a second person follows an authorized cardholder through a door before it closes, defeats every credential type equally, since the door does not know how many people walked through it. This gap shows up most in commercial venues with dozens of badge holders and a steady stream of visitors, where tailgating is hard to catch by policy alone. Shared cards create the same gap deliberately: a team that hands one card around to cover a shift leaves no record of who actually entered. Lost and unreturned cards compound the problem, since a card left active after an employee departs is a working credential with no owner accountable for its use.
What the Door Log Actually Proves
An investigator pulling the audit trail after an incident sees a card number, a door, and a timestamp. That is the full extent of what the system knows, and it cannot confirm the person in the hallway matches the person the card was issued to. That structural gap holds regardless of credential frequency, whether the card runs at 125 kHz or 13.56 MHz.
Managing the Credential Lifecycle
Credential lifecycle management is the ongoing work of issuing, tracking, and revoking cards so the access list matches the people who should have access. Every new hire needs a card mapped to the correct doors and schedule on day one, and every departure needs that same card deactivated the same day, not at the next audit. A lost card needs to be deactivated immediately, and on higher security doors the reader may need a credential format change if the card cannot be trusted to stay out of circulation.
- Issue credentials with the minimum door list and time schedule the role requires, not blanket access.
- Deactivate a card the same day an employee departs or reports a card lost.
- Review the active credential list on a fixed schedule, not only after an incident.
- Keep the audit trail for each door long enough to support an investigation; many organizations set a 90-day or longer retention window through internal policy rather than a single universal rule.
None of this lifecycle work fixes the underlying gap. A well managed card is still just a card. It confirms a credential, not a face.
Frequently Asked Questions
What is the difference between a 125 kHz and a 13.56 MHz key card?
A 125 kHz card is a low frequency proximity card that transmits a static, unencrypted number, which makes it straightforward to clone with inexpensive equipment. A 13.56 MHz smart card built on the ISO/IEC 14443 standard uses an encrypted challenge and response exchange, which is considerably harder to copy. Most new commercial installations use 13.56 MHz smart cards for this reason.
What is the difference between Wiegand and OSDP?
Wiegand is an older, unencrypted interface between a card reader and a controller, typically carrying data in a 26-bit format, and it cannot detect a swapped or tapped reader. OSDP encrypts that same connection with AES-128 and supports supervision, so the controller can detect tampering on the wire. Buildings upgrading their wiring generally move from Wiegand to OSDP for this reason.
Can a key card be cloned?
Low frequency proximity cards at 125 kHz can be cloned with a handheld reader because they broadcast a static, unencrypted number. High frequency smart cards using ISO/IEC 14443 encryption are considerably harder to clone, since the card and reader perform a cryptographic exchange rather than sending a fixed number. Card type is the single biggest factor in how vulnerable a system is to cloning.
What happens when a key card is lost?
A lost card should be deactivated in the access control software immediately, which removes its permissions from every door on the network without requiring the physical card to be recovered. Until it is deactivated, it remains a working credential that will open every door it was authorized for. Same day deactivation is a basic requirement, not an optional practice.
Does a key card entry system confirm who is entering a building?
No. A key card entry system confirms that a specific credential was presented at a specific reader. It does not confirm the identity of the person holding that credential, which is why tailgating, shared cards, and cloned cards all remain effective ways to defeat a card-only door.
What is OSDP and how is it different from Wiegand?
OSDP, or Open Supervised Device Protocol, was developed by the Security Industry Association and is often referred to as SIA OSDP. Its current version, OSDP v2, supports AES-128 encryption between the reader and controller and lets the controller detect a disconnected or tampered reader, something the unencrypted Wiegand interface cannot do.
What is FIPS 201 and when does it apply to a key card system?
FIPS 201 is a federal standard that defines Personal Identity Verification, or PIV, credentials used by U.S. government agencies and their contractors. A building that must meet FIPS 201 needs readers and controllers certified to handle PIV cards specifically, not a generic proximity or smart card reader.
This is the gap that pushes many security teams to pair their card readers with a camera that can actually confirm identity at the door instead of trusting the card alone. Argu turns the cameras a building already has into agents that can flag a mismatch between a badge and the face using it, without replacing the card system already installed. It is an agent you instruct in plain language, not a catalogue of pre-set detectors. Teams adding a second layer of identity at the door often look at facial recognition for this reason, or use natural language video search to pull the exact moment a badge and a face did not match. Organizations that combine badge data with facial verification should also account for state biometric privacy laws such as Illinois’ BIPA, which regulates collection and retention of biometric identifiers separately from an ordinary door log, alongside broader deployments across commercial venues where badge systems anchor daily access. Contact Argu to talk through how it fits alongside the readers you already have.
Last updated: September 2026
