HF vs LF RFID: What Is the Difference?

What Is RFID, Briefly?

Radio-Frequency Identification (RFID) uses electromagnetic fields to identify and track tags attached to objects - or carried by people. Every RFID system has the same basic components: a reader that emits a radio signal, and a tag (or transponder) that responds. The reader's antenna generates an electromagnetic field, the tag's antenna absorbs enough energy from that field to power its chip, and the chip transmits its stored data back to the reader.

Simple enough in theory. But RFID spans a huge range of frequencies, and the frequency determines almost everything about how a system behaves: read range, data capacity, speed, security, cost, and what it can actually do in the real world. The two most common frequency bands in physical security and access control are Low Frequency (LF) at 125kHz and High Frequency (HF) at 13.56MHz.

These two bands are fundamentally different technologies that happen to share the RFID label. Understanding those differences is critical if you work in physical security, penetration testing, or access control system design.

Low-Frequency RFID (125kHz)

graph TD
    subgraph LF_System["LF RFID System - 125kHz"]
        Reader["LF Reader"] -->|"EM Field 125kHz"| Field["Inductive Coupling Zone"]
        Field -->|"Powers Tag"| Tag["Passive LF Tag"]
        Tag -->|"Backscatter"| Data["Tag ID Transmitted"]
        Data --> Reader
    end
    subgraph Common_LF_Cards["Common LF Card Types"]
        EM4100["EM4100/EM4102"]
        HID_Prox["HID ProxCard II"]
        AWID["AWID Prox"]
        Indala["Indala Prox"]
        T5577["T5577 - Writable"]
    end
    subgraph LF_Characteristics["Key Characteristics"]
        Range["Read Range: 1-10cm typical"]
        DataCap["Data: 64-128 bits"]
        Speed["Speed: Slow"]
        Cost["Cost: Very Low"]
        Security_Level["Security: Minimal"]
    end
    Tag --> Common_LF_Cards
    Reader --> LF_Characteristics

LF RFID system architecture showing common card types and characteristics at 125kHz

Low-Frequency RFID operates at 125kHz (some systems use 134.2kHz for animal tracking, but 125kHz dominates access control). This frequency band has been used in proximity cards since the early 1990s, and billions of LF cards are still in active service worldwide.

How LF Tags Work

LF tags use inductive coupling. The reader generates an alternating magnetic field through its antenna coil. When an LF tag enters this field, the tag's own coil antenna absorbs energy from the magnetic field, powering the tag's chip. The chip then modulates the field to transmit its stored data back to the reader - typically a simple identification number.

Most LF tags are passive, meaning they have no battery. They rely entirely on the reader's field for power. This limits their read range but makes them extremely durable. An LF proximity card can last decades because there is nothing inside it to wear out or discharge.

Common LF Card Types

EM4100/EM4102: The most common LF chip globally. Stores a 40-bit read-only ID number. No encryption, no authentication. The card transmits its ID to any reader that asks. These are manufactured in enormous volumes and cost pennies per unit. You will find EM4100 cards in budget access control systems, parking garages, and time-and-attendance systems worldwide.

HID ProxCard II (26-bit H10301): The dominant LF card in North American commercial access control. Uses the H10301 26-bit format with a facility code and card number. Despite HID's brand recognition, ProxCard II has no cryptographic security. The card broadcasts its credential in the clear, just like EM4100.

Indala: Motorola's (now HID's) proprietary LF format. Uses a different modulation scheme (PSK vs ASK for HID Prox), but the security model is identical - no encryption.

T5577: A writable LF chip that can emulate most other LF card formats. The T5577 can be programmed to clone EM4100, HID Prox, Indala, and other LF credentials. This chip is the reason LF card cloning is trivially easy.

LF Strengths and Weaknesses

LF RFID's advantages are simplicity and cost. The technology is mature, readers are cheap, and cards cost almost nothing. LF signals also penetrate water and biological tissue better than higher frequencies, which is why 134.2kHz is the standard for animal microchips.

The weaknesses are severe. LF has very low data capacity - typically 64 to 128 bits. That is enough for an ID number and nothing else. There is no room for cryptographic keys, certificates, or application data. Read speeds are slow, and the read range is short (typically 1-10cm for passive tags).

Most critically for security: the vast majority of LF access cards have zero cryptographic protection. They transmit a static ID number that can be captured and replayed trivially.

High-Frequency RFID (13.56MHz)

High-Frequency RFID operates at 13.56MHz, a globally allocated ISM band. This frequency band is home to NFC, MIFARE, iCLASS, DESFire, and the entire contactless smart card ecosystem. HF RFID is a fundamentally different - and more capable - technology than LF.

How HF Tags Work

Like LF, HF tags use inductive coupling with passive power from the reader's field. But the higher frequency allows significantly more data to be transferred, at much higher speeds. The 13.56MHz carrier can support data rates from 106kbps up to 848kbps, compared to LF's typical rates of a few kilobits per second.

This speed difference is not just about convenience. Higher data rates enable real-time cryptographic operations - challenge-response authentication, encrypted data transfer, and secure key exchange. These capabilities are impossible at LF speeds and data capacities.

Common HF Card Types

MIFARE Classic: NXP's enormously popular HF card. Uses the CRYPTO1 cipher for authentication and data encryption. MIFARE Classic 1K has 1,024 bytes of storage organized in 16 sectors. Despite its wide deployment, CRYPTO1 was broken in 2008, and MIFARE Classic cards are now considered cryptographically insecure. More on this in our article on MIFARE Classic vulnerabilities.

MIFARE DESFire EV2/EV3: NXP's modern replacement for Classic. Uses AES-128 encryption, supports multiple applications on a single card, and has 2KB to 8KB of storage. DESFire is currently the gold standard for secure contactless access control.

HID iCLASS: HID's proprietary 13.56MHz platform. The original iCLASS used proprietary encryption that was later broken. iCLASS SE and SEOS use stronger cryptography and are considered secure.

ISO 14443 Type A/B: The underlying communication standard for most HF smart cards, including MIFARE, DESFire, and NFC. Defines the radio interface, collision detection, and data framing.

ISO 15693: An alternative HF standard optimized for longer read range (up to 1-1.5 meters) at the cost of lower data rates. Used in library systems, supply chain, and some access control applications.

HF Strengths and Weaknesses

HF RFID's primary advantage is capability. With kilobytes of storage and fast data transfer, HF cards can support real cryptographic security - mutual authentication, session keys, encrypted data, and secure messaging. Modern HF cards like DESFire EV3 offer security that is genuinely difficult to break.

HF cards can also store multiple applications. A single DESFire card can simultaneously serve as a building access badge, a cafeteria payment card, and a parking credential, with separate security keys for each application.

HF's weaknesses are cost (though declining) and slightly more complex reader infrastructure. HF signals also do not penetrate water or tissue as well as LF, though for access control applications this rarely matters.

Side-by-Side Comparison

graph TD
    subgraph LF["Low Frequency - 125kHz"]
        LF_Freq["Frequency: 125kHz"]
        LF_Range["Read Range: 1-10cm"]
        LF_Data["Data Capacity: 64-128 bits"]
        LF_Speed["Data Rate: ~4 kbps"]
        LF_Security["Security: None/Minimal"]
        LF_Standard["Standards: EM4100, HID Prox"]
        LF_Cost["Card Cost: $0.10-$2"]
        LF_Power["Power: Always Passive"]
    end
    subgraph HF["High Frequency - 13.56MHz"]
        HF_Freq["Frequency: 13.56MHz"]
        HF_Range["Read Range: 1-10cm (14443) / 1.5m (15693)"]
        HF_Data["Data Capacity: 1KB-8KB+"]
        HF_Speed["Data Rate: 106-848 kbps"]
        HF_Security["Security: AES-128, 3DES, PKI"]
        HF_Standard["Standards: MIFARE, DESFire, NFC"]
        HF_Cost["Card Cost: $0.50-$10"]
        HF_Power["Power: Passive or Battery-Assisted"]
    end

Side-by-side comparison of LF and HF RFID specifications

Here is a direct comparison of the two frequency bands across the dimensions that matter most for access control and security:

Frequency: LF operates at 125kHz. HF operates at 13.56MHz - over 100 times higher.

Read Range: Both have similar typical read ranges for access control (1-10cm with passive tags). HF ISO 15693 can extend to about 1.5 meters. Specialized LF readers with large antennas can sometimes reach 20-30cm.

Data Capacity: LF stores 64-128 bits. HF stores 1,024 to 8,192+ bytes. That is a difference of roughly 100x to 500x.

Data Transfer Speed: LF manages a few kilobits per second. HF supports 106kbps to 848kbps. This speed difference is what enables cryptographic operations on HF cards.

Security: LF cards generally have no cryptographic security. HF smart cards support AES-128, 3DES, RSA, and other modern ciphers.

Cost: LF cards cost $0.10-$2. HF smart cards cost $0.50-$10 depending on the chip. Readers follow a similar cost ratio.

Multi-application: LF cards store one credential. HF cards like DESFire can store multiple independent applications.

Security Differences

This is where the gap between LF and HF becomes a chasm.

LF Security (or Lack Thereof)

Most LF access cards - EM4100, HID ProxCard II, Indala - have no security at all. The card transmits a static number. Anyone with a reader (which can be built for under $20) can capture that number from several centimeters away. The number can then be written to a T5577 blank card, creating a perfect clone.

This is not theoretical. LF card cloning is a routine part of physical penetration testing and has been demonstrated thousands of times. The entire attack takes seconds and requires no special expertise.

Some newer LF technologies like HID's Indala Secure Mode add basic security features, but the vast majority of installed LF systems use completely unprotected credentials.

HF Security

HF cards span a wide range of security levels. MIFARE Classic's CRYPTO1 cipher has been broken and should be considered insecure. But modern HF smart cards offer robust protection:

Mutual authentication: Both the reader and the card prove their identity to each other before any data exchange. An attacker cannot simply interrogate the card - they need the correct cryptographic keys.

Encrypted communication: Data transferred between reader and card is encrypted, preventing eavesdropping.

Diversified keys: Each card can have unique keys derived from a master key, so compromising one card does not compromise the system.

Secure messaging: Modern cards like DESFire EV3 use AES-128 session keys that change with every transaction.

Cloning a DESFire EV3 card without the keys is currently not feasible with any known attack. This represents a massive security improvement over LF credentials.

Access Control: Where Each Fits

stateDiagram-v2
    [*] --> Assessment
    Assessment --> LowRisk: Budget constrained, low threat
    Assessment --> MediumRisk: Standard commercial
    Assessment --> HighRisk: Government, finance, critical
    
    LowRisk --> LF_System: LF 125kHz acceptable
    LF_System --> EM4100_Deploy: EM4100 / HID Prox
    EM4100_Deploy --> BasicAccess: Door access only
    
    MediumRisk --> HF_Transition: Migrate to HF 13.56MHz
    HF_Transition --> DESFire_Deploy: DESFire EV2/EV3
    DESFire_Deploy --> MultiApp: Access + Payment + Parking
    
    HighRisk --> HF_PKI: HF with PKI / SEOS
    HF_PKI --> MaxSecurity: Multi-factor + Biometric
    MaxSecurity --> Compliance: Meets FIPS 201 / FICAM

Decision flow for choosing between LF and HF RFID based on organizational risk assessment

Despite LF's security problems, it remains enormously popular. Here is why, and where each technology makes sense:

LF still dominates in: Small businesses, apartment complexes, parking structures, and organizations where the threat model does not include sophisticated physical attackers. If you are securing an interior office door and the main threat is unauthorized employees (not attackers with RFID cloners), an LF system might be acceptable - especially given the cost advantage.

HF is required for: Government facilities, financial institutions, healthcare, data centers, and any environment where physical security is taken seriously. Modern regulations like FIPS 201 (for US federal buildings) require smart card credentials with strong cryptography - LF cannot meet these requirements.

The migration challenge: Many organizations are stuck with legacy LF systems. Replacing every reader and re-issuing every card is expensive and disruptive. This is why millions of vulnerable LF cards remain in active service even though better technology is available.

Dual-Frequency Systems

The migration problem has given rise to dual-frequency solutions. Multi-technology readers can read both LF and HF credentials simultaneously, allowing organizations to transition gradually. Employees can be issued new HF cards while the old LF cards continue to work. Over time, LF readers are replaced with HF-only readers.

HID's iCLASS SE platform and their multi-technology readers (like the multiCLASS SE series) are designed specifically for this migration path. These readers can simultaneously support HID Prox (LF), iCLASS (HF), SEOS (HF), and even mobile credentials via BLE and NFC.

Dual-frequency cards also exist - a single card with both an LF and HF antenna and chip. These cards allow one credential to work on both old LF readers and new HF readers during a transition period.

Choosing Between HF and LF

If you are deploying a new access control system, there is very little reason to choose LF in 2025. HF smart card costs have dropped dramatically, the security difference is enormous, and HF provides a foundation for future capabilities like mobile access and multi-application credentials.

If you are assessing an existing system's security, knowing whether it uses LF or HF tells you a lot immediately. An LF-only system is almost certainly vulnerable to credential cloning. An HF system's security depends on the specific card type - MIFARE Classic is broken, DESFire EV2/EV3 is solid.

For penetration testers, LF credentials are low-hanging fruit. If a target uses HID ProxCard II or EM4100, badge cloning should be one of the first things you test. Tools like the Proxmark3 make this straightforward.

For security consultants, recommending a migration from LF to HF (specifically DESFire EV2 or EV3) is one of the highest-impact improvements you can suggest for organizations still running legacy systems.

Conclusion

LF and HF RFID serve the same basic purpose - identifying a credential to a reader - but they do it with vastly different capabilities. LF is cheap, simple, and insecure. HF is more capable, supports real cryptography, and can be genuinely secure when implemented correctly.

The physical security industry is moving toward HF, and eventually beyond it to mobile and cloud-based credentials. But LF systems will remain in the field for years to come, representing both a persistent vulnerability and an ongoing opportunity for security improvement.

Understanding the technical differences between these two frequency bands is foundational knowledge for anyone working in physical security - whether you are designing systems, testing them, or trying to break into them.

The BLEShark Nano is a compact multi-protocol tool that can help you explore wireless protocols including BLE and WiFi in your security research and learning.

Get the BLEShark Nano - $36.99+

This article is for educational purposes. Always obtain proper authorization before testing security systems. Unauthorized access to computer systems or physical security infrastructure may violate applicable laws.