13.56 MHz secure HF

AES-secured HF Metal RFID Cards

AES-secured lightweight HF keeps the small, ticket-friendly footprint of the entry-level HF family and replaces its weak points with AES-128 authentication. It sits between plain entry-level HF and high-security AES HF: enough cryptography to stop casual cloning, without the application structure and key ceremony a full high-security AES HF estate demands.

AES-secured HF route brief

Frequency	13.56 MHz secure HF
Best use	Lightweight secure ticketing, controlled membership, event access, and loyalty needing stronger authentication.
Chip route	AES-secured lightweight HF or the platform-specified AES-authenticated lightweight HF chip.
Phone behavior	Not a generic tap-to-URL choice; phone behavior depends on the app, NDEF setup, and AES flow.
Encoding	AES keys, authenticated pages, counters, UID mapping, access rights, and app-specific payloads.
Approval check	Define key ownership, personalization responsibility, app or reader support, and sample validation.

Visual references

Brushed metal NFC card tapping a smartphone

Champagne-gold metal NFC card beside a smartphone

Gunmetal metal RFID card at a secure reader

Copper metal RFID credential on a contactless reader

Brushed metal RFID card on an LF reader test bench

Gunmetal metal credential in front of UHF gate antennas

Metal RFID card encoding and QA workstation

AES keys mean an owner — name one before production.

AES-128 protection only works if someone controls the keys. Define who generates them, who personalizes the cards, and whether the reader platform or an app performs the authentication. A secure chip with unmanaged keys is security theatre — that decision is part of the order, not an afterthought.

Approve a working sample in the real environment.

Define key ownership, personalization responsibility, app or reader support, and sample validation.

Best uses

Lightweight secure ticketing, controlled membership, event access, and loyalty needing stronger authentication.
Metal card programs that can validate a finished encoded sample on the target reader
Projects that need print, serial, QR, packaging, and data handling reconciled in one approved brief

Frequently asked questions

When should a metal card use AES-secured lightweight HF?

When ticketing or membership needs real authentication — enough to stop casual cloning — but the platform does not require high-security AES HF's application structure. It is the light secure route of the 13.56 MHz family.

What does AES-128 add over plain entry-level HF?

Authenticated access to the chip's pages: a reader must prove knowledge of the AES key before reading or writing protected data. Plain entry-level HF has no cryptography; the 3DES variant offers only the older 3DES route.

Who manages the AES keys?

That is defined before production: the buyer, the platform provider, or the integrator generates and owns the keys, and personalization responsibility follows the same decision. Samples are validated under the agreed key flow.

Specification

Format	CR80 85.6 x 54 mm by default; custom outlines after RF review
Thickness	0.3 mm to 0.8 mm depending on construction
Minimum order	None — single samples to production runs
Production time	About one week after artwork and sample approval
RF construction	Antenna, ferrite or hybrid shielding, chip, metal faces, and edge stack specified together
Chip routes	NFC tag, standard HF, high-security AES HF, LF compatibility, and selected UHF by reader test
Marking options	Laser etch, deep engraving, UV print, white ink, enamel fill, QR, serial, and controlled cut-through
Approval flow	Finish sample, encoded working sample, reader check, pre-production approval
Frequency	13.56 MHz secure HF
Chip route	AES-secured lightweight HF or the platform-specified AES-authenticated lightweight HF chip.
Phone behavior	Not a generic tap-to-URL choice; phone behavior depends on the app, NDEF setup, and AES flow.
Encoding	AES keys, authenticated pages, counters, UID mapping, access rights, and app-specific payloads.
Approval check	Define key ownership, personalization responsibility, app or reader support, and sample validation.