MIFARE Classic vs DESFire vs Ultralight — Which NFC Card Technology?
NXP's MIFARE is the world's most deployed contactless smart card family. Three product lines dominate: Classic, DESFire, and Ultralight. They serve very different markets with very different security models. Here's how to choose.
Comparison
| Feature | MIFARE Classic 1K | MIFARE DESFire EV2 | MIFARE Ultralight C |
|---|---|---|---|
| Memory | 1 KB (16 sectors × 4 blocks) | 2-8 KB (flexible files) | 192 bytes |
| Architecture | Fixed sectors | Flexible file system | Fixed pages |
| Security | Crypto-1 (proprietary, broken) | AES-128 / 3DES | 3DES (Ultralight C only) |
| NFC Forum | Emulated Type 2 | Native Type 4 | Type 2 |
| ISO 14443 | Part 3 (no ISO-DEP) | Part 4 (ISO-DEP) | Part 3 |
| Key Scheme | 2 keys/sector (A + B) | 14+ keys per application | 1 key (Ultralight C) |
| Throughput | 106 kbps | Up to 848 kbps | 106 kbps |
| Typical Price | ~$0.50/card | ~$1.50-3.00/card | ~$0.20-0.35/card |
| Best For | Legacy access control | Transit, payment, multi-app | Single-use tickets, simple NFC |
Security: The Deciding Factor
MIFARE Classic's Crypto-1 cipher is cryptographically broken. The 48-bit key is vulnerable to brute force, and several practical attacks exist (DarkSide, nested authentication). Do not use MIFARE Classic for any application where security matters. Use it only for legacy compatibility or where security is enforced at the application layer.
DESFire EV2 uses industry-standard AES-128 with mutual authentication. It is the recommended choice for any new deployment requiring actual security.
Ultralight C fills the gap between Classic (broken) and DESFire (expensive). It uses 3DES authentication, making it suitable for medium-security applications like event tickets or loyalty cards.
Use Our Tool
Configuring MIFARE Classic sector permissions? Use our MIFARE Access Bits Calculator.
Related
NFC Tag Capacity Calculator | Best NFC Tags | MIFARE Access Bits Calculator