Hotel door keys

The card the front desk slides across the counter is, more often than not, a MIFARE Classic card at 13.56 MHz (sometimes a cheaper Ultralight, increasingly a DESFire). What makes hotel keys interesting isn't the chip — it's that the lock on your door is not connected to anything.

#The offline lock trick

Wiring every door to a central server is expensive, so most hotels don't. The lock runs on batteries and knows nothing about tonight's guests. Instead, the front desk writes the permission onto the card: your room number, a checkout date and time, and a sequence value, all signed with a key the lock already holds. The lock reads the card, checks it was written by its own system, checks the clock, and opens. No network call, ever.

That one fact explains the quirks:

• Your key dies at checkout because the expiry is written on the card, not revoked from a server.
• A new guest's key kills yours because it carries a higher sequence number, and the lock remembers the latest one it saw.
• The desk can re-cut a key in seconds — it's just writing a fresh record.

#The security reality

Two separate weaknesses meet here. The card is often MIFARE Classic, with all that implies. And the lock is its own computer that has, historically, had bugs — famously the Onity lock research in 2012 (a hardware port that could be made to release the bolt), and more recently the Unsaflok work in 2024 against a widely used Saflok system. Both were responsibly disclosed published research, and both prompted fixes; neither is a recipe you'll find here.

The takeaway isn't "hotels are doomed" — it's that a door protected by a 1990s card and a battery-powered computer is protecting against a casual threat, and was mostly designed to.

#Where it's heading

Newer properties use DESFire cards and, increasingly, a key in your phone — issued with your booking, held in Apple Wallet or the chain's app, and (on the better systems) backed by real per-door key management. Same offline-lock idea, much better credential.