ISO 14443
The standard behind almost every card you tap — how a reader finds a card, picks it out of a crowd, and starts talking.
Bank cards, transit cards, office badges, passports, NFC stickers, phone wallets: if you tap it, it almost certainly speaks ISO/IEC 14443. It defines "proximity cards": 13.56 MHz, read within about 10 cm, powered entirely by the reader's field.
The standard comes in four parts, each building on the one before:
- The card: physical size and antenna classes.
- The radio: how bits get on and off the air. This is where Type A and Type B split.
- Finding a card: wake-up and anticollision, so a reader can pick one card when your whole wallet is on it.
- Talking to it: a reliable channel for sending real commands to smart cards.
#Type A and Type B
Two companies brought two radio schemes to the standards table, and both made it in. They do the same job with different modulation:
- Type A is by far the more common: MIFARE, NTAG, most payment cards and phones.
- Type B shows up in some passports, national ID cards and transit systems.
Readers and phones speak both, so as a user you'll rarely notice.
Into the weeds: How the bits travel
Reader to card, Type A switches the field fully off for tiny gaps (100% ASK), while Type B just dips it by about 10%. Card to reader, both use load modulation: the card switches a load on and off, which the reader sees as small changes in its own field, on a subcarrier at 847.5 kHz (13.56 MHz ÷ 16). The base rate is 106 kbit/s, and faster modes go up to 848 kbit/s.
#Waking up and picking a card
A Type A reader doesn't know what's in its field, or how many cards are there. So every conversation starts with the same short handshake:
- REQA / ATQA: "anyone there?" Every card in the field answers with a two-byte ATQA hinting at what it is.
- Anticollision: the reader walks through the cards' UIDs bit by bit until it has exactly one. UIDs come in 4, 7 or 10 bytes, so this can take up to three rounds.
- SELECT / SAK: the reader picks that card, and the card replies with a one-byte SAK that says what it speaks next.
Readers use ATQA and SAK to guess the card type before sending anything else. A few common SAK values:
| SAK | Usually means |
|---|---|
00 |
a memory tag like MIFARE Ultralight or NTAG (NFC Type 2) |
08 |
MIFARE Classic 1K |
18 |
MIFARE Classic 4K |
20 |
a smart card that speaks part 4, e.g. DESFire, EMV, passports, phones |
#Part 4: real smart cards
Cards that answer "I speak part 4" switch to a reliable block protocol and
then carry APDUs, the command format from contact smart cards (ISO
7816-4). An APDU is a few header bytes (class, instruction, two parameters),
optional data, and a reply that ends in a two-byte status, where 90 00
means "OK".
The first command is usually SELECT by AID: "connect me to the application called…". That's how one chip can hold a payment app, a transit app and an ID app side by side, and how a terminal picks the right one.
Memory tags (SAK 00, 08) don't do part 4. They have their own simpler
read and write commands for blocks of memory.
#Relatives
- ISO 15693 ("vicinity"): same frequency, simpler and slower, but reads up to about a metre. Library books, ski passes, some access cards.
- FeliCa (JIS X 6319-4): Sony's 13.56 MHz system, dominant in Japan. Phones speak it too, as "NFC-F".
- NFC wraps all three for phones: NFC-A and NFC-B are 14443 Types A and B, and NFC-V is 15693.
With Proxmark3
hf 14a info runs the handshake and prints ATQA, SAK and UID, then makes a
best guess at the card type.
With Flipper Zero
NFC → Read shows ATQA, SAK and UID for any Type A card before it tries to read anything deeper.
With Your phone
NXP TagInfo lists the same wake-up values under its technical details, along with the card's guessed type.
With USB NFC reader
nfc-list (from libnfc) prints ATQA, UID and SAK for each card on the
reader.