rfid.wtf / WTF is RFID?
Tool

Proxmark3

The open-source RFID research tool — LF and HF, a command line, and the deepest rabbit hole on this site.

The Proxmark3 is the classic RFID research instrument. It's a small board with an FPGA, a microcontroller, and separate LF and HF antennas, driven from a command-line client on your computer. Jonathan Westhues released the original design as open hardware in the late 2000s, and it's been refined by the community ever since. Today most people run the RDV4 or one of the cheaper "Easy" boards, with the community-maintained Iceman firmware and client from the RFID Research Group.

#What it's good at

  • Identifying anything. auto, lf search and hf search try every protocol they know and tell you what you're holding.
  • Going deep. Raw signal capture, protocol decoding, and sniffing a reader and card talking to each other. It's the tool security researchers use to work out how a system behaves.
  • Both sides. It can act as a reader, or as a card for a reader to talk to, which is what makes it useful for testing your own readers.

#What it's not

  • Not plug-and-play. Expect a terminal, a lot of commands and some reading.
  • Not for UHF: it doesn't do EPC tags at all.
  • Not a phone app: it needs a computer (or a phone with a USB/Bluetooth add-on).

The tips on each page below are all about identifying and reading. The command reference and wiki live with the Iceman repository on GitHub.

Topics with Proxmark3 tips

LF — 125 kHzThe old, slow, everywhere band — badges, pet chips and car keys, read from a few centimetres by a coil with hundreds of turns.ConceptLF · 125–134 kHzHF — 13.56 MHzOne frequency, most of the RFID you'll ever touch — payments, transit, passports, NFC, toys and badges.ConceptHF · 13.56 MHzISO 14443The standard behind almost every card you tap — how a reader finds a card, picks it out of a crowd, and starts talking.ConceptHF · 13.56 MHzMIFARE ClassicThe 13.56 MHz memory card that's in a billion transit passes, hotel keys and office badges — running a cipher that's been broken since 2008.Deep diveHF · 13.56 MHzHID ProxThe beige 125 kHz badge on half the office lanyards in North America. It shouts one fixed number and does no crypto at all.Deep diveLF · 125–134 kHziCLASSHID's 13.56 MHz access family, in three acts — broken legacy iCLASS, the SR migration card, and the modern SE platform. What ties the new ones together is the SIO.Deep diveHF · 13.56 MHzPet microchipsA grain-of-rice LF tag that says one number. Whether it gets your pet home depends entirely on a database.In the wildLF · 125–134 kHzBiohacking (human implants)The same grain-of-rice glass chip as the dog, injected into the web of your hand. A hobbyist access badge you can't lose — and can't upgrade without a scalpel.In the wildPhonesYour phone is a reader, a card and a wallet — sometimes all in the same minute.In the wildHF · 13.56 MHzToysYoto cards, Skylanders, amiibo and DropMix — RFID's most fun job, done two very different ways.In the wildHF · 13.56 MHz

Where next

LF — 125 kHzThe old, slow, everywhere band — badges, pet chips and car keys, read from a few centimetres by a coil with hundreds of turns.ConceptLF · 125–134 kHzHF — 13.56 MHzOne frequency, most of the RFID you'll ever touch — payments, transit, passports, NFC, toys and badges.ConceptHF · 13.56 MHz

Shows up in

Flipper ZeroChameleonUltraUSB NFC reader