NFC

Reading NFC cards

Document image


Flipper Zero allows you to read, save, and emulate NFC cards. An NFC card is a transponder that operates at 13.56 MHz and has a unique number (UID) as well as a part of rewritable memory for storing data. Depending on the card type, memory can be segmented into sectors, pages, applications, and more. When near a reader, NFC cards transmit the requested data.

On this page, youll learn how to read and emulate NFC cards and find the list of supported NFC cards.



How to read NFC cards

The reading process is automatic and doesnt require the user to manually configure it.

To read and save the NFC cards data, do the following:

1

Go to Main Menu -> NFC.

2

Press Read, then hold the card near your Flipper Zeros back.

Document image

Don’t move the card while reading. The reading process might take up to several minutes.

3

When reading is finished, go to More -> Save.

4

Name the read card, then press Save.

Reading whats on your card

For some cards, Flipper Zero can read and show data in a readable format. For example, you can get information such as the card validity date, balance, or remaining trips. This functionality is made possible thanks to parsers contributed by the community. You can view the full list of available parsers in the Flipper Zero GitHub repository.

Learn what’s on your card with Flipper Zero
Learn what’s on your card with Flipper Zero


If reading failed



NFC cards type A

MIFARE Classic®

Flipper Zero can read MIFARE Classic 1K, MIFARE Classic 4K, and MIFARE Classic Mini cards and save data. To read data stored in sectors, Flipper Zero has to find all 32 keys for 16 sectors (MIFARE Classic 1K), 80 keys for 40 sectors (MIFARE Classic 4K), and 10 keys for 5 sectors (MIFARE Classic Mini). For that, Flipper Zero uses keys from the System dictionary.

You can manually add your keys to the User dictionary by going to Main Menu -> NFC -> Extra Actions -> MIFARE Classic Keys. 

What if not all sectors of the card were read?
You can try to retrieve the keys for the unread sectors by extracting nonces from the card or the reader, and then calculate the missing keys. Learn more.

Captured data organized in sectors
Captured data organized in sectors

For MIFARE Classic cards, Flipper Zero emulates only unlocked sectors.


After Flipper Zero reads a MIFARE Classic card, the original data is stored in memory. When you implement changes to the data via Flipper Mobile App or through emulation via your Flipper Zero, the device generates a new shadow file representing the new data state. This leads to desynchronization between the actual state on your Flipper Zero and the physical card. To synchronize the physical card with the data state on your Flipper Zero, use the Write To Initial Card function.

Similarly, physical card data can be changed after interaction with a reader leading to desynchronization of data states. To synchronize states, use the Update From Initial Card function.

You can discard changes on your Flipper Zero by using the Restore to original function. In this case, Flipper Zero deletes the shadow file.

You can synchronize data states between Flipper Zero and the physical card
You can synchronize data states between Flipper Zero and the physical card



MIFARE Ultralight® & NTAG®

For MIFARE Ultralight and NTAG cards, Flipper Zero can read and save data in open pages.

Captured data organized in pages
Captured data organized in pages

For MIFARE Ultralight and NTAG cards, Flipper Zero emulates only pages that were read.


Flipper Zero can write saved NTAG data to another NTAG card of the same type (for example, NTAG 213 - NTAG 213). This feature is available for NTAG 213, NTAG 215, and NTAG 216 cards. The initial and destination NTAG cards must have their default PWD, PACK, and disabled AUTH0. Additionally, static and dynamic lock bits must be 0 for both the initial and destination NTAG cards, guaranteeing that all user memory is unlocked.

You can write NTAG data to other NTAG cards
You can write NTAG data to other NTAG cards



MIFARE® DESFire®

Flipper Zero can read MIFARE DESFire cards and save data. In this card type, memory is organized in applications with multiple files. Flipper Zero reads and saves unprotected applications and files with data.

Captured data organized in applications
Captured data organized in applications

For MIFARE DESFire cards, Flipper Zero is able to emulate only the UID.



Unknown cards

When reading an unknown NFC card, Flipper Zero reads and saves only the UID, SAK, and ATQA.

Captured data of an unknown ISO card
Captured data of an unknown ISO card

For unknown NFC cards, Flipper Zero can emulate only the UID.



NFC cards type V

ICODE® SLIX

Flipper Zero can read and save data stored on ICODE SLIX, SLIX-2, SLIX-L, and SLIX-S tags. In these tags, memory is organized in blocks.

Captured data organized in blocks
Captured data organized in blocks

For ICODE SLIX cards, Flipper Zero can emulate the UID and data in blocks.


Unknown cards

When reading an unknown NFC-V card, Flipper Zero reads and saves the UID and data in read blocks.

Captured data of an unknown NFC-V card
Captured data of an unknown NFC-V card

For unknown NFC-V cards, Flipper Zero can emulate the UID and data in read blocks.



NFC cards type F

FeliCa™ Lite-S

Flipper Zero can read, save and emulate FeliCa Lite-S cards. In particular, it can read the Manufacture ID (IDm), Manufacture parameter (PMm), and data in blocks.

Document image

If your Flipper Zero read 26 out of 28 blocks, it means that all data has been successfully read. This happens due to the nature of FeliCa cards reading. However, if you have less than 26 blocks read, it means that some blocks are locked. To access these locked blocks, use the Unlock function and enter the 16-bit key from the manufacturer.



NFC cards type B

ST25TB

Flipper Zero can read and save ST25TB cards. The UID and card data can be captured.

The following card types with different memory organization are supported:

  • ST25TB512
  • ST25TB512-AC
  • SRIX512
  • ST25TB02K
  • ST25TB04K
  • SRIX4K
Document image


Other NFC type B cards

For other NFC cards type B, Flipper Zero can only read and display the UID without saving it.

Captured data of an NFC type B card
Captured data of an NFC type B card



Reading a specific card type

Hybrid cards combine two types of NFC cards in one card. For example, an EMV card can be combined with a MIFARE Classic card. In this case, youll need to specify what type of card you want to read by doing the following:

1

Go to Main Menu -> NFC -> Extra Actions -> Read Specific Card Type.

2

Select the card type you want to read, and then press %ok%OK.

3

Hold the card near your Flipper Zeros back to read the cards data.



Emulating NFC cards

Flipper Zero can emulate an entire NFC card or just the UID depending on the NFC card type and saved data.

To emulate the saved NFC card, do the following:

1

Go to Main Menu -> NFC -> Saved.

2

Select the card, then press Emulate.

In some cases, you can emulate only the UID
In some cases, you can emulate only the UID

3

Hold your Flipper Zero near the reader to transfer data.

While emulating the NFC card, hold your Flipper Zero near the reader
While emulating the NFC card, hold your Flipper Zero near the reader

When emulating MIFARE Classic cards, Flipper Zero tries to guess the reader’s frequency in order to correctly modulate the signal. Flipper Zero assumes that the field frequency is exactly 13.56 MHz. If the frequency differs significantly, the signal won’t be modulated correctly, leading to emulation errors.



MIFARE, MIFARE Ultralight, MIFARE Classic, NTAG, DESFire, and ICODE are registered trademarks of NXP B.V.

FeliCa is a trademark of Sony Corporation.

🤔
Have a question?
Our knowledgeable support team and an awesome community will get you an answer in a flash. Please leave your questions in English.
To ask a question or participate in discussions, you'll need to authenticate first.