125 kHz RFID

Goal

By the end of this module you can pick up a low-frequency access fob that belongs to you, read it on the Flipper, save it, and play it back from the device — and, just as important, explain to a friend why you have to hold it almost touching the reader instead of waving it from across the room.

Everything up to now has been Sub-GHz: remotes, gates and sensors that broadcast a little radio signal into the air on 315, 433.92 or 868 MHz. This module is a hard left turn. Low-frequency RFID at 125 kHz looks similar on the surface — you "read" a thing and "emulate" it — but the physics underneath is different enough that it deserves its own week. Get the mental model right here and Module 7's NFC will feel like a cousin, not a stranger.

A different kind of radio

"RFID" stands for radio-frequency identification. The name is honest but a little misleading, because the low-frequency version barely radiates at all. Here is the split you need to hold in your head:

That one difference — battery versus no battery, far-field wave versus near-field coupling — explains almost everything else about how these tags behave, especially the tiny range.

Why the range is centimetres, not metres

125 kHz is a very low frequency. Run it through the wavelength formula from the primer, λ = c / f, and you get a wavelength of roughly 2.4 kilometres. A useful radiating antenna is a meaningful fraction of a wavelength; nobody is putting a kilometre-long antenna on a keyfob. So a 125 kHz tag doesn't try to radiate. Instead the reader and the tag each have a small coil, and they pass energy back and forth through the magnetic field between them. Magnetic coupling falls off ferociously with distance — far faster than a radio wave does — which is exactly why your fob works when it's kissing the reader and does nothing an inch further out. The short range isn't a flaw. It's the whole operating principle, and it's a feature: an attacker can't skim your coil from across the street the way they might sniff a Sub-GHz remote.

How a passive tag answers

Picture two coils of wire facing each other. The reader (your Flipper, or the box by the door) drives an alternating current through its coil at 125 kHz. That creates a pulsing magnetic field. Bring the tag's coil into that field and the field induces a small current in it — the same trick that makes a transformer or a wireless phone charger work. The tag has no battery, but for as long as it's in the field it has just enough power to run its tiny chip.

Now the tag has to answer. It can't shout back with its own transmitter — it has no power source of its own. Instead it changes how much energy it draws from the reader's field, flicking that load on and off in a pattern. The reader feels those tiny tugs on its own coil and reads them out as ones and zeros. The tag never "broadcasts"; it modulates the reader's own field. That's why the tag can be so cheap and so thin, and why it only works up close.

What's actually on the tag

A 125 kHz tag doesn't store your name or your job title. It stores a short number, and the reader system at the door looks that number up in a database to decide whether to unlock. But there are several incompatible ways that number is laid out, and the Flipper has to recognise which one it's looking at. The three you'll meet most:

UID vs "facility code + card number"

Two different ways of thinking about the number are worth pulling apart, because they come up again in NFC next module:

UID

A unique identifier — one flat number that is the tag's identity. EM4100 works this way: the whole 40-bit value is the ID, and the door either knows it or doesn't.

FC + card #

Some formats, like HID's H10301, split the number into a facility code (which site or customer this card belongs to) and a card number (which person). A door tuned to facility code 42 ignores an otherwise-valid card stamped facility 7.

Neither layout is "encrypted" in any meaningful sense. A 125 kHz tag mostly just recites its number when powered. That simplicity is why these tags are cheap, and also why the security world moved on to the 13.56 MHz cards you'll meet in Module 7 — where at least some cards can hold keys and do real cryptography. Reading a 125 kHz ID is roughly as hard as reading a printed serial number: trivial. The security, such as it is, lives in the door's database, not on the tag.

Read, Save, Emulate, Write

The 125 kHz RFID app has a simple loop, and it mirrors the Sub-GHz workflow you already know: capture something, keep it, play it back. Four verbs:

1. Read. The Flipper energises the tag and tries to identify it. Hold the fob flat against the back of the Flipper — the coil is inside the case — and wait for it to lock on to a protocol and an ID.
2. Save. Give the capture a name and store it on the SD card, exactly like a .sub file but for RFID. Now you have a reusable copy of that identity.
3. Emulate. The Flipper becomes the tag. Held to a compatible reader, it presents the saved ID as if it were the original fob. This is the "does the door recognise it" test — on your own door.
4. Write. The Flipper writes the saved ID onto a blank tag, producing a physical duplicate you can carry.

On the device the path looks like 125 kHz RFID → Read, then Saved → Emulate once you've stored one.

The T5577: a blank that can pretend to be anything

Reading and emulating live entirely on the Flipper. To make a real physical copy you need a writable tag, and the workhorse there is the T5577. Out of the factory a T5577 is a blank — a chip that can be configured to imitate other 125 kHz formats. Write an EM4100 ID to it and it behaves like an EM4100 tag; configure it for HID Prox and it presents that instead. That flexibility is why a single pack of T5577 fobs and cards can stand in for most of the low-frequency tags you'll encounter.

The idea to lock in: reading a tag captures its number; writing puts that captured number onto a blank so a copy exists in the world. Reading actively powers the tag and can copy sensitive identifying data. The second creates a working credential — which is precisely why the legal line matters, and why the only ID you should ever write to a blank is one you're entitled to duplicate.

Lab

The three RF worlds, side by side

Keep this table handy. It's the single most useful thing to memorise this week, because "which app do I even open?" starts with "which of these three am I holding?"

The two right-hand columns look almost identical — both near-field, both a few centimetres, both passive tags. The difference is the frequency and, as you'll see next module, how much brains the tag has. Sub-GHz is the odd one out: it's the only column that's a real radio wave with a real battery behind it.

Going deeper

Check yourself

Verify the details

Read the primary sources: Flipper: LF RFID. Course review: 10 September 2026.