MIFARE Classic vs Ultralight
Card vs CardBoth products are NXP ISO 14443 Type A contactless ICs, and both sit at opposite ends of the cost and security range. MIFARE Classic carries 1 KB or 4 KB of EEPROM — 768 bytes usable on the 1K variant — organised into sectors authenticated by the 48-bit Crypto-1 cipher, and supports read and write per sector after authentication, which suits persistent stored value such as trip credits or loyalty points. Crypto-1 has been broken since 2008, yet Classic remains widely deployed because reader infrastructure is already installed. MIFARE Ultralight strips the design to the lowest achievable cost with 48 to 192 bytes of EEPROM and a flat page structure; the original variant has no cryptographic authentication at all, Ultralight C adds 3DES, Ultralight EV1 adds a four-byte password and a single-use ticket counter, and Ultralight AES, released in 2021, adds AES-128.
At a Glance
| Attribute | MIFARE Classic | MIFARE Ultralight |
|---|---|---|
| Memory | 1 KB or 4 KB EEPROM (768 bytes usable on 1K) | 48–192 bytes depending on variant |
| Security | Crypto-1, 48-bit, broken since 2008 | None (original), 3DES (C), password (EV1), AES-128 (AES) |
| Memory layout | Sector and block layout with per-sector keys | Flat page structure |
| Value model | Persistent stored value | Read-once or count-down tokens |
| Permanent locking | Sectors cannot be permanently locked | Pages lockable via one-time-programmable bits |
| Write endurance | 100,000 cycles per sector | 100,000 cycles over far less capacity |
| Typical unit cost | Reusable card tier | ≈$0.10–0.20 disposable ticket tier |
MIFARE Classic vs MIFARE Ultralight
MIFARE Classic and MIFARE Ultralight are both NXP ISO 14443 Type A contactless products — but they occupy different cost/security tiers. Classic targets persistent stored-value applications; Ultralight targets disposable, low-cost tickets and single-use tokens.
Overview
MIFARE Classic carries 1 KB or 4 KB of EEPROM with Crypto-1 sector authentication. Despite Crypto-1 being broken since 2008, Classic remains deployed in high-volume applications due to its established reader infrastructure. The card supports read/write operations per sector after authentication, enabling persistent stored value (e.g., trip credits, loyalty points).
MIFARE Ultralight (ISO 14443 Type A) is a stripped-down contactless IC designed for the lowest possible cost. The Ultralight carries 48–192 bytes of EEPROM (depending on variant) with minimal security: the original Ultralight has no cryptographic authentication at all — any reader can read and (before page locking) write any page. MIFARE Ultralight C adds 3DES authentication. MIFARE Ultralight EV1 adds a password-based authentication mechanism (4-byte password) and a message counter for single-use ticket verification. MIFARE Ultralight AES (2021) finally adds AES-128.
Key Differences
- Memory: Classic 1K = 768 bytes usable; Ultralight ranges from 48 to 192 bytes
- Security: Classic uses Crypto-1 (48-bit, broken); Ultralight original = none; Ultralight C = 3DES; Ultralight EV1 = password; Ultralight AES = AES-128
- Cost: Ultralight is significantly cheaper — suitable for single-use disposable tickets (~$0.10–0.20 per card)
- Write endurance: Classic: 100,000 write cycles per sector; Ultralight: 100,000 (lower total capacity means fewer meaningful writes)
- Persistent value: Classic designed for persistent stored value; Ultralight designed for read-once or count-down scenarios
- Physical locking: Ultralight pages can be one-time write locked (OTP bits); Classic sectors cannot be permanently locked
- Multi-sector structure: Classic has full sector/block layout with per-sector keys; Ultralight has a flat page structure
Use Cases
MIFARE Classic (legacy, stored-value):
- Transit monthly pass cards (persistent balance or trip count)
- Campus cards with running balance
- Access control cards (despite security issues)
MIFARE Ultralight excels in:
- Single-event admission tickets (concerts, sports, theme parks)
- Single-ride transit tickets dispensed from machines
- Loyalty stamp cards (limited write cycles are sufficient)
- Paper NFC tickets with embedded Ultralight chip (ultra-thin form factor)
- Short-term wristbands for festivals and water parks
Verdict
MIFARE Classic and MIFARE Ultralight are designed for different cost and lifecycle profiles. If a card needs to store a persistent balance across months and handle hundreds of transactions, Classic (or better, DESFire EV3) is appropriate. If the card is a disposable single-event ticket that costs less than $0.20 and is thrown away after use, Ultralight is the correct choice — no point deploying an expensive Classic or DESFire chip in a ticket destined for the bin after one use. For new persistent-value applications, skip Classic entirely and use DESFire EV3; for disposable applications, MIFARE Ultralight AES provides a modern, low-cost option.
Recommendation
Classic for reusable cards; Ultralight for disposable tickets and low-cost applications.
(frontend-gold-standard §1.7): the answer text is in
the initial HTML and stays reachable with JavaScript disabled, so crawlers and
AI extractors read answer-shaped chunks without depending on Alpine. #}
Frequently Asked Questions
How much memory does each product provide?
MIFARE Classic carries 1 KB or 4 KB of EEPROM, of which 768 bytes are usable on the 1K variant after sector overhead. MIFARE Ultralight ranges from 48 to 192 bytes depending on variant, in a flat page structure rather than sectors.
Does MIFARE Ultralight support cryptographic authentication?
It depends on the variant. The original Ultralight has none, so any reader can read and — before page locking — write any page. Ultralight C adds 3DES, Ultralight EV1 adds a four-byte password and a message counter for single-use ticket verification, and Ultralight AES, released in 2021, adds AES-128.
Which product suits a disposable ticket?
Ultralight is designed for the lowest achievable cost at roughly $0.10 to $0.20 per card, and its pages can be permanently locked through one-time programmable bits, which fits read-once and count-down scenarios. Classic is built for persistent stored value on a reusable card and its sectors cannot be permanently locked.
How are smart card comparisons structured?
Each comparison provides a side-by-side analysis covering interface type, chip architecture, security certification, communication protocol, application domains, and cost. Card-vs-card comparisons focus on specific products, while cross-technology comparisons evaluate broader categories like Contact vs Contactless or EMV vs MIFARE.
Frequently Asked Questions
How much memory does each product provide?
MIFARE Classic carries 1 KB or 4 KB of EEPROM, of which 768 bytes are usable on the 1K variant after sector overhead. MIFARE Ultralight ranges from 48 to 192 bytes depending on variant, in a flat page structure rather than sectors.
Does MIFARE Ultralight support cryptographic authentication?
It depends on the variant. The original Ultralight has none, so any reader can read and — before page locking — write any page. Ultralight C adds 3DES, Ultralight EV1 adds a four-byte password and a message counter for single-use ticket verification, and Ultralight AES, released in 2021, adds AES-128.
Which product suits a disposable ticket?
Ultralight is designed for the lowest achievable cost at roughly $0.10 to $0.20 per card, and its pages can be permanently locked through one-time programmable bits, which fits read-once and count-down scenarios. Classic is built for persistent stored value on a reusable card and its sectors cannot be permanently locked.
How are smart card comparisons structured?
Each comparison provides a side-by-side analysis covering interface type, chip architecture, security certification, communication protocol, application domains, and cost. Card-vs-card comparisons focus on specific products, while cross-technology comparisons evaluate broader categories like Contact vs Contactless or EMV vs MIFARE.