MIFARE Classic vs Ultralight

MIFARE Classic vs MIFARE Ultralight

MIFARE Classic and MIFARE Ultralight are both NXP ISO 14443ISO 14443StandardStandard for contactless smart cards.Click to view → Type A contactless products — but they occupy different cost/security tiers. Classic targets persistent stored-value applications; Ultralight targets disposable, low-cost tickets and single-use tokens.

Overview

MIFARE Classic carries 1 KB or 4 KB of EEPROMEEPROMHardwareNon-volatile card memory for data.Click to view → with Crypto-1 sector authentication. Despite Crypto-1 being broken since 2008, Classic remains deployed in high-volume applications due to its established reader infrastructure. The card supports read/write operations per sector after authentication, enabling persistent stored value (e.g., trip credits, loyalty points).

MIFARE Ultralight (ISO 14443 Type A) is a stripped-down contactless IC designed for the lowest possible cost. The Ultralight carries 48–192 bytes of EEPROM (depending on variant) with minimal security: the original Ultralight has no cryptographic authentication at all — any reader can read and (before page locking) write any page. MIFARE Ultralight C adds 3DES3DESCryptographyLegacy triple-DES symmetric cipher in payment smart cards.Click to view → authentication. MIFARE Ultralight EV1 adds a password-based authentication mechanism (4-byte password) and a message counter for single-use ticket verification. MIFARE Ultralight AESAESCryptographyNIST symmetric block cipher for smart card encryption.Click to view → (2021) finally adds AES-128.

Key Differences

• Memory: Classic 1K = 768 bytes usable; Ultralight ranges from 48 to 192 bytes
• Security: Classic uses Crypto-1 (48-bit, broken); Ultralight original = none; Ultralight C = 3DES; Ultralight EV1 = password; Ultralight AES = AES-128
• Cost: Ultralight is significantly cheaper — suitable for single-use disposable tickets (~$0.10–0.20 per card)
• Write endurance: Classic: 100,000 write cycles per sector; Ultralight: 100,000 (lower total capacity means fewer meaningful writes)
• Persistent value: Classic designed for persistent stored value; Ultralight designed for read-once or count-down scenarios
• Physical locking: Ultralight pages can be one-time write locked (OTP bits); Classic sectors cannot be permanently locked
• Multi-sector structure: Classic has full sector/block layout with per-sector keys; Ultralight has a flat page structure

Use Cases

MIFARE Classic (legacy, stored-value):

• Transit monthly pass cards (persistent balance or trip count)
• Campus cards with running balance
• Access control cards (despite security issues)

MIFARE Ultralight excels in:

• Single-event admission tickets (concerts, sports, theme parks)
• Single-ride transit tickets dispensed from machines
• Loyalty stamp cards (limited write cycles are sufficient)
• Paper NFC tickets with embedded Ultralight chip (ultra-thin form factor)
• Short-term wristbands for festivals and water parks

Verdict

MIFARE Classic and MIFARE Ultralight are designed for different cost and lifecycle profiles. If a card needs to store a persistent balance across months and handle hundreds of transactions, Classic (or better, DESFire EV3) is appropriate. If the card is a disposable single-event ticket that costs less than $0.20 and is thrown away after use, Ultralight is the correct choice — no point deploying an expensive Classic or DESFire chip in a ticket destined for the bin after one use. For new persistent-value applications, skip Classic entirely and use DESFire EV3; for disposable applications, MIFARE Ultralight AES provides a modern, low-cost option.