How RFID hotel locks actually work — and why hotels should care

Walk into any modern hotel and you'll likely tap a card or your phone against a door — a green light blinks, the latch clicks, and you're in. It feels simple, but there's a surprising amount of technology working in the half-second between the tap and the click. Understanding what's inside that lock helps hoteliers buy smarter, troubleshoot faster, and explain security to guests with confidence.

This guide is written for hotel owners, GMs, and front-office managers — not engineers. We'll cover what RFID is, what's actually inside a hotel lock, how a card "knows" which door to open, and what separates a cheap lock from one you can stake your insurance policy on.

What RFID actually means

RFID stands for Radio-Frequency Identification. It's a way for two devices to exchange a small amount of data wirelessly using radio waves — no battery in the card, no line of sight required, and no contact needed. The lock has a reader (the antenna behind the front plate). The card has a tiny chip and a coil of wire. When the card enters the lock's field, the coil harvests just enough energy from the reader's signal to power the chip for a moment. The chip wakes up, says hello, and the conversation begins.

Hotels almost universally use a flavour of RFID called Mifare, operating at 13.56 MHz. Within Mifare, there are several generations — Classic, Plus, DESFire EV1/EV2/EV3 — each with different memory layouts and cryptography. The choice of chip is one of the biggest security decisions in the lock you buy.

What's inside the door lock

Pop the cover off a typical hotel lock and you'll find five distinct subsystems:

• The reader board — the antenna and RF front-end that talks to cards.
• The MCU — a microcontroller that runs the lock's firmware, validates cards, manages the audit log, and drives the motor.
• Secure storage — non-volatile memory holding the lock's encryption keys, room ID, and recent access events. On a well-designed lock this storage is tamper-protected.
• The motor and clutch — what actually retracts the latch when access is granted. The mechanical quality here is often what separates a 5-year lock from a 15-year one.
• Power — usually four AA batteries, lasting 12–24 months depending on traffic and audit-log behaviour.

Notice what's not in that list: a network connection. The vast majority of hotel locks installed today are offline. They don't phone home. Everything they need to know — which cards are valid, which were revoked, when housekeeping last entered — is encoded directly onto the cards themselves and synced when staff cards "walk past" the lock.

How a card knows which door to open

This is the part most people get wrong. A guest card doesn't contain "the key to room 312." It contains an encrypted credential that says, in effect: "the holder of this card is authorised to enter room 312 between check-in time on Apr 22 and 11 AM on Apr 24, and this credential was issued by encoder #2 at the front desk."

When the card touches the lock, four things happen in sequence:

1. The reader powers the card and asks for its UID — the chip's hardware serial number.
2. The lock and card perform a mutual authentication using a shared secret (a key derived from a master key only the property knows). If either side fails the challenge, the conversation stops cold.
3. Once authenticated, the lock reads the encrypted credential off the card, decrypts it with AES-128, and checks: is this room ID mine? Is the time window still valid? Is this card on the revocation list?
4. If all three pass, the MCU fires the motor, retracts the latch, and writes an audit event: card UID, timestamp, result. If anything fails, it writes the failure too — that's how you investigate disputed access later.

The whole exchange takes about 200 ms. Done well, the guest never notices it's happening.

Why AES-128 matters

You'll hear three terms used loosely: "encrypted," "secured," and "AES." They aren't equivalent. The original Mifare Classic chip used a proprietary cipher called Crypto-1, which was broken publicly in 2008. Locks still using Crypto-1 can be cloned with hardware that costs less than ₹3,000 — and yes, this is documented and exploited in the wild. If a vendor cannot tell you in writing what cipher their lock uses, assume it's broken.

AES-128 — the same standard banks and governments use — is the current minimum bar for hospitality. Mifare DESFire EV2/EV3 chips run AES natively, in hardware, with replay protection and per-session keys. A correctly implemented AES-128 lock cannot be cloned by a guest with a phone or a curious teenager with a Proxmark.

If your supplier can't name the cipher, you don't have a security product. You have a convenience product.

The audit trail — your most underrated feature

Every modern lock keeps a rolling log of the last few hundred events: who tapped, when, and whether the door opened. This log is the single most useful feature when something goes wrong — a complaint, a missing item, a dispute over a damaged room. With offline locks, staff retrieve this log by walking up with a small handheld reader and pulling it over a maintenance card.

What to look for when evaluating a lock's audit capability:

• Event capacity — at least 200 events per lock; 500+ is better for high-traffic doors.
• Tamper logging — does it record someone trying random cards? It should.
• Time-sync — locks drift; check that the property's PMS pushes time updates regularly.
• Export format — can you get a CSV out, or is it locked into the vendor's portal?

Master, grand-master, and emergency cards

A real hotel installation isn't just guest cards. There's a hierarchy:

• Guest cards — opens one room, valid for the stay.
• Floor / housekeeping cards — opens a defined zone, valid by shift.
• Master cards — for managers; opens most rooms but typically excludes safes, suites, or owner residences.
• Grand-master / emergency — opens everything, including in DnD mode. Usually 1–2 cards, kept in the safe.

A good lock supports all of these without creating overlap risk: revoking one master shouldn't affect the others, and an emergency override should always log the event clearly so the GM can review it next morning.

Mobile keys: BLE on top of RFID

Newer locks add Bluetooth Low Energy alongside RFID, so a guest's phone can act as the credential. The cryptography is similar — the credential is still AES-encrypted — but the delivery path changes. Instead of an encoder printing a card, the PMS sends the credential to the guest's phone over the internet, the phone caches it, and BLE delivers it to the lock at the door.

BLE adds two things hotels actually want: contactless check-in (skip the lobby queue), and last-minute key changes (a guest extends their stay; the front desk pushes a new key without printing a card). The trade-off is battery: BLE-on locks consume roughly 30% more power than RFID-only, so plan your replacement schedule accordingly.

What this means for hotels

If you're evaluating locks today, here's the short version of everything above:

• Insist on AES-128 with Mifare DESFire. Walk away from anything still selling Mifare Classic.
• Confirm the audit-log capacity and export path in writing — this is your insurance for disputes.
• Ask about offline behaviour. The lock must work when the network doesn't. Period.
• Plan the credential hierarchy before installation, not after. Get master/floor/emergency policies on paper.
• Get a real warranty. A 5-year electronics warranty and 10-year mechanical warranty is industry standard for premium locks. Anything less is a flag.

RFID locks aren't magic — they're a careful stack of radio physics, cryptography, and mechanical engineering. When the stack is built well, the guest sees nothing but a green light and a click. When it's built badly, you find out at the worst possible time: at 2 AM, on the phone with a guest, trying to explain why their door won't open.

The good news is that getting it right isn't expensive — it just requires asking the right questions before you buy. We hope this guide helps you ask better ones.

---

Have questions about evaluating locks for your property? Talk to our team — we're happy to walk through cipher specs, audit-log examples, and warranty terms before you decide on anything.