A card reader, often called a badge reader, is the device mounted beside a door, gate or turnstile that reads a credential (a card, key fob, phone or sometimes a PIN or fingerprint) and passes it to the access control system that decides whether to unlock. If you have heard it called an “HID reader”, that is because HID Global is one of the best-known makers of these readers and cards; many other manufacturers make them too, and the buying questions are the same whatever the brand.
At a glance
- A reader reads a credential and hands it to a door controller, which usually makes the unlock decision.
- Readers differ by what they can read: 125 kHz proximity cards, 13.56 MHz smart cards, phones over Bluetooth or NFC, PIN codes or biometrics.
- Multi-technology readers can read old and new credentials during a migration.
- The link to the controller is commonly the older Wiegand interface or the newer OSDP standard, which supports encryption when enabled.
- The reader you choose limits the credentials you can use, so pick them together.
What problem it solves
Electronic access depends on each door being able to identify who is standing at it. The card reader is that point of identification. It turns a card tap or phone tap into data the system can check, log and act on, which is what lets you remove a person’s access without changing locks and see who opened which door.
Reader choice also decides how secure the front end of the system is. Readers that only accept older formats keep you tied to credentials that are widely reported to be easy to copy, while newer readers can support encrypted cards and phones. Because readers sit on the outside of the door, they are also the part of the system an intruder can physically reach.
How it works
Reading the credential. Most access readers are contactless: the reader emits a radio field and the card or phone answers when held close. Older proximity cards use 125 kHz and typically send a fixed number. Smart cards use 13.56 MHz and can store data protected by cryptographic keys, so the reader and card can authenticate each other. Readers that support mobile credentials use Bluetooth Low Energy (BLE), NFC or both to read a phone or watch.
Other factors. Some readers add a keypad for a PIN, which can be required in addition to a card for sensitive rooms. Biometric readers check a fingerprint, face or other trait; because biometric data is regulated in some places (Illinois is the best-known US example) and rules vary by country and state, check with counsel before deploying them.
Talking to the controller. The reader sends what it read to the door controller. Many installed readers use Wiegand, an older interface that is one-way and unencrypted, which makes it possible for someone with access to the wiring to capture or replay credential data. OSDP (Open Supervised Device Protocol), a Security Industry Association standard also published as IEC 60839-11-5, supports two-way communication, reader supervision and an encrypted Secure Channel mode; that protection depends on the mode actually being enabled. Some newer readers connect over the IP network instead.
Power and mounting. Readers are usually powered by the controller through their cable; some IP readers can use Power over Ethernet (PoE) where supported. Tamper switches in many readers alert the system if the reader is pried off the wall.
When it matters for buyers
- When upgrading credentials. Moving off 125 kHz prox or adding phone access usually starts with the readers.
- When moving to cloud access control. Some access control as a service (ACaaS) platforms work with common third-party readers; others require their own.
- When building out a new site. Choosing one reader family across locations keeps one credential working everywhere.
- When a security review flags Wiegand. Rewiring or replacing readers to use OSDP with secure channel is a common remediation.
- When readers fail or reach end of life. Replacement is the moment to check credential and protocol support for the next decade.
Questions to ask vendors
- Which credential technologies does this reader support (125 kHz, 13.56 MHz formats, BLE, NFC, PIN, biometrics)?
- Can it read our current cards and the cards we plan to move to, at the same time?
- Does it support OSDP with Secure Channel, and will it be configured that way?
- Are custom or site-specific keys supported for smart cards, and who holds them?
- Is the reader compatible with our current or planned controller or cloud platform?
- What tamper detection does it have, and is it rated for outdoor use if needed?
- How are reader firmware updates delivered?
How it differs from a door controller
The card reader is the part people touch: it reads the credential and reports it. The door controller, usually mounted out of reach on the secure side of the door or in a closet, holds the permission list, decides whether to unlock, drives the lock and records the event. Keeping the decision on the secure side means that, in a well-designed installation, pulling a reader off the wall should not by itself unlock the door. Some all-in-one or cloud-connected devices combine reader and controller in one unit, so ask which design you are buying. See our door access controls overview for help choosing hardware.