MIFARE Classic, DESFire, and NTAG: A Complete Comparison Guide for NFC Chip Selection
If you've spent any time sourcing custom NFC cards, you've run into these three names. They all work on 13.56MHz and fit inside standard credit card inlays, but they are not interchangeable for different application systems.
Choosing the wrong chip can mean cards that don't work with your readers, fail a security audit, or cost more than necessary. This guide explains how each chip family works, what it's designed for, and how to choose.
First: Why These Three Are Not Direct Competitors
MIFARE Classic and DESFire are built for closed-loop systems — access control, transit, loyalty — communicating with dedicated readers in managed infrastructure. NTAG was designed for open interaction with smartphones: no reader required, any NFC-enabled phone reads it natively.
If your application involves dedicated readers, you're looking at MIFARE. If it involves consumer smartphones, you're looking at NTAG. If it involves both, a dual-inlay card (DESFire + NTAG in one card body) is the standard solution — DESFire does not natively support tap-to-URL like NTAG, and cannot replace it for smartphone-facing use cases.
MIFARE Classic
The most widely deployed NFC chip in history — NXP estimates over 10 billion shipped globally since launch. Built for access control and transit infrastructure, it stores data in 16 independently keyed sectors.
Memory: 1KB or 4KB | Encryption: Proprietary CRYPTO1 | Write cycles: ≥100,000 (typical)
Use when: You need compatibility with existing installed readers. The majority of legacy access control systems, hotel locks, and transit gates were built around MIFARE Classic. For new deployments with no infrastructure constraint, evaluate DESFire instead.
The security caveat: CRYPTO1 was cryptanalyzed and broken in 2008. Even the revised EV1 retains the same insecure cipher. Cards can be cloned with low-cost hardware. Acceptable for most legacy deployments where attack cost exceeds value gained — not acceptable for high-security, financial, or regulated environments.
- Hotel key cards (many hotel lock brands support Classic; confirm with your lock vendor — major vendors increasingly offer DESFire-compatible systems)
- Legacy office access control and parking systems
- Loyalty and membership programs with modest security requirements
MIFARE DESFire EV1 / EV2 / EV3
NXP's premium chip family, using AES-128 encryption and a flexible file system rather than fixed sectors. One card can carry credentials for multiple independent applications — transit, access, cafeteria — each separately secured.
Memory: 2KB, 4KB, or 8KB | Encryption: EV1: 3DES native, optional AES-128; EV2/EV3: AES-128 standard | Write cycles: ≥500,000 (typical)
EV2 added anti-relay attack protection. EV3 added a hardware secure element, transaction timer, and SDM/SUN function. For new deployments, EV2 or EV3 is recommended.
Use when: Security, regulatory compliance, or multi-application flexibility matters. Card and system implementation costs — including backend licensing and key management infrastructure — are higher than Classic. Justified when the requirements are real; not necessary for a basic office door.
- Government and enterprise ID requiring AES encryption compliance
- Transit programs migrating from MIFARE Classic
- Multi-application campus or corporate cards
- High-security access control: data centers, critical infrastructure, pharmaceutical facilities
NTAG (213 / 215 / 216)
Designed for NFC Forum Type 2 compliance — the standard for smartphone interaction. No dedicated reader or infrastructure required. Any NFC-enabled iOS or Android device reads it natively and acts on the data (opens a URL, reads a contact, triggers an app action).
- NTAG213: 144 bytes — single URL or small payload
- NTAG215: 504 bytes — suitable for NFC business cards and applications requiring larger NDEF records
- NTAG216: 888 bytes — multi-record NDEF, complex payloads
All three support 32-bit password protection and read-only lock to prevent unauthorized rewriting. Write cycles: ≥100,000 (typical).
Compatibility note: NTAG cannot work with closed-loop MIFARE access systems relying on MIFARE proprietary sector authentication. Universal ISO 14443-A readers can read NTAG public NDEF content normally.
Security limit: NTAG213/215/216 offer only simple password protection — no hardware cryptographic challenge-response authentication. A cloned NTAG chip behaves identically to the original. Not suitable for genuine anti-counterfeiting.
- NFC business cards and digital contact sharing
- Product engagement: tap-to-register, tap-to-reorder, tap-to-support
- Marketing triggers: URL, app deep links, promotional content
- Event credentials with smartphone interaction
NTAG 424 DNA and NTAG X DNA
For applications requiring genuine cryptographic verification, these chips go significantly further than standard NTAG.
NTAG 424 DNA uses AES-128 with challenge-response authentication. Each tap generates a unique CMAC verified server-side — a cloned chip cannot replicate this response, enabling real anti-counterfeiting. Compatible with NFC smartphones, no dedicated reader required.
NTAG X DNA (sampling released in 2025, mass production pending) extends this with additional memory and enhanced secure messaging.
Key applications: luxury brand protection, grey market prevention, EU Digital Product Passport compliance (including battery passports), pharmaceutical authentication, and supply chain traceability — areas where server-side tap verification is becoming a regulatory or brand requirement.
If you've been told NTAG213 can support product authentication — it cannot. You need NTAG 424 DNA or NTAG X DNA.
How to Choose
What is the interaction model?
- Dedicated reader in a managed system → MIFARE family
- Consumer smartphone → NTAG family
- Both → Dual-inlay card (DESFire + NTAG); DESFire EV3's SDM/SUN enables limited smartphone interaction via dedicated app but does not support native tap-to-URL
If MIFARE — what is the security requirement?
- Existing legacy infrastructure → confirm chip with your reader vendor; typically MIFARE Classic 1K
- New deployment → DESFire EV2 or EV3
- High-security, regulated, or financial → DESFire EV2/EV3
If NTAG — how much data, and is authentication required?
- Simple URL → NTAG213
- Business card / vCard → NTAG215
- Multi-record payload → NTAG216
- Cryptographic authentication → NTAG 424 DNA or NTAG X DNA
Summary
| Chip Type | MIFARE Classic | MIFARE DESFire EV2/EV3 | NTAG 213/215/216 | NTAG 424 DNA |
|---|---|---|---|---|
| Primary use | Access control, loyalty, transit | High-security, multi-app, transit | Smartphone interaction, marketing | Product authentication, supply chain traceability |
| Interaction | Dedicated reader | Dedicated reader | Any NFC smartphone | Any NFC smartphone |
| Encryption | CRYPTO1 (broken) | AES-128 | 32-bit password only | AES-128 + CMAC |
| Anti-counterfeiting | No | Yes (requires matched reader & key management) | No | Yes (server-side verification) |
| Infrastructure | Yes | Yes | No | No |
| Write cycles | ≥100,000 | ≥500,000 | ≥100,000 | ≥100,000 |
| Cost | Low | Higher | Low–Medium | Medium |
| Best for | Legacy compatibility | New secure deployments | Consumer engagement | Brand protection |
No chip is universally best. The right chip matches your interaction model, security requirement, and infrastructure — at the cost your volume justifies. If you're unsure, share your use case and we'll recommend the right configuration before you commit to production.
We manufacture custom NFC cards across all chip families — NTAG 213/215/216, NTAG 424 DNA, MIFARE Classic, and DESFire EV1/EV2/EV3 — with factory encoding, custom printing, and full OEM/ODM support. mass production MOQ from 1,000 units.
