How do access cards work?
Peel open an access card and find a coil of wire, a chip smaller than a grain of rice and no battery. Feed it power through the air, hear it answer by tugging on the reader's field, and follow one tap all the way to the lock.
▶ Play with it · Read the 60-second explainer · Watch the 40-second video
- A card with no battery. A contactless card is a plastic sandwich. Inside is a flat coil of a few turns round the edge and one chip about a millimetre across. There is no battery. The reader on the wall has its own coil, driven at 13.56 million swings a second by a quartz crystal.
- Power through the air. The reader's coil and the card's coil are a loose transformer with no iron core. The reader's changing magnetic field induces about 1.2 volts in this card's coil for every ampere per metre of field. A capacitor tunes the coil to 13.56 MHz, so the voltage builds to about Q times more. The field falls roughly eight times for each doubling of distance, which is why a card works only within a few centimetres.
- Talking with no transmitter. The card answers by switching a small load across its coil at 847.5 kHz, one sixteenth of the carrier. The reader senses its own field dip: load modulation. The reader talks by cutting its field for pauses of 2 to 3 millionths of a second. Bits flow at about 106,000 a second. If two cards answer together, the reader spots where their numbers clash and narrows down to one.
- Proving it is the real card. Old cards just repeat a fixed number, which anyone who hears it can repeat. Better cards keep a secret key inside the chip. The reader sends a fresh random challenge, the chip scrambles it with the key, and the reader checks the answer. The key never crosses the air, and yesterday's answer is useless today. Real cards use AES with 128-bit keys.
- The door's decision. The reader only asks. A door controller on the secure side holds the rules: who, which door, what hours. It works even when the network is down. A relay switches the lock. A maglock grips with about 5,300 newtons on 6 watts and lets go when power is cut, so people can escape in a fire. Every event goes into a log. The human weakness is tailgating.
- Cards in daily life. Metro cards keep money on the chip: India's National Common Mobility Card, launched in 2019, lets a gate take a fare offline. Hotel keys, e-passports and phones use the same 13.56 MHz idea. FASTag is different: a UHF tag that reflects a radio wave from metres away. Each tap leaves a record of a card, a place and a time, which is personal data.
| Term | Meaning |
|---|---|
| Passive card | A card with no battery. It runs only on power the reader sends through the air. |
| Induction | A changing magnetic field through a coil makes a voltage in it. This is how the reader powers the card. |
| Resonant tank | A coil and a capacitor tuned to ring at one frequency, here 13.56 MHz, so the voltage builds up. |
| Near field | The zone close to a coil where its magnetic field dominates. It fades roughly with the cube of distance. |
| Load modulation | The card answers by switching a load across its coil, which the reader senses as tiny dips in its own field. |
| Anticollision | The reader's way of picking one card when several answer at once. |
| Challenge and response | The reader sends a fresh random number and the card answers with it scrambled by a secret key, proving it holds the key without revealing it. |
| Door controller | The small computer that holds the access rules, switches the lock and keeps the log. |
| Fail-safe | A lock that releases when power is lost, used where people must be able to escape. |
About 200 years from a twitching needle in London to a card, a phone or a passport that opens a gate with a tap.
- 1831 · A changing magnet makes electricity (Michael Faraday, London, England)
- 1945 · The Thing: a bug with no battery (Leon Theremin, Moscow, Soviet Union)
- 1973 · A transponder with memory is patented (Mario Cardullo and William Parks, United States)
- 1974 · Roland Moreno patents the memory card (Roland Moreno, France)
- 1994 · MIFARE: a contactless card with memory and a cipher (Mikron, Gratkorn, Austria)
- 1997 · Hong Kong launches Octopus (Octopus Cards Limited, Hong Kong)
- 2002 · Delhi Metro opens with tokens and smart cards (Delhi Metro Rail Corporation, Delhi, India)
- 2008 · Researchers show a secret cipher is weak (Karsten Nohl, David Evans, Starbug and Henryk Plötz; Flavio Garcia and colleagues, University of Virginia, Berlin and Radboud University Nijmegen)
The full story, with 30 moments, charts, people and 55 sources: glassbox.how/e/accesscardclear/history. The data lives in history.json.
Made with the Glassbox studio from this box's storyboard (window.glassbox.director). Free to reuse under CC BY 4.0.
| File | What | Size |
|---|---|---|
glassbox/reel.mp4 |
Reel / Short, with captions and soundtrack | 1080×1920 |
glassbox/video.mp4 |
YouTube video, with captions and soundtrack | 1920×1080 |
glassbox/slide-1…10.jpg |
Instagram carousel | 1080×1350 |
glassbox/thumb.jpg |
YouTube thumbnail | 1280×720 |
glassbox/cover.jpg |
Share card and repo social preview | 1200×630 |
glassbox/history-reel.mp4 |
“History in 10 moments” Reel / Short | 1080×1920 |
glassbox/history-slide-*.jpg |
History carousel | 1080×1350 |
glassbox/post.json |
Post copy and schedule used by the publish kit |
This box has no accounts and no ads, and it ships its own fonts and libraries. When you run it yourself it sends nothing anywhere. On glassbox.how, the site's /bar.js also loads Glassbox's analytics: Google Analytics to count visits (it asks first in the EU, UK and Switzerland, and stays off when your browser sends Global Privacy Control or Do Not Track) and ClickTrust to detect bots.
It remembers a few things in your own browser only, and never sends them anywhere:
| Browser storage key | What it holds |
|---|---|
accesscardclear.v1 |
Which chapters you have opened, your best quiz scores, and sound on or off. |
Exactly what each one sees is at glassbox.how/privacy.
- Code: MIT. Use it, change it, ship it.
- Explanations, text, images and videos (
glassbox.json,glassbox/): CC BY 4.0. Credit “Glassbox, glassbox.how/e/accesscardclear”. - Third-party parts keep their own licences: three.js (MIT), Geist, Instrument Serif (SIL OFL 1.1).
- The Glassbox name and logo aren't covered by either licence. See the terms.
Found a mistake? Open an issue. Corrections happen in public.
It's plain HTML, CSS and JavaScript. No build step and no dependencies. Run locally, it contacts no other website.
python3 -m http.server 8000Three.js and the fonts ship in vendor/ and fonts/, so it also works offline.
Then open http://localhost:8000.
| File | What |
|---|---|
index.html, css/app.css |
The page and its styles |
js/app.js, js/stage.js, js/ui.js, js/kit.js |
The shared Glassbox 3D engine: chapters, 3D stage, controls, quiz, video director |
js/card.js |
The shared card and reader models and the physics: field of a loop, induced voltage, the tuned circuit, and the chart boards |
js/chapters/*.js |
One file per chapter: the 3D model, controls, text, key terms, quiz and video scenes |
glassbox.json |
Title, question, explainer beats, key terms, browser storage and credits shown on glassbox.how |
reel in each chapter |
The storyboard the Glassbox studio records into short videos |
glassbox/ |
The published video, slides, thumbnail and post copy |
fonts/, vendor/three/ |
Self-hosted Geist and Instrument Serif (SIL OFL 1.1) and three.js (MIT) |