Lock Compatibility · Chip guide
Ultralight C (ULC) key cards for security-updated hotel locks
Custom printed MIFARE Ultralight® C cards for Saflok, dormakaba, Onity and SALTO properties whose MIFARE Classic® 1K cards stopped encoding after a vendor security update. Chip confirmed by test sample before printing.
For independently sourced replacement cards. Brand names identify the intended locking system; confirm the credential and your property's authorization requirements before ordering.
At a glance · indicative, updated September 2026
Indicative prices for ULC key cards
| Card format | Indicative range per card (USD) |
|---|---|
| MIFARE Ultralight C (ULC), PVC | $0.16 – $0.30 |
| MIFARE Classic 1K compatible, PVC | $0.10 – $0.30 |
Classic 1K is listed for comparison only; it is not a substitute on security-updated locks. ULC inlays can also be laminated into wooden ($0.30–$1.60), bamboo ($0.25–$1.50) and waterproof paper ($0.12–$1.35) card bodies. Those material ranges span several chips, so the ULC figure for a wood, bamboo or paper card is set in the quote.
Indicative USD ranges per card at 1,000–4,999 pieces per design, four-colour offset printing included, EXW Dongguan; freight, duties, taxes, special finishes, sleeves and credential preparation are quoted separately, and the exact price is set in a dated quote.
Quantity bands. Per design, against the 1,000–4,999 range: about −15% from 5,000 pieces, −25% from 10,000 and −35% from 25,000; 500–999 pieces run about +35%. Full price table
A price range is not a compatibility statement. Confirm the chip with test samples in your own locks before ordering.
Short answer
If your locks and encoders received the vendor's security update (dormakaba began the Saflok programme in November 2023; Onity and SALTO run their own programmes), MIFARE Classic® 1K cards typically stop encoding and opening doors, and the property moves to MIFARE Ultralight® C (ULC) credentials. ULC is not the same chip as Ultralight EV1 and the two are not interchangeable. Before ordering, confirm the chip with test samples encoded on your own front desk and tested in your own locks.
Why hotels are asking for ULC key cards
In September 2022 security researchers reported to dormakaba that the MIFARE Classic credentials used by Saflok locks could be cloned and forged from a single legitimate card; the finding was published as Unsaflok in March 2024. dormakaba published a mitigation for System 6000, Ambiance and Community and began upgrading locks, front-desk software and encoders from November 2023. Upgraded properties issue Ultralight C cards, and the encoder no longer accepts Classic 1K stock.
Onity and SALTO have their own programmes. Trillium documentation lists Ultralight C among its reader options, and SALTO Space can issue ULC as a non-configurable technology once it is enabled. The practical result is the same: a front desk finds that the card stock it has reordered for years no longer encodes, and the replacement quote has to name a different chip. The trade abbreviation on those quotes is ULC.
Classic 1K, Ultralight C, Ultralight EV1 and DESFire compared
Reference figures from the NXP product pages and the vendor documents listed at the end of this page. Which chip a property needs is set by its encoder and lock configuration, not by the brand name.
| Chip | Memory / UID | Security | Typical hotel systems | Reads on security-updated locks? | Card bodies |
|---|---|---|---|---|---|
| MIFARE Classic® 1K | 1 KB EEPROM in 16 sectors; 4-byte or 7-byte UID | Proprietary CRYPTO1 cipher; publicly documented weaknesses | Pre-update Saflok MT, Quantum and RT; SALTO Space with Classic active; older Onity Trillium; many other brands | No on Saflok and dormakaba estates that completed the security update; check per system elsewhere | PVC, wood, bamboo, waterproof paper |
| MIFARE Ultralight® C (ULC) | 1,536 bits total (192 bytes), 1,152 bits user memory; 7-byte UID | 3DES mutual authentication | Security-updated Saflok and dormakaba; Onity Trillium (listed option); SALTO Space with ULC active | Yes where the vendor update specifies ULC; confirm with samples on your encoder | PVC, wood, bamboo, waterproof paper (sample check per construction) |
| MIFARE Ultralight EV1 | 640 or 1,312 bits; 7-byte UID | 32-bit password, no mutual authentication | Onity Trillium (listed option); VingCard guest credential catalogue; ticketing | Not a substitute for ULC; a different chip with a different security model | PVC, wood, bamboo, waterproof paper |
| MIFARE DESFire EV2 / EV3 | 2 KB to 8 KB with file-based applications; 7-byte UID | AES or 3DES mutual authentication per application | SALTO Space configured for DESFire; VingCard multi-application catalogue; Saflok RT Plus (listed option) | Only where the system is configured and licensed for DESFire; not a ULC replacement | PVC; wood, bamboo and paper on request with a sample check |
Card bodies: PVC, wood and bamboo and waterproof paper. Each construction is checked with a sample of the intended material.
How to tell which chip you need
Five checks a front-desk or purchasing team can complete without access keys. None of them replaces a test sample.
- 1
Was the front-desk software or encoder updated?
Ask the front desk whether the property management or lock software was upgraded, or whether the encoder was replaced or reflashed. Security updates for Saflok, dormakaba, Onity and SALTO change the encoder before they change the cards.
- 2
When did cards stop working?
If the last batch of Classic 1K cards encoded until a service visit and failed afterwards, note the date. dormakaba began its Saflok programme in November 2023; Onity and SALTO run their own programmes with their own dates. A date is a clue, not a specification.
- 3
What does the vendor invoice or service report say?
Look for a line naming the credential, for example "Ultralight C keycards", "ULC" or "MIFARE UL-C". A service report that lists a software version or a firmware update without a card line does not settle the question on its own.
- 4
Read a working card with NXP TagInfo.
The free NXP TagInfo app on an NFC Android phone identifies the chip family of a card that still opens doors. "MIFARE Ultralight C" or "MF0ICU2" points to ULC; "MIFARE Classic 1K" or "MF1S50" points to Classic. The app reads the chip type, not the hotel's protected configuration, so treat the result as supporting evidence.
- 5
Ask the installer for the credential specification.
Request a non-sensitive specification: chip, capacity and any factory preparation. Do not ask for or send access keys. With that specification, request ULC test samples and have an authorized operator encode and test them before the printed order.
Which systems use ULC
- Saflok (dormakaba): MT, Quantum and RT estates that completed the security update commonly issue ULC; RT Plus lists ULC among its options.
- Kaba / dormakaba (dormakaba): Saflok-related and RT Plus installations under the dormakaba brand follow the same programme; Ilco magstripe floors are unaffected.
- Onity (Honeywell): Trillium documentation lists Ultralight C among its reader options; security-updated Trillium properties commonly move from Classic to ULC.
- SALTO (SALTO Systems): Space issues ULC as a non-configurable technology when it is active in the installation; it is not enabled everywhere.
Not ULC: VingCard estates by ASSA ABLOY do not use Ultralight C. Their guest credential catalogue lists Ultralight EV1 and Ultralight AES, with Plus EV2 and DESFire EV3 for multi-application use. A VingCard order follows the approved credential SKU, not another brand's update.
Ordering ULC cards from Cardotel
- Chip confirmed by sample: request ULC test cards, have an authorized operator encode them on your own front desk and test guest rooms, common doors and lift readers, including reissue and expiry.
- Indicative ULC range in PVC: $0.16–$0.30 per card at 1,000–4,999 pieces per design, printing included, EXW Dongguan. The cost guide gives the full basis, the other card formats and the quantity bands; the exact price is set in a dated quote.
- Card bodies in PVC, wood, bamboo or waterproof paper, four-colour printing, magstripe-free construction; matching sleeves quoted in the same enquiry.
- Mixed estates: separate quote lines for updated floors (ULC) and floors still on Classic 1K, so neither batch is wasted.
- Not sure yet? Start with which chip your locks need or, if cards failed after a service visit, the key card not working checklist.
ULC key card questions
What does ULC stand for on a hotel key card quote?
ULC is the trade abbreviation for MIFARE Ultralight C, an NXP chip with 192 bytes of memory and 3DES authentication. Suppliers in the United States list it as "ULC key cards" or "Ultralight C key cards"; both describe the same chip. Keep the full name on the quote so it is not confused with Ultralight EV1 or Ultralight AES.
Do security-updated Saflok locks need ULC cards?
Properties that completed the dormakaba Saflok security update commonly report that Classic 1K cards no longer encode and that the installer specified Ultralight C. That is the usual outcome, not a rule for every property: some estates were upgraded to other credentials or replaced locks entirely. Confirm the credential with your installer and test ULC samples on your own encoder before ordering.
Is Ultralight C the same as Ultralight EV1?
No. Ultralight EV1 uses a 32-bit password and has 640 or 1,312 bits of memory; Ultralight C uses 3DES mutual authentication with 1,536 bits. A lock configured for ULC will not accept an EV1 card, and an EV1 quote does not fulfil a ULC specification. Ultralight AES is a third, newer product that is also not interchangeable.
Will my old Classic 1K cards work again after ordering ULC?
Not on doors and encoders that were updated. The update removes Classic 1K as an accepted credential, so existing Classic stock can only be used on floors that were not updated. Count the remaining Classic stock, separate the floors and quote ULC for the updated areas.
Do VingCard locks use ULC cards?
VingCard estates by ASSA ABLOY do not use Ultralight C. The VingCard guest credential catalogue lists Ultralight EV1 and Ultralight AES, with Plus EV2 and DESFire EV3 for multi-application use, and the cards receive preparation during manufacture. Order against the approved VingCard credential SKU, not against another brand's security update.
Can ULC cards be made in wood, bamboo or paper?
Yes. The ULC inlay can be laminated into PVC, wooden, bamboo and waterproof paper card bodies. Each construction changes thickness and antenna behaviour, so test a sample of the intended material in your encoder and doors rather than approving the chip in PVC and the material separately.
How much do ULC key cards cost?
Indicative Cardotel range for printed MIFARE Ultralight C (ULC) cards in PVC: $0.16–$0.30 per card at 1,000–4,999 pieces per design, four-colour offset printing included, EXW Dongguan. Freight, duties, taxes, special finishes, sleeves and credential preparation are quoted separately. Quantity moves the figure: about −15% from 5,000 pieces, −25% from 10,000 and −35% from 25,000. The exact price is set in a dated quote for your artwork, material and destination. Full hotel key card price table
What should I send to get a ULC quote quickly?
Send the lock and encoder model, the software name and version, the current card SKU or a TagInfo screenshot of a working card, the quantity per design, material, artwork status and destination. Mark unknown fields as not sure. Do not send SAM keys, passwords or guest data.
Sources · checked 17 September 2026
- dormakaba: Security Support Center for Saflok System 6000, Ambiance and Community
- Unsaflok: disclosure of the Saflok MIFARE Classic vulnerability and the Ultralight C upgrade
- NXP: MIFARE Ultralight C (MF0ICU2) product page
- NXP: MIFARE Ultralight EV1 (MF0ULX1) product page
- SALTO Space: Ultralight C and non-configurable keys
- Onity: Trillium RFID encoder and reader data sheet (PDF)
These references describe the manufacturers' systems and chips. They are separate from evidence for the Cardotel card offered in your quote. MIFARE, MIFARE Classic, MIFARE Ultralight and MIFARE DESFire are trademarks of NXP B.V.; lock brand names identify the intended system only.
Plan your Ultralight C (ULC) card order
Share your lock system, approximate quantity and destination. Unsure of the chip? Start with the system details you have.