Can HID Prox Cards Be Cloned? (Honest Answer)

HID Prox cards can be cloned. That is the direct answer. Standard HID Prox — the H10301 26-bit format that runs on most legacy access systems — operates at 125 kHz with no encryption and no authentication, which means any device that can interrogate the card’s RF field can capture and reproduce the credential data. American Key Cards supplies HID Prox H10301-compatible cards and key fobs programmed from your facility code and card number — built to specification, not copied from existing cards. If you are reading this because you need to replace lost badges, add credentials to an existing system, or decide whether to upgrade for security, the rest of this guide gives you the honest technical picture without the sales spin.

Is HID Prox Encrypted? (No — and That Is the Whole Point)

Verdict: Standard 125 kHz HID Prox has zero cryptographic protection. It was never designed to have any.

Every HID Prox credential — whether it is a thin 1326 ProxCard II, a printable 1386 ISOProx II, or a 1346 ProxKey III fob — contains a passive RFID chip that wakes up inside a reader’s electromagnetic field. The reader energizes the card, the card broadcasts its stored data, and the reader passes that data to the access controller as a Wiegand output. That broadcast is a fixed, plain FSK-modulated signal. It carries the same facility code and card number every single time, with no key, no rolling code, and no back-and-forth challenge between card and reader.

This is fundamentally different from a modern smart credential. With encrypted formats, the reader issues a challenge, the card proves it holds a secret key without ever transmitting the key itself, and the actual credential data is encrypted with AES. None of that exists in 125 kHz Prox. The card is, in effect, a wireless barcode that anything with a 125 kHz antenna can read.

The Standard HID Prox Card Line (OEM Part Numbers)

If you are trying to identify what you already have, HID’s 125 kHz Prox catalog uses a consistent part-numbering scheme. These are the most commonly searched OEM credentials — every one of them is the same unencrypted H10301-capable 125 kHz technology, differing only in form factor:

OEM Part Number	Common Name	Form Factor
1326	ProxCard II	Thin clamshell (non-printable)
1386	ISOProx II	ISO PVC, direct-print card
1346	ProxKey III	Key fob / tag
1336	DuoProx II	Printable card with magstripe slot
1586	Smart ISOProx II	ISO card with embedded contactless smart chip
1391	ProxPass / adhesive tag	Adhesive label / vehicle tag variant

OEM HID cards are sold through HID’s authorized distributor channel, often with minimum order quantities and dealer markup. That distribution model — not any technical lock — is the main reason buyers look for compatible alternatives. There is no proprietary cryptographic barrier preventing a third party from producing a card to the same open specification.

Can HID Prox Cards Be Cloned? (The Technical Reality)

Verdict: Yes, easily, with hardware that costs less than a tank of gas.

Here is exactly how it works, in plain terms:

Reading the card. A device such as a Proxmark3 — a widely available RFID research tool — captures the facility code and card number from an HID Prox card when held within a few inches of it. The capture takes a second or two. Even simpler $30 handheld “key copiers” sold online can read many 125 kHz Prox cards.

Writing the copy. That captured data is written to a T5577 blank card — a multi-frequency programmable RFID transponder that costs a few dollars and is sold openly. The T5577 is configured to emulate the HID Prox protocol and broadcast the same facility code and card number.

Using the copy. The cloned card works in the reader exactly like the original. The reader has no mechanism to distinguish an OEM HID chip from a T5577 that is transmitting identical data in the identical format. There is no serial-number check, no encryption to fail, nothing to flag the duplicate.

This is not a flaw unique to HID. It applies to the entire category of 125 kHz proximity credentials. The same class of tools clones Kantech ioProx (XSF), Indala FlexPass 26-bit, AWID, DoorKing DKProx, and essentially every other unencrypted low-frequency format. AWID is a frequent point of confusion here because it shares HID’s 26-bit output — our explainer on the difference between AWID and HID 26-bit shows why the cards still are not interchangeable despite the identical clone exposure. The technology was standardized in an era when the cloning hardware did not exist on the open market. It does now.

How a Cloned Card Differs From a Compatible Replacement

The word “cloning” gets thrown around loosely, and the difference is worth being precise about — legally and operationally.

A cloned card is an unauthorized copy of a specific, existing credential. It carries the exact facility code and card number of a real card that was read without the cardholder’s consent. The intent is to use someone else’s valid identity to gain access. Depending on jurisdiction and circumstances, making one can run afoul of computer-fraud or property-access laws.

A compatible replacement card is a brand-new credential, legitimately programmed by the authorized system owner. American Key Cards encodes HID-compatible cards from your facility code and your card number range, written to the H10301 specification during manufacture — the same process the OEM uses. The card is not duplicated from any existing card; it is produced to spec.

The analogy is straightforward: cloning is photocopying a banknote; ordering a compatible replacement is asking your bank for a new checkbook. What makes a credential valid in your building is not secrecy — it is that the facility code and card number match an entry your administrator added to the access database. The specification itself is open.

American Key Cards is not affiliated with HID Global. Our compatible cards are produced by specification, not reverse-engineered from OEM cards, and every card carries a lifetime parts and workmanship guarantee.

Which HID Formats Are Clone-Resistant and Which Are Not

Not all “HID” credentials are the same. The brand name spans both the wide-open 125 kHz Prox family and genuinely secure 13.56 MHz smart formats. If security is your concern, this table is the one that matters:

Format	Frequency	Encryption	Authentication	Practically Clonable?
HID Prox (H10301 26-bit)	125 kHz	None	None	Yes — Proxmark3 + T5577
HID iCLASS Legacy	13.56 MHz	Weak / compromised	Limited	Yes — known key attacks exist
HID iCLASS SE	13.56 MHz	AES (Secure Identity Object)	Mutual	No — not with off-the-shelf tools
HID Seos	13.56 MHz	AES-128, standards-based	Mutual	No — current best-in-class
MIFARE DESFire EV2 / EV3	13.56 MHz	AES-128	Mutual	No

The takeaway: “HID” alone tells you nothing about security. A 1326 ProxCard II is trivially clonable; a Seos credential is not. The middle row is the one that trips people up — our separate look at whether HID iCLASS legacy can be cloned explains why that 13.56 MHz format is not the safe upgrade its frequency suggests. If a vendor tells you your old 125 kHz Prox cards are “secure,” they are either confused or selling you something.

Should You Worry? (An Honest Risk Assessment)

Verdict: For most buildings, the cloning risk is real but tolerable. For a few doors, it is not.

We will not pretend the risk is zero, and we will not inflate it to sell an upgrade. Cloning an HID Prox card requires an attacker to get a reading device within a few inches of a live card for a second or two — close enough to physically bump someone or briefly handle their badge. That is a meaningful barrier in practice. The overwhelming majority of commercial, residential, and institutional deployments run 125 kHz Prox and accept this risk because the cost and disruption of ripping out every reader is not justified by the threat.

Where it stops being acceptable is at high-value doors: server and network rooms, pharmacies and drug storage, cash rooms, executive suites, research labs, and anywhere a compliance regime explicitly requires it. For those, 125 kHz proximity — HID Prox included — is the wrong long-term answer.

How to Make Your HID System Clone-Resistant

You do not have to convert your whole building at once, and you should not let anyone tell you that you do.

The practical path is to upgrade the readers at your high-risk doors to HID multiCLASS SE or iCLASS SE readers, which read 13.56 MHz encrypted credentials — iCLASS SE or Seos. These formats use AES encryption and mutual authentication: the data is never transmitted in the clear and cannot be lifted and replayed with a Proxmark3 or any commercially available hardware as of this writing.

The migration-friendly detail: multiCLASS SE readers are dual-technology. They read your existing 125 kHz Prox cards and new encrypted credentials simultaneously. That lets you swap readers door by door, issue encrypted cards to the people who need access to sensitive areas, and keep your legacy Prox population working everywhere else during the transition. No flag-day cutover required.

If you are not sure which HID format your readers actually use, our guides on identifying your access card format and the iCLASS SE vs. Seos security comparison walk through it.

What You Need to Order Compatible HID Prox Cards

If you have decided that compatible 125 kHz Prox replacements are right for your situation — replacing lost badges, adding credentials, or building a standing inventory — ordering is straightforward. You need:

1. Facility code — the site-level code (0–255) assigned when the system was installed. It is usually printed on existing cards or available from your installer or panel records.
2. Card number range — the sequential numbers (0–65,535) you want encoded. For replacements, provide the original card number so the new card inherits the same access rights in your panel; for additions, specify unused numbers in your range.
3. Form factor — clamshell (1326-style), printable ISO card (1386-style), or key fob (1346-style).

American Key Cards supplies these direct, with no dealer account required, no OEM minimum order, and pricing at a fraction of OEM. Every card is encoded to your exact specification before it ships and is backed by a lifetime parts and workmanship guarantee.

Ordering Compatible HID Prox Cards

If you manage an HID Prox system and need to replace lost cards, issue new credentials, or stock spares, contact American Key Cards with your facility code, card number or range, quantity, and preferred form factor. We will confirm the format, encode the cards to the H10301 specification, and ship direct.

And if this article convinced you that the doors that matter deserve better than 125 kHz, tell us that too — we will point you toward the right encrypted upgrade path rather than sell you more of a format we just told you can be cloned.