Indala ASP FlexSecur Cards Cannot Be Copied or Cloned

Indala ASP FlexSecur cards cannot be cloned, copied, or replaced by any third-party supplier. The FlexSecur layer encrypts card data with a site-specific key before programming; only the matched ASP+ reader can decrypt that data, and only HID Global holds the key needed to produce new cards for an enrolled site. If your building uses ASP / FlexSecur credentials, this guide explains why those replacements must come through HID and what your options are in the meantime.

What Is Indala ASP / FlexSecur?

Indala is a 125 kHz proximity format developed by Motorola and later acquired by HID Global. It uses Phase Shift Keying (PSK) modulation — a fundamentally different air-interface protocol than HID Prox (ASK/FSK) — which is why standard Indala cards and HID Prox cards are not interchangeable even at the same carrier frequency.

Most Indala installations use the base FPCRD or FPISO card format with standard 26-bit or 27-bit Wiegand encoding. These are straightforward proximity credentials: facility code and card number are stored unencrypted on the chip and delivered to the access panel via a Wiegand output. American Key Cards supplies compatible versions of these standard Indala cards — see the Indala FlexPass 26-bit format page for details.

FlexSecur is a separate, higher-security programming layer layered on top of that same 125 kHz PSK platform. With FlexSecur enabled, the card data — facility code, card number, and additional credential fields — is encrypted using a site-specific key before the card is programmed at the factory. That key is unique to the enrolling site and remains in HID’s custody. When the card is presented to a reader, the ASP+ reader uses its locally stored site key to decrypt the data. If decryption succeeds, the reader passes the Wiegand data to the panel. If it fails — wrong site, wrong card, or cloned credential — the reader outputs nothing.

The chip itself is Indala’s proprietary 172-bit RFID coil operating at 125 kHz with PSK modulation. The same physical chip is used in both standard and FlexSecur cards. The difference is entirely in what data is written during factory programming and how the reader is configured.

Why FlexSecur Cards Cannot Be Cloned

Most 125 kHz proximity cards — HID Prox, standard Indala, AWID, EM4100 — can be reproduced if you know the facility code and card number. The data on the chip is unencrypted and readable with an RFID scanner. A compatible blank (commonly the T5577 chip or a factory-programmed credential from a supplier like American Key Cards) can be written with identical data and will operate in the reader exactly like the original.

FlexSecur eliminates this attack surface. The encrypted payload on the card is meaningless without the site-specific decryption key. Even if you read the raw bits off a FlexSecur card with a Proxmark3 or similar tool, the data you capture is ciphertext — not the facility and card number in plaintext. Writing that ciphertext to a blank chip produces a card that a different site’s reader will reject. Writing fabricated data produces a card that even the correct site’s reader will reject.

To produce a functional replacement FlexSecur card, you need:

1. The site-specific encryption key for that installation
2. HID’s proprietary FlexSecur programming process
3. The correct FPCRD or FPISO card blank

Only HID Global holds item one. No aftermarket supplier, no card duplicator machine, and no RFID security researcher has published a successful break of the FlexSecur scheme as of this writing.

How to Identify a FlexSecur Installation

The quickest indicator is the reader model. Standard Indala installations use the Indala 603 FlexPass, FP4511A mullion reader, or FP3521A. FlexSecur installations use HID Indala ASP+ readers, most commonly the HID Indala 610 ASP Mid-Range reader. The “ASP” designation in the model name is the tell.

Reader Model	Credential Type Required
Indala 603 FlexPass	Standard Indala 26-bit (FPCRD, FPISO) — AKC can supply
Indala FP4511A Mullion	Standard Indala 26-bit — AKC can supply
Indala FP3521A	Standard Indala 26-bit — AKC can supply
HID Indala 610 ASP Mid-Range	FlexSecur encrypted (FPCRD ASP variant) — HID only
HID Indala ASP+ series	FlexSecur encrypted — HID only

If the reader is an ASP+ model, FlexSecur is almost certainly active. Your installer’s commissioning documentation should also list whether FlexSecur was configured during system setup.

One additional test: present a known-good standard Indala 26-bit card to the reader. If it reads successfully, you have a standard Indala system. If it is rejected, and your existing OEM cards work fine, FlexSecur is likely active.

OEM Part Numbers and What They Mean

The base card body for both standard and FlexSecur Indala credentials is the same product family:

• FPCRD — standard clamshell proximity card; can be ordered with or without FlexSecur encryption
• FPISO — ISO-size printable card; same dual-availability
• Indala ASP+ reader series — reader hardware that supports FlexSecur decryption

The key point: the part number alone does not tell you whether a card is FlexSecur-encrypted. That designation is determined at the time of factory order and is specific to the site enrollment. An FPCRD can be a standard 26-bit card or an ASP FlexSecur card depending on how it was ordered.

This is why you cannot simply purchase an FPCRD from a distributor as a drop-in FlexSecur replacement. The physical part is correct; the programming would be wrong.

Who Can Supply FlexSecur Replacement Cards

For FlexSecur-protected sites, the replacement path runs through HID Global directly or through an authorized HID integrator. Because the site key is held in HID’s system, new cards must be programmed by HID using that key. The process typically involves:

1. Providing your site enrollment information to HID or your integrator
2. HID retrieving the site key from their records
3. HID programming new FPCRD or FPISO blanks with FlexSecur encryption
4. Delivery and enrollment in your access panel

The timeline and cost are both higher than for standard proximity cards, which is one of the tradeoffs of FlexSecur’s stronger security posture.

For a full technical overview of the format, see the Indala ASP / FlexSecur format page.

If you are not certain whether your system uses FlexSecur, contact American Key Cards before ordering. We will help you determine whether your Indala installation is standard (where we can supply compatible cards at a lower cost than OEM pricing) or FlexSecur (where HID is the correct path).

Standard Indala 26-Bit: Where AKC Can Help

If your Indala system uses standard FlexPass credentials — not FlexSecur — American Key Cards can supply compatible cards and key fobs programmed to your facility code and card number range. These are manufactured to the same specification as the OEM FPCRD-SSSMW-0000 and FPISO-SSSCNA-0000 cards: 125 kHz, PSK modulation, 26-bit Wiegand output, facility code 1–255, card number 1–65,535.

We also supply Indala 27-bit compatible cards for installations that use the extended 27-bit format with facility codes up to 8,191.

Compatible cards are manufactured by specification — we are not affiliated with or authorized by HID Global. For standard (non-FlexSecur) Indala installations, this means a direct-buy path with no OEM minimum order quantity and pricing that reflects the aftermarket rather than the integrator channel.

FlexSecur vs. Standard Indala: Security Summary

FlexSecur and standard Indala share the same physical platform (125 kHz, PSK modulation, Indala 172-bit coil) but differ fundamentally in what is written to the chip and how the reader interprets it.

Property	Standard Indala 26-bit	Indala ASP FlexSecur
Frequency	125 kHz	125 kHz
Modulation	PSK	PSK
Encryption	None — plaintext facility/card number	Site-specific key, factory-programmed
Cloneable	Yes, from facility and card number	No — site key required
Third-party supply	Yes (AKC and others)	No — HID Global only
Reader required	Standard Indala (603, FP4511A, FP3521A)	HID Indala ASP+ (610 ASP, etc.)
OEM card SKU	FPCRD, FPISO (standard)	FPCRD, FPISO (ASP variant)

For security-conscious installations at 125 kHz, FlexSecur is one of the strongest protections available at this frequency tier. The tradeoff is complete dependence on HID Global for card supply.

Bottom Line

If you have an Indala system with standard (non-FlexSecur) credentials, American Key Cards can supply compatible replacements programmed to your facility code. Visit our Indala FlexPass format page or contact us with your reader model and facility code to get a quote.

If you have an ASP / FlexSecur installation, the honest answer is that no third-party supplier can produce working replacements — contact your HID integrator or HID Global directly. If you are not certain which type of system you have, reach out and we will help you confirm before you spend time chasing the wrong supply channel.