NFC is a type of RFID. RFID is the umbrella term for anything that reads a tag over radio. NFC is one slice of it: 13.56 MHz, a range of a couple of centimetres, and a set of standards your phone speaks. Lots of access cards are a different slice, low-frequency 125 kHz, and your phone can't read those at all.
For a password manager you unlock with a card, that's the whole question. A 125 kHz card works with a desk reader and nothing else. A 13.56 MHz card also works when you tap it on your phone. Same shape of plastic, different radio.
The short version
| Low-frequency RFID (125 kHz) | High-frequency RFID / NFC (13.56 MHz) | |
|---|---|---|
| Frequency | 125 kHz | 13.56 MHz |
| Typical range | Longer. The Flipper Zero team puts it at up to a metre with the right reader | Short. The NFC Forum gives a typical range of up to 2 cm |
| What the card sends | An ID number, and that's it | An ID, and optionally data and cryptographic protocols |
| Security | Low. The ID isn't authenticated and can be copied | Can support strong cryptography such as AES, if the system uses it |
| Can a phone read it? | No. Phones need an external reader for 125 kHz | Yes, on phones with NFC |
| Common example | EM4100 cards and key fobs | MIFARE cards, NFC tags, contactless payment |
Sources: the NFC Forum's technology overview for frequency, range and standards, and Flipper's write-up on RFID protocols for how the two families behave in practice.
Where the confusion comes from
People say "RFID card" when they mean the card that opens the office door. That card could be either kind. The word tells you nothing about the frequency.
It gets worse when you shop. A listing called "RFID card" might be 125 kHz. A listing called "NFC card" is 13.56 MHz. Read the frequency, not the label.
NFC does more than read tags
The NFC Forum defines several modes. In reader mode, your phone acts like a card reader and talks to a tag. In card emulation mode, your phone pretends to be a contactless card, which is how paying with your phone works. For unlocking a password manager, only reader mode matters: the phone reads the card.
125 kHz is old, and still everywhere
Low-frequency cards are cheap and simple, which is why they're still in so many buildings. Flipper's team describes the protocol as primitive: the card can only transmit its identification number, and that data isn't authenticated or protected. A read-only EM4100 chip can't be rewritten, but its ID can be copied onto a writable blank.
Why your password manager cares
Three reasons. Two are practical, one is about security.
1. Whether your phone can open the vault
If your card is 125 kHz, the phone is out. You need a reader for every machine you sign in on. If the card is 13.56 MHz, your phone is the reader, and you don't need to buy anything else for mobile.
2. What the reader looks like on your desk
A common 125 kHz desk reader plugs in over USB and types the card's ID into whatever field has focus, like a keyboard. TagTix's guide to the EM4100 reader describes exactly that, with no drivers to install. That's why the SecureGate Card desktop app puts the cursor in the card field when you open it: you tap, the reader types, you're in.
3. What the card actually proves
This is the one people skip.
A 13.56 MHz card can run proper cryptography. That doesn't mean it does. If a system only reads the card's ID, it gets the same thing a 125 kHz system gets: a number. And a number can be copied.
SecureGate Card reads the ID on both frequencies. It doesn't run a cryptographic challenge on the card. So the card is a keycard, not a security key. It's quick, and you'll actually use it. It isn't phishing-resistant and it isn't something to rely on alone for high-value accounts.
How SecureGate Card handles both
Your vault can have more than one way in, all pointing at the same account.
- Desk reader. A 125 kHz EM4100 USB reader reads the card and types the ID into the app.
- Your phone. The Android app reads the ID of 13.56 MHz tags over NFC. You link the tag to your account and it becomes another way in.
- No card at all. Email and master password, with 2FA codes in the same vault.
One detail matters here. A 125 kHz card and an NFC tag are two different chips. If you want one physical card that works on both the desk reader and the phone, it has to be a dual-frequency card: two chips and two antennas in the same plastic, for example an EM4100 paired with a MIFARE Classic 1K. These are sold widely for buildings that run old and new readers side by side. A plain 125 kHz card won't work on your phone, whatever the packaging says.
How the NFC card unlock works goes through linking a card and a phone step by step.
Security: what we'd tell a friend
Treat the card like the keycard to your building.
- Keep it on you, not in your laptop bag. Losing both together hands someone the card and the machine.
- Verify your email. When your vault is opened from an IP and device we haven't seen in the last 30 days, you get an email. That's how you find out something happened.
- Keep the master password. The card is a shortcut to the vault, not a replacement for a strong password behind it.
- Use passkeys or a FIDO2 key for the accounts that matter most. Your vault can hold passkeys for sites that support them. For your email admin account, a hardware key is still the right tool.
If you lose the card, deactivate it from the panel. From then on, signing in with it is refused, and you still get in with email and master password or your linked phone.
What this means for a team
For a small company, the frequency question is often answered for you: whatever the office doors already use.
If your building runs 125 kHz and staff sign in at desks, a 125 kHz reader per desk keeps things simple. If people work from phones, you want 13.56 MHz or dual-frequency cards. Mixing is fine. Each person's vault accepts the card and the phone as separate ways in.
On the Business plan you also get access limited to your office network and an audit trail of who got in and when. The business page has the details.
When SecureGate Card fits, and when it doesn't
It fits if you want to open your password manager with a tap instead of typing a master password all day, and you're comfortable with what a keycard is. It fits a small team that already carries access cards and wants one less password to type. Personal is free. Team is €4 per user a month, Business €8, with a 14-day trial, all on the pricing page.
It doesn't fit if you're looking for a card that proves identity with cryptography. That's a FIDO2 security key, and we're not one. It also doesn't fit if you need a vault the provider can't read. SecureGate Card encrypts your data with AES-256-GCM on our servers, with a key we hold. Bitwarden and 1Password both encrypt on your device before anything leaves it. If that's a requirement, pick one of them.