An access card reader is a device mounted at a door that scans a card, key fob, or mobile credential to confirm identity and unlock the entrance. It sends the credential’s unique code to a controller, which checks the code against a database, then unlocks the door and records who entered and when. For businesses and government facilities, an access card reader replaces mechanical keys with credentials you can issue, schedule, and revoke in seconds.
Key Takeaways
- An access card reader verifies a credential, not a person. It reads a card, fob, badge, or phone, then a controller decides whether to unlock the door and logs the event.
- Six reader types cover most commercial doors: proximity/RFID, encrypted smart card, mobile/NFC, keypad/PIN, biometric, and legacy magnetic stripe.
- Card security depends on frequency and protocol. 125 kHz proximity cards are easy to clone, while 13.56 MHz encrypted smart cards and the OSDP reader protocol are the standard for new installs.
- A door access card reader costs about $1,500 to $3,500 per door installed, plus roughly $30 to $200 per door per month for access control software.
- Government facilities need specific readers. FIPS 201 / PIV and CAC-capable readers, plus NDAA-compliant hardware, are required on many federal and grant-funded projects.
Have a security project?
How an Access Card Reader Works
An access card reader works in four steps, from the moment a credential is presented to the moment the door unlocks and the event is logged.
- Present the credential. A user taps or holds a card, key fob, or smartphone near the reader, or swipes a magnetic stripe card through it.
- Read the code. The reader captures the credential’s unique identifier and passes it to the door controller.
- Verify against the database. The controller checks the code against the access rules set for that door, time of day, and user.
- Unlock and log. If the credential is valid, the controller releases the lock for a set interval and records the entry with a timestamp.
On modern systems, the reader talks to the controller over the Open Supervised Device Protocol (OSDP), which encrypts that connection with AES-128 over an RS-485 link, per the Security Industry Association. That encrypted link is one of the biggest differences between a modern access control system and an older one.
Types of Access Card Readers
Access card readers fall into six main types, grouped by the credential they read and how they verify it.
Proximity and RFID Card Readers
Proximity card readers use radio frequency identification (RFID) to read a card or fob held a few inches away, with no physical contact. They are the most common access card reader in commercial buildings because they are fast, durable, and work through wallets and lanyards. Most run at either 125 kHz (legacy proximity) or 13.56 MHz (contactless smart cards), and that frequency decides how secure the credential is. A separate proximity cards guide breaks the technology down further.
Smart Card Readers
Smart card readers read a 13.56 MHz card with an embedded chip that encrypts the credential and authenticates with the reader before any data is shared. Encrypted formats like MIFARE DESFire and iCLASS SE, read by multi-technology readers such as HID Signo, authenticate with the reader and protect the credential, so the card cannot be copied by the low-cost cloners that defeat older proximity cards. Smart cards are the current baseline for any new commercial or government install.
Mobile and NFC Credential Readers
Mobile credential readers unlock a door when an employee presents a smartphone over NFC or Bluetooth, using a credential stored in a secure app or a mobile wallet. They remove the cost and plastic waste of physical cards and let administrators issue or revoke access remotely in seconds. Most current cloud access platforms support mobile credentials alongside cards, a shift the mobile and NFC access control guide covers in detail.
Keypad and PIN Readers
Keypad readers grant access when a user enters a PIN on a physical or touch keypad, with no card required. They are inexpensive and remove the cost of replacing lost cards. A PIN can be shared, observed over a shoulder, or guessed, so keypads suit lower-security doors or work best paired with a card for two-factor entry.
Biometric Readers
Biometric readers verify a person by a physical trait, most often a fingerprint, and increasingly a face or palm vein. Because the credential is the person, it cannot be lent, lost, or stolen like a card or PIN. Biometric readers cost more than card readers and are usually reserved for high-security doors or paired with a card for multi-factor access, as explained in the fingerprint access control guide.
Magnetic Stripe Readers (Legacy)
Magnetic stripe readers require a user to swipe a card with a magnetic band, the same technology as an older credit card. Swipe cards wear with use and are simple to copy, so they have largely been replaced by contactless credentials and are considered legacy for new commercial access control.
Have a security project?
Access Card Reader Security: Frequency and Protocol
The security of an access card reader comes down to two things: the frequency of the card it reads and the protocol the reader uses to talk to the controller.
125 kHz vs 13.56 MHz Cards
125 kHz proximity cards transmit a fixed number with no encryption, and a copier costing under $30 can clone one in seconds, according to security testing firm IPVM. 13.56 MHz smart cards such as MIFARE DESFire and HID iCLASS SE encrypt the credential and authenticate with the reader, and have no publicly known low-cost clone. For any new door access card reader, a 13.56 MHz encrypted credential is the recommended minimum for commercial security.
OSDP vs Wiegand
Wiegand is the legacy wiring protocol between a reader and controller, and it sends the credential in plain text over a one-way link that can be intercepted. The Open Supervised Device Protocol (OSDP) replaces it with AES-128 encryption, two-way communication, and tamper monitoring, and is an approved standard of the Security Industry Association. On a new system, OSDP-capable readers keep the connection between the reader and the panel encrypted end to end.
Badge Readers and Credential Forms
A badge reader is an access card reader that reads an employee ID badge, which is simply a credential in card form printed with the person’s photo or company branding. Badge readers use the same proximity, smart card, or mobile technology as any other reader; the badge just doubles as visible photo identification.
Access card readers accept several credential forms:
- Cards carried in a wallet or worn on a lanyard.
- Key fobs attached to a keyring for quick tap access.
- ID badges that combine the credential with a printed photo.
- Mobile credentials stored in a phone app or wallet.
- Adhesive tags that convert an existing card or device into a credential.
Standardizing on one set of credentials and readers lets a single badge or phone work across every door.
Reader Connection Types
Access card readers differ not only by credential type but by how they connect to power and to the access control system.
- Standalone readers store credentials on the device itself and control a single door, best for one or two entrances with no central management.
- Wireless readers run on batteries and communicate wirelessly, useful where running cable is impractical, such as historic buildings or fast retrofits.
- Wired readers connect to a central door controller for real-time changes, instant lockdown, and a single audit trail across every door.
- IP and PoE readers connect over the network and draw power from the same cable, which simplifies wiring on larger, multi-door sites.
Wired and networked readers give you central control over every door at once, which is why most commercial and multi-site systems use them.
Access Card Readers for Government: NDAA, FIPS 201, and CAC
Government facilities need access card readers that meet federal security standards, which most off-the-shelf commercial readers do not automatically satisfy.
A common access card (CAC) reader authenticates the smart-card credential issued to Department of Defense personnel, which is built on the Federal Information Processing Standard (FIPS) 201 Personal Identity Verification (PIV) framework published by NIST. Federal buildings and many contractors require readers that can validate a PIV or CAC credential at the door.
Grant-funded and government projects also often require NDAA-compliant hardware, meaning the reader and connected equipment contain no federally banned components. Federal, education, and grant-funded projects typically call for NDAA-compliant, FIPS 201-capable readers.
How Much Does an Access Card Reader Cost?
A door access card reader typically costs $1,500 to $3,500 per door fully installed as of 2026, covering the reader, electronic lock, controller, wiring, and configuration. Cloud access control software then runs about $30 to $200 per door per month, depending on features and user count, as detailed in the access control cost breakdown.
The reader itself is a small part of that total. Most of the cost is the lock hardware, the controller, and the labor to wire and program each door. Higher-security credentials like encrypted smart cards or biometrics, plus outdoor or high-traffic entrances, push the per-door figure toward the top of the range.
How to Choose the Right Access Card Reader
Choosing an access card reader comes down to the security level each door needs, the environment it sits in, and the credentials your people already carry.
- Security level. Pair a card with a PIN or biometric for two-factor entry on sensitive doors. A single credential is fine for general interior doors.
- Environment. Outdoor, gated, and high-traffic entrances need weather-rated, vandal-resistant readers, sometimes with a longer read range.
- Existing credentials. Multi-technology readers read both legacy proximity cards and new encrypted smart cards, so you can migrate without reissuing every badge at once.
- Compliance. Government, healthcare, and finance doors may require FIPS 201, NDAA, or detailed audit-log capabilities.
- Management. Cloud systems let you add and revoke access from anywhere, while on-premise systems keep everything inside the building.
For a fuller walkthrough, the access control buyer’s guide maps these choices to system types.
Why Businesses Choose Safe and Sound Security for Access Control
Safe and Sound Security is a commercial security installer that designs, installs, and integrates access control systems, including card readers and credentials, for businesses and government agencies nationwide. We have installed card readers and credentials for more than 430 organizations, from single offices to multi-site rollouts. We are a Verkada Platinum Partner, provide NDAA-compliant options for government and grant-funded projects, and are approved on more than 15 government procurement vehicles.
We are brand-agnostic, so we specify the reader and credential technology that fits each door rather than pushing one manufacturer. We install and integrate readers from Brivo, HID, Avigilon, Openpath, Kisi, and Schlage, and we handle the locks, wiring, and software as a single contractor. For a site assessment and a no-obligation quote, contact our access control team.
Frequently Asked Questions
What is an access card reader?
An access card reader is a device at a door that scans a card, key fob, or mobile credential, checks it against an access control system, and unlocks the door for approved users while logging the entry.
What is a common access card reader?
A common access card (CAC) reader authenticates the smart-card credential carried by Department of Defense staff and contractors. It reads the card’s FIPS 201 PIV chip to verify identity before granting access to a facility or computer network.
What are the different types of access control card readers?
The main types are proximity/RFID readers, encrypted smart card readers, mobile and NFC readers, keypad readers, biometric readers, and legacy magnetic stripe readers. Many modern readers are multi-technology and read several credential types at once.
Are card readers still used?
Yes. Card and credential readers remain the standard for commercial access control. The technology is shifting from plastic proximity cards to encrypted smart cards and mobile credentials, but the reader at the door is still how most businesses and government facilities control entry.
How much does a card reader cost?
A commercial access card reader costs about $1,500 to $3,500 per door installed, plus $30 to $200 per door per month for cloud software. The reader itself is a fraction of that total; most of the cost is the lock, the controller, and installation labor.
Conclusion
An access card reader is the entry point of any modern access control system, and the right one depends on the door’s security needs, its environment, and the credentials your team already carries. Proximity and encrypted smart card readers cover most commercial doors, mobile credentials are steadily replacing plastic cards, and government facilities need FIPS 201 and NDAA-compliant hardware.
The practical rules are simple: match the credential’s security to the door, standardize on 13.56 MHz encrypted cards and OSDP-capable readers for new installs, and budget roughly $1,500 to $3,500 per door installed.
As a nationwide commercial security installer, Safe and Sound Security designs and installs access control and card reader systems, backed by more than 19 years of work and 20,000 locations protected. To plan the right readers for your building, talk to our access control installers.
Have a security project?
