Your hotel keycard is a tiny computer

and it works without a battery!

For something as trivial as a hotel key card, I thought it just keeps an encrypted code, that you should be able to copy. I was wrong. Each time I tried to scan it, it gave out a different text. I was baffled. I went down the rabbit hole so you don’t have to.

The reality is that these keycards are tiny computers on their own.

What I actually saw (and why it confused me)

When you tap a hotel keycard with an NFC app, the app often shows some hex strings or a seemingly random text. Tap it again — different hex. If the card were “just storing” ROOM=504 or pass=randomstring1234, those bytes would be constant. So why the changing output?

Because the card is not handing you a static blob of data to copy. It’s participating in a live authentication protocol with the reader. The reader asks a question; the card computes an answer. That answer depends on a new random challenge every time. That’s why the bytes look different on every tap.

Understanding the flow

Let’s take the following analogy to understand this better.

Suppose you are going into a math puzzle contest. The doorman asks a different riddle to every person. If you know the secret method to solve this riddle, only then you can arrive at the right answer.

In this example,

• Doorman = Key Reader
• You = Key card
• Secret method = Secret code

There’s also a very important part of the puzzle called nonce. Nonce is a random and unique number, associated with your puzzle. The task of this Nonce is to increase the randomness or the entropy of the system. It also obscures the answer from the riddle. This way, it becomes impossible to crack the secrey key, as the nonce changes the answer.

An easy-to-understand example

I invite you to a Trivia night. I tell you the secret code is “*+-**”

You go to the gate, and the doorman gives you the following information.

• Riddle — 5, 15, 3, 8
• Nonce — 7

I told you to use the secret key to perform operations on the riddle, and then take the modulus using nonce.

So you do the calculations → 5+15*3–8 = 32 and 32%7=4

From the riddle and nonce, even if I give you 100 examples, it will be impossible to crack the code from input/output.

Why? Because the nonce makes the output unpredictable: the same secret and riddle applied to different nonces produces different outputs. Recording answers doesn’t help unless you also know the secret method. That’s the challenge–response pattern in action.

Now translate that back to hotel cards:

• The reader (doorman) always sends a fresh nonce.
• The card (you) computes a response using its secret key (the secret method).
• The reader checks the response against what it expects.
• If it matches, access is granted.

Real systems use much more complex math but the essence is same.

One could say it’s a little (nonce)nce. xD

But if the card is doing computations, it needs a power source. But I have never seen them run out of charge.

The Power equation

If the card is doing cryptographic math, where does its power come from? You’re right to wonder — these cards don’t have visible batteries, and yet they seem to work forever. The trick is energy harvesting: the card draws a tiny amount of power from the reader’s radio field when you tap it.

Here’s the short version:

• The reader emits an alternating electromagnetic field (RF) when it’s polling for cards.
• The card has an antenna coil that picks up that field and converts it into a small electrical current.
• That current powers the card’s microcontroller and secure element long enough to receive the nonce, compute the response, and send the result back using load modulation (the card slightly changes how it loads the field; the reader senses those changes).

So the card is batteryless because it only needs power in the short window when the reader is actively interrogating it. When there’s no reader nearby, the card is idle and consumes essentially nothing.

How much power are we talking about?

Nothing like a phone battery — think micro- to milliwatts of available energy. That’s enough to run extremely low-power electronics and perform a handful of cryptographic primitives (AES, CMAC, 3DES) if the chip is designed for it. Modern secure microcontrollers and secure elements used in access cards are optimized for this constrained environment: small instruction sets, low clock rates, hardware crypto accelerators, and sleep states.

Because the crypto is hardware-accelerated and the handshake is short, the card can complete the challenge–response in a few milliseconds while powered from the reader’s field. That’s why you never see the card “run out” of power — it’s powered on-demand by the reader.

This whole process is also why sometimes it takes a bit of time to get a response from reader.

Reach out to me at samarthrawat1@gmail.com for suggestions/improvements.