Card, phone, PIN or biometrics: which credential to choose for access control
Quick answer
For most businesses the best balance of security, cost and convenience is an encrypted card (such as MIFARE DESFire) or a mobile credential. A PIN is only worth using as a second factor, QR codes suit visitors, and biometrics should be used in Spain only where it can be justified under data protection rules.
Quick comparison
| Credential | Security | Cost per user | Convenience | Where it fits |
|---|---|---|---|---|
| 125 kHz card (legacy proximity) | Low: cloned with cheap kit | Very low | High | Only to keep existing installations running |
| Encrypted card (MIFARE DESFire) | High | Low | High | The general recommendation |
| Phone (NFC or Bluetooth) | High | Per-user licence, varies by vendor | Very high | Staff with phones, remote issue and revocation |
| PIN code | Low: shared and shoulder-surfed | None | Medium | Second factor or low-risk doors |
| Temporary QR code | Medium | None | High for visitors | Visitors and one-off access |
| Biometrics (fingerprint, face) | High | None per user; dearer terminal | Very high | Only with justification and a DPIA |
Cards are not all the same
Two identical-looking white cards can be very different inside.
- 125 kHz cards always transmit the same unencrypted number. Copying them is trivial.
- MIFARE Classic uses encryption that has been publicly broken for years.
- MIFARE DESFire (EV2, EV3) uses AES encryption and is today's benchmark.
If you inherit a system with old cards, many current readers read both technologies and let you migrate gradually.
The phone as a key
The credential lives in an app or the phone wallet. Benefits: it is issued and revoked remotely, nobody lends their phone, and there are no cards to replace. Bear in mind: it usually carries a per-user licence, depends on the phone having battery, and not all staff will want a company app on a personal phone, so offer a card as an alternative.
PIN and QR
A PIN does not identify a person; it identifies whoever knows the number. It works as a second factor (card + PIN) on sensitive doors. A temporary QR code is handy for visitors: it is emailed and expires by itself, but it can be forwarded or photographed, so it is not for critical doors.
Biometrics: convenient but heavily restricted in Spain
Technically it is excellent: it cannot be lent or lost. Legally, the Spanish data protection authority treats it as special category data and high-risk processing, and requires proof that no less intrusive alternative exists (AEPD guide). If a card solves the problem, biometrics fails that test. See biometrics in access control.
How to decide
- How many people, and how much turnover? High turnover favours phones or QR codes.
- What happens if someone gets in with another person's credential? If serious, add a second factor.
- Are cards already in use (canteen, printers, clocking)? Reusing them keeps things simple.
- Any outdoor doors? Check the reader's ingress protection rating.
Want us to assess this for your site? See our access control service.
Frequently asked questions
Can the same card open doors and record working time?
Yes, that is common and convenient. They are two different purposes for data protection, so staff must be informed of both.
What if an employee loses their card?
It is cancelled in the software and stops working immediately. That is the big difference from a key.
Sources
This guide is for information only and is not a substitute for legal advice or for the technical design of each installation. Regulations change: always check the current text at the official source.