HF / NFC 
MIFARE Ultralight EV1
For simple ticketing and event applications where 32-bit password protection instead of 3DES is sufficient.
Security PWD 32-bit
Memory 48 / 128 B
MIFARE Ultralight C: Technical Data, Security and Use
The MIFARE Ultralight C from NXP is a contactless HF RFID and NFC chip for 13.56 MHz. It operates according to ISO/IEC 14443 Type A and has 192 bytes of EEPROM, of which 144 bytes are available as freely writable user memory. Compared to simpler chips of the MIFARE Ultralight family, the C variant adds mutual authentication based on 3DES with a 112-bit key.
NXP developed the chip primarily for applications with a limited period of use, including public transport tickets, event tickets and loyalty applications. MIFARE Ultralight C is still available, but NXP no longer recommends it for new designs. The manufacturer names MIFARE Ultralight AES as its successor.
| Feature | Value |
|---|---|
| Manufacturer | NXP Semiconductors |
| Product family | MIFARE Ultralight |
| Type designation | MF0ICU2 |
| RFID class | HF / NFC |
| Frequency | 13.56 MHz |
| Standard | ISO/IEC 14443 Type A |
| NFC standard | NFC Forum Type 2 Tag |
| Data rate | 106 kbit/s |
| Total EEPROM | 192 bytes / 1,536 bits |
| Usable memory | 144 bytes |
| Memory structure | 48 pages of 4 bytes each, 36 of which are user memory pages |
| OTP area | 32 bits |
| Counters | 16-bit one-way counter |
| Authentication | Mutual three-pass authentication |
| Encryption | 2-key 3DES with 112 bits |
| Access protection | Read and/or write protection from a configurable memory page |
| UID | 7 bytes |
| Anti-collision | Yes |
| Read range | Up to 100 mm according to NXP, depending on antenna and reader |
| Write cycles | At least 100,000 at 22 °C |
| Data retention | At least 10 years at 22 °C |
| Smartphone NFC | Yes; NFC Forum Type 2 Tag |
| Product status at NXP | Active – not recommended for new designs |
| Typical media | RFID cards, tickets, NFC tags and event media |
| Security rating | 3DES / Legacy |
| Recommendation | Existing ticketing and loyalty systems with 3DES; consider Ultralight AES for new designs |
NXP specifies 13.56 MHz, 106 kbit/s and an operating distance of up to 100 mm. The memory comprises a total of 192 bytes of EEPROM. 144 bytes of this are available as user memory on 36 pages of four bytes each. In addition, there are the UID, lock bytes, OTP area, counter, authentication configuration and the 3DES key, among others.
Typical Applications
MIFARE Ultralight C was developed for cost-sensitive applications that require more protection than a simple NFC tag with a password or without cryptographic authentication.
Typical applications are:
- single and multi-ride tickets in public transport
- admission tickets for events, stadiums and leisure facilities
- customer and loyalty cards
- time-limited access and visitor media
- NFC applications with small amounts of data
Today, the chip makes particular sense in existing systems whose readers, encoding and backend are already tailored to the 3DES authentication of MIFARE Ultralight C.
Suitable media: RFID cards, contactless tickets and NFC tags.
Security
Security level: Medium / Legacy
MIFARE Ultralight C uses mutual three-pass authentication with a 112-bit 2-key 3DES key. The configuration bytes AUTH0 and AUTH1 can be used to define the memory page from which successful authentication is required. Either only writing or both reading and writing can be protected.
Important for classification: with MIFARE Ultralight C, 3DES protects the authentication. The normal memory commands READ and WRITE are subsequently not transmitted in encrypted form. The chip therefore does not offer an encrypted secure messaging channel like newer products with AES and CMAC.
For existing ticketing or loyalty systems, this security level may still be sufficient or technically necessary. For new applications, NXP recommends MIFARE Ultralight AES. It uses AES-128, offers CMAC for communication integrity and has Common Criteria certification to EAL3+.
Advantages and Disadvantages of MIFARE Ultralight C
| Advantages | Disadvantages |
|---|---|
| Mutual 3DES authentication | No longer recommended by NXP for new designs |
| 144 bytes of freely usable user memory | 3DES is now considered legacy cryptography |
| NFC Forum Type 2 Tag and smartphone NFC | No encrypted transmission of the normal READ/WRITE commands |
| Configurable read and write protection | No Common Criteria security certification |
| 16-bit counter and 32-bit OTP area | Only little memory for complex applications |
Alternatives to MIFARE Ultralight C
For new projects, it should first be clarified whether existing 3DES compatibility is actually required. For new systems, more suitable chips with AES, more memory or a stronger focus on smartphone NFC are available.
HF / NFC Recommendation 
NTAG 213 / 215 / 216
For applications focused on use with smartphones and storing NDEF content.
Security PWD
Memory 144–888 B
HF / NFC Recommendation 
MIFARE DESFire EV3
For access control, ID card, ticketing and multi-application systems with more memory and higher security requirements.
Security AES-128
Memory 2 / 4 / 8 / 16 KB
Frequently Asked Questions about MIFARE Ultralight C
How much memory does MIFARE Ultralight C have?
MIFARE Ultralight C has a total of 192 bytes or 1,536 bits of EEPROM. Of this, 144 bytes are provided as freely writable user memory. This area comprises 36 pages of four bytes each. The remaining memory areas contain the 7-byte UID, lock bytes, a 32-bit OTP area, the 16-bit counter, the authentication configuration and the 3DES key, among others. This is why, depending on the data sheet or retailer, both “192 bytes of memory” and “144 bytes of memory” are stated. 192 bytes refers to the entire EEPROM, 144 bytes to the actual user memory.
How secure is MIFARE Ultralight C?
MIFARE Ultralight C uses mutual three-pass authentication with 112-bit 2-key 3DES. This gives the chip significantly stronger access protection than variants with a simple password. However, 3DES only protects the authentication process. The normal read and write commands are transmitted unencrypted over the air interface. NXP therefore no longer recommends the chip for new designs and names MIFARE Ultralight AES as its successor.
Is the data on MIFARE Ultralight C encrypted with 3DES?
No. 3DES is used for mutual authentication between reader and chip. After successful authentication, protected memory areas can be read or written. The READ and WRITE commands themselves, however, are transmitted in plain text. Anyone who also needs integrity or cryptographic protection of the transmitted data in a new application should consider a current chip with secure messaging functions. MIFARE Ultralight AES, for example, adds AES-128 and CMAC.
Can MIFARE Ultralight C be read with a smartphone?
Yes. MIFARE Ultralight C complies with the NFC Forum Type 2 Tag and is therefore generally suitable for NFC applications with smartphones. NXP names URLs and other typical NFC content, among other things, as possible applications. For applications with 3DES authentication, however, the normal automatic reading of an NFC tag is not sufficient. The app must support the required commands and key management.
What is the difference between MIFARE Ultralight C and MIFARE Ultralight EV1?
The biggest difference lies in access protection. MIFARE Ultralight C uses 112-bit 3DES authentication and has 144 bytes of user memory. MIFARE Ultralight EV1, by contrast, uses 32-bit password protection and is available with 48 or 128 bytes of user memory. In terms of security, Ultralight C is therefore above Ultralight EV1. For new applications with cryptographic protection, MIFARE Ultralight AES is now the current variant within the product family.
What is the difference between MIFARE Ultralight C and MIFARE Ultralight AES?
Both chips have 144 bytes of user memory and operate at 13.56 MHz and ISO/IEC 14443 Type A. The key difference is the security architecture. MIFARE Ultralight C uses 112-bit 3DES for authentication. MIFARE Ultralight AES uses AES-128, supports CMAC for checking the integrity of communication, has additional security functions and is certified to Common Criteria EAL3+. NXP explicitly describes Ultralight AES as the replacement for Ultralight C in new designs.
Which readers support MIFARE Ultralight C?
The reader must operate at 13.56 MHz and ISO/IEC 14443 Type A. For simple read and write operations, support for the MIFARE Ultralight command set is sufficient. If protected memory areas are to be accessed, the reader or its software must also handle the special 3DES authentication of MIFARE Ultralight C. A reader with ISO/IEC 14443 A support therefore does not automatically guarantee full support for all Ultralight C functions.
Is MIFARE Ultralight C still being produced?
NXP currently lists MIFARE Ultralight C with the product status “Active”. At the same time, the chip is labeled “not recommended for new designs”. For new projects, NXP recommends MIFARE Ultralight AES as a replacement. Ultralight C can therefore still make sense for existing systems if the readers, key management and backend are already tailored to this chip. For a completely new system, it is no longer part of the standard selection.
Technical sources
Data as of: September 2026
The technical information is based on the NXP data sheet MF0ICU2, MIFARE Ultralight C – Contactless Ticket IC, Rev. 3.5 dated 30 January 2026, the current NXP product page and the NXP Application Note AN12265, MIFARE Ultralight C security design and its impact on chip performance, Rev. 1.2 dated 5 May 2021.
The information on smartphone support is based on the Android NDEF documentation and Apple's Core NFC documentation.
Trademark notice
MIFARE and MIFARE Ultralight are trademarks of NXP B.V.
The spelling on this page follows the MIFARE Trademark and Branding Guidelines, Rev. 5.2 dated 10 March 2025.