KeySy: Copying and Replaying RFID Tags
Summary
The KeySy is an low-frequency RFID duplicator by Tiny Labs, which can be used to store, replay and duplicate 125kHz RFID Tags. It comes with the KeySy remote and an additional rewriteable keyfob, onto which stored data can be duplicated.
Hardware Used
- KeySy RFID Duplicator (includes CR2032 battery)
- programmed 125 kHz RFID Tag
- empty 125 kHz RFID Tag
Copying RFID Tags
Step 1
On the KeySy remote, press the button you wish to program until the light starts blinking red (approx. 8 seconds)
Step 2
Place the remote on the keycard to be copied until the light stops blinking. If the copying process was successful, the light will now be green otherwise it will turn amber and you should proceed to Step 3.
Step 3
If the light turned amber, the copying process failed. Turn over the tag and repeat Steps 1 & 2 while slowly moving the KeySy remote over the tag.
If the copying process keeps failing:
- Change the battery:
Copying a tag uses a lot more energy than just replaying one. This means, even if the LED lights up, the battery could be too weak to complete the copying process. - Check KeySy compatibility:
The Tag you want to copy is simply not readable by the remote. Refer to Section Hardware Limitations or Tiny Labs website under KeySy compatibility for further information.
Note: Any buttons that have already been programmed can be rewritten using the same steps. It is not necessary to explicitly delete information from the remote beforehand.
Replaying and Duplicating Tags
When you press one of the buttons on the KeySy remote, the LED will either flash red (there is nothing programmed on the button) or green (there is currently something programmed on this button).
Replaying
To replay a stored RFID tag from the remote, simply press and release the corresponding button in front of the RFID reader. Replay distance of the KeySy is about 5cm. The reader should blink or beep when the tags has been read successfully.
Duplicating Tags
The KeySy remote can also be used to program empty RFIDs tags with the information stored on one of the buttons.
Step 1
Position the remote on top of the empty RFID tag.
Step 2
Press the button you wish to copy 5 times, after which the LED will start blinking.
Step 3
When programming is finished the LED will blink 3 times green or red, if programming the keyfob failed. In this case please refer to Section Copying RFID Tags Step 3.
Hardware Limitations
The KeySy is specifically designed to operate only with RFID tags that function on the 125kHz low-frequency band. This means that NFC tags operating on 13.56MHz cannot be read or copied. While many perimeter access control systems rely on low-frequency RFID (e.g., gym cards, garage doors, and building key cards), modern building key cards provided by employers often use NFC due to its advanced functionality, such as authentication, which is incompatible with the KeySy. Additionally, high-frequency RFID, commonly used in smartphones, also falls outside KeySy’s capabilities.
A simple rule of thumb is: Any tag your phone can read, the KeySy cannot, and vice versa.
This limitation is intentional and was implemented to enhance security by preventing the duplication of sensitive data, such as credit or debit cards.
The compatibility list below reflects the current state as of 14.12.2024, but it may change over time. For the most up-to-date information, please refer to the official website. (Source: https://tinylabs.io/keysy/keysy-compatibility)
RFID Key Fobs and Cards Supported
- HID Prox (Proxcard, ISOProx, ProxKey)
- HID Indala (Motorola) (95% Success rate for Clamshell card and key fob versions. Thin card is not compatible)Kantech ioProx
- Rosslare Square fob (Triangle shaped fob not compatible)
- AWID (Low frequency only – CS-AWID, GR-AWID, KT-AWID, PW-AWID)(Emulation (playback) not supported, can still clone to rewritable oval key fob)
- Keri Key Fobs (95% Success rate KC-10X, MT-10X, PKT-10X)
- Radio Key (SecuraKey RKKT-01, RKKT-02)
- DKS DoorKing 1508
- Schlage IBF iButton (RFID portion only)
- PDK Prodatakey
- EM400x, EM410x, EM420x
- Nortek Linear Blue Key Fob
- Noralsy (KCP3000)
- Farpointe Pyramid
- Open Key Fobs (5 digits only- 8 digit incompatible)
- Viking
- Visa2000
- XceedID (labeled 7610 only)
- Schlage key fob (labeled 7610 only)
- Schlage Proximity key card (labeled 7410 – 7510 only)
- ACTprox Fob-B, Vanderbilt (Mifare version not compatible)
- Paradox C704, C705, PTDE16, PTAP14, PTAP17, PTFE19, PTOC16, PTJA19)
- CDVI BTAG, PPCB
- CDVI Black Metal1 (Not blue)
- T55x7 compatible keycard/keyfob
Unsupported Models
- Automotive Fobs & Windshield Tags/Transponders
- HID iCLASS, Seos IY
- DKProx Long Range
- XceedID key fob 9651
- Schlage key fob (9651, 9691T)
- Schlage key card (8420, 8520, 8920, 9451, 9551, 9951)
- Miwa Red Green Mifare
- Mifare Classic 1k/4k (all colors)
- Kantech ioSMART SSF Key Fobs and Key Cards
- Salto key fobs (PFM01K, PFM04K, PFD04K)
- Keri key cards
- Keri NXT fobs, serial #’s starting with *N, K-SF-1k MAX fobs
- Mass transit cards
- Stored value cards
- Mifare Plus EV1
- Mifare DESFire EV1/2
- Mifare Ultralight
- Farpointe Delta, Farpointe Ranger
- DKProx Long Range (AVI)
- AWID (all HF and UHF tags)
- Any other RFID cards/fobs not operating at 125kHz