ISO/IEC 14443
ISO/IEC 14443 is the four-part international standard for contactless proximity cards operating at 13.56 MHz. It is the radio layer sitting underneath ePassport chips, tap-to-pay cards, and most transit systems — the agreement that lets a reader built by one company talk to a card made by another.
| Full title | Identification cards — Contactless integrated circuit cards — Proximity cards |
| Frequency | 13.56 MHz |
| Operating range | Proximity — roughly 10 cm by specification, ~4 cm in practice |
| Card side | PICC (proximity integrated circuit card) |
| Reader side | PCD (proximity coupling device) |
| Signaling variants | Type A and Type B |
| Used by | ICAO Doc 9303 for eMRTD chips; EMV for contactless payment |
The four parts
| Part | Covers |
|---|---|
| Part 1 | Physical characteristics of the card |
| Part 2 | Radio frequency power and signal interface |
| Part 3 | Initialization and anticollision |
| Part 4 | Transmission protocol |
Part 3 is the one that solves a problem people notice. Anticollision is the negotiation that lets a reader isolate a single card when several are inside the field — the reason a wallet holding three contactless cards produces a polite failure rather than an arbitrary charge.
Type A and Type B
The standard supports two signaling schemes. Both run at 13.56 MHz and both reach Part 4 with the same transmission protocol, but they differ in modulation, coding, and initialization.
| Type A | Type B | |
|---|---|---|
| Modulation | 100% ASK | 10% ASK |
| Coding | Modified Miller | NRZ |
| Field during transmission | Interrupted | Continuous |
| Prevalence | More widely deployed | Common in national ID programs |
A compliant reader supports both, which is why the distinction rarely surfaces in practice and matters mainly when debugging why one particular document will not read.
Why ISO/IEC 14443 matters for identity verification
Almost every claim about chip security in identity documents implicitly depends on this standard, because it sets the physical constraint everything else rests on.
Proximity range is not a limitation to be engineered around. It is a deliberate security property. A credential that could be read at several meters — as UHF RFID tags can be — would be interrogable without the holder’s knowledge or consent. Requiring deliberate presentation is doing real work.
What the standard does not do is say anything about trust. It defines how bytes move between a card and a reader. Whether those bytes are authentic comes from layers above it: ICAO Doc 9303 for travel documents, EMV for payment. A identity document verification stack cares about both, and conflating them is a common source of overstated security claims.
What ISO/IEC 14443 doesn’t cover
It defines no security model. Encryption, authentication, and access control all live in the application layer above. A card can be fully compliant and completely insecure.
It does not specify what data is stored. Data groups, file structures, and signature formats come from ICAO Doc 9303 or EMV, not from this standard.
It is not the only contactless standard. ISO/IEC 15693 covers vicinity cards at greater range and lower data rates, and it is not used for identity documents.
Compliance is not interoperability in practice. Real-world variation in antenna design and field strength means some card and reader combinations perform poorly despite both being compliant.
Frequently asked questions
Is ISO 14443 the same as NFC?
They overlap but are not the same. NFC is defined primarily by ISO/IEC 18092 and includes peer-to-peer and card emulation modes, but NFC readers also implement ISO/IEC 14443 so they can read contactless cards. That compatibility is why a phone can read an ePassport chip.
What is the difference between Type A and Type B?
Modulation and coding. Type A uses 100% ASK with modified Miller coding and interrupts the field during transmission; Type B uses 10% ASK with NRZ coding and a continuous field. Both converge on the same transmission protocol in Part 4, and compliant readers handle both.
What is the actual read range?
The specification describes proximity operation at roughly 10 cm. Real deployments typically achieve around 4 cm, because antenna size, card construction, and reader power all reduce the practical figure.
Does ISO/IEC 14443 encrypt anything?
No. It carries bytes between card and reader. Any encryption, authentication, or access control is defined by the application standard layered on top, such as ICAO Doc 9303 or EMV.
