Magnetic Stripe
A magnetic stripe is a band of magnetizable material on a card that stores data in up to three parallel tracks. It is read by physical contact — a swipe past a head that senses flux reversals. The data is static: identical on every read, forever, until someone re-encodes it.
| Standard | ISO/IEC 7811, in six parts |
| Tracks | Up to three, running the length of the stripe |
| Track 1 | Alphanumeric, 210 bits per inch, ~79 characters — originated with IATA |
| Track 2 | Numeric, 75 bits per inch, ~40 characters — originated with the ABA |
| Track 3 | Numeric, 210 bits per inch — originated with the thrift industry |
| LoCo | ~300 Oersted, usually brown, easily re-encoded |
| HiCo | ~2750 Oersted, usually black, more durable |
| Data behavior | Static — every read returns the same bytes |
Tracks and coercivity
The three tracks come from three industries solving the same problem independently, which is why their capacities differ so oddly. Track 1 was specified by the airlines and supports full alphanumeric encoding, so it can carry a cardholder name. Track 2 came from banking, is numeric only, and is the track most payment terminals actually read. Track 3 came from the thrift and savings sector and is rarely used today.
Coercivity describes how strong a magnetic field is needed to write the stripe. Low-coercivity stripes are cheap and easy to encode, which suits hotel keys and event passes where cards are disposable. High-coercivity stripes resist accidental erasure from magnets and daily handling, which is why bank cards and access credentials use them. The color difference — brown for LoCo, black for HiCo — is a genuine visual tell.
Why the magnetic stripe matters for identity verification
Mostly as the cautionary example the entire field is built around.
Everything a magnetic stripe stores is static. Read it once and you have everything needed to reproduce it, permanently. There is no computation on the card, no key, no challenge, nothing that varies between reads. That single property made skimming a viable industry: a cheap reader hidden over a slot captures the tracks, and a blank card encoded with them is functionally the original.
The response was to move from storage to computation. An EMV chip generates a unique cryptogram per transaction, so a captured transaction cannot be replayed. A smart card holds a private key that never leaves the silicon. A passport chip refuses to speak until the reader proves possession of the document. All of it is a direct answer to what the stripe could not do, and the same logic drives identity document verification today: static data is evidence of nothing on its own.
Magnetic stripe vs chip
| Magnetic stripe | Chip | |
|---|---|---|
| Data | Static, identical every read | Computed per interaction |
| Cloning | Cheap and reliable | Impractical |
| Keys | None | Private key never leaves the chip |
| Physical wear | Degrades with swipes | Contactless has none |
| Cost | Very low | Higher |
| Still used for | Hotel keys, transit, fallback | Payment, identity, access |
Why it hasn’t disappeared
Fallback compatibility. Many payment cards still carry a stripe so they work where chip terminals do not exist. Forced-fallback attacks deliberately exploit this, degrading a chip transaction to a stripe read to bypass the cryptography.
Cost. For a hotel key or a two-day festival pass, a re-encodable LoCo stripe is dramatically cheaper than a chip and the threat model does not justify more.
Installed infrastructure. Readers, encoders, and card stock exist in enormous quantity, and replacement follows depreciation schedules rather than security reasoning.
It is genuinely simple. No power negotiation, no protocol, no failure modes beyond wear. That reliability is why it lasted fifty years and why it will outlive several predictions of its death.
Frequently asked questions
How many tracks does a magnetic stripe have?
Up to three. Track 1 is alphanumeric and can hold a name; Track 2 is numeric and is what most payment terminals read; Track 3 is numeric and largely unused today. Not every card encodes all three.
What is the difference between HiCo and LoCo?
Coercivity — the field strength needed to write the stripe. LoCo runs around 300 Oersted, is usually brown, and is easily re-encoded, which suits hotel keys and temporary passes. HiCo runs around 2750 Oersted, is usually black, and resists accidental erasure, which suits bank and access cards.
Can a magnetic stripe be cloned?
Trivially. The data is static and unencrypted, so a reader captures it in one swipe and an encoder writes it to a blank card. This is the fundamental weakness that chip technology was created to address.
Do magnets erase cards?
They can, particularly LoCo stripes. HiCo stripes require a much stronger field, so everyday exposure to phone magnets and bag clasps is rarely enough to damage them.
