RFID implementation for hotels

This page is for you if you run a boutique or full-service hotel and are considering replacing magnetic stripe cards or an older RFID key card system with a modern solution — or if you already have RFID locks but want to add mobile keys, connect the lock system to your PMS, or understand what upgrading your hotel locks actually involves before you sign a contract with a supplier.

How it works

1. Current-state analysis — a review of the existing lock system, door types, any cabling, the PMS and integration options, as well as your requirements for mobile keys, security level and budget.
2. Choice of technology — choice of card technology, locks (offline/online, battery-powered or wired) and whether mobile keys via BLE should be included from the start.
3. Procurement and contracts — quotes are obtained and reviewed (see "Common pitfalls" for what is worth watching out for).
4. Installation, door by door — rooms are taken out of service as they are changed over, normally outside periods of high occupancy.
5. PMS integration — the link between check-in and card encoding/mobile key issuing is set up and tested. Read more under technology integration.
6. Staff training — reception and night staff go through card encoding, troubleshooting and fallback routines.
7. Commissioning with a backup period — the old system or mechanical master keys are kept available as a fallback during a transition period.

Card technology and mobile keys

Mifare Classic vs. DESFire EV3. Mifare Classic is the older card technology still found in many hotel installations. Its encryption (Crypto-1) has long been known to be breakable with publicly available equipment, which makes it unsuitable where you want modern protection against card cloning. Mifare DESFire EV3 uses AES-based encryption and is the level I recommend for new installations or hotel lock upgrades — especially if the same card also handles payment functions or staff access.

Migrating from magnetic stripe or older RFID. Lock cylinders and card readers are replaced door by door, the encoding station at reception is replaced or updated, and for a period you need to be able to handle both old and new keys for guests who have already checked in.

Mobile keys via BLE. Requires locks with a built-in Bluetooth Low Energy radio (new locks, or a retrofitted BLE module if the supplier supports it), an app/web solution that delivers the key, and a PMS integration that issues the key automatically at check-in. Expect higher demands on Wi-Fi/mobile coverage around the hotel, and a clear fallback process (physical card) for guests who cannot or do not want to use a mobile key.

Offline versus online locks. Most hotel room locks are offline — the lock decides on access locally based on what is encoded on the card, without a constant connection. They are cheaper to install (no cabling), but blocking a lost card normally does not take effect until the next valid card is read by that particular lock — the exact blocking logic varies between suppliers and should be verified before choosing a system. Online locks communicate in real time and are more often used in high-security areas or staff areas — at the cost of cabling and a higher installation cost.

Battery life and service intervals. Battery-powered locks normally signal low battery well before they stop working. Exact battery life varies between manufacturers and with the number of openings per day — require the supplier to specify this in the quote. Battery replacement should be a recurring item in ongoing operations, not a one-off task.

PMS integration. Often the part of the project that takes longest to get right, as it involves two suppliers' systems at the same time. Require the entire chain — check-in, card encoding, check-out, blocking — to be tested end to end before going fully live.

Common pitfalls

• Choosing card technology on price rather than security level. Mifare Classic is cheaper but the wrong choice if you handle sensitive guest data through the same card infrastructure.
• Underestimating installation time per room type. Fire-rated doors or unusual frame dimensions often take longer — ask the supplier to survey every door type, not a sample.
• Having no fallback routine for the night. If the encoding station or the PMS integration is down at 2 a.m., the night staff need a clear plan: a mechanical emergency key, manual card encoding or an escalation path to support.
• Signing a contract without owning your own data. Some suppliers bundle card encoding, app and PMS integration so tightly that switching supplier later becomes unreasonably expensive.
• Forgetting staff areas and delivery entrances. The focus easily ends up on guest rooms only — otherwise staff doors and storerooms are left behind on the old system as a security gap.
• Launching mobile keys without testing them in practice first. Coverage and Bluetooth pairing behave differently across phone models — test on several devices before launch.

What it costs

The cost of an RFID implementation is driven primarily by three things: the number of doors, whether cabling is required for any part of the system, and whether mobile keys are to be included from the start. We go through your particular property in the current-state analysis and produce a realistic cost estimate based on that, rather than a standard price that would not fit your property anyway.

Frequently Asked Questions

Do we have to replace all the locks at once?

No — most installations are done door by door, often floor by floor, so the hotel can stay in operation.

Can we keep our current PMS?

In most cases, yes — the question is whether your PMS supplier already has a ready-made integration interface to the lock system you choose, or whether one needs to be built specifically. This is investigated in the current-state analysis.

What happens if a guest loses their card?

A new card is encoded at reception and the old one is blocked. With offline locks, the block takes effect the first time a valid card is used in the lock in question — the exact blocking logic varies between suppliers' systems.

Are mobile keys something guests actually want?

Demand varies with the guest profile — higher among younger guests and business travellers, lower in groups that prefer a physical card. A good solution always keeps the physical card as the first-choice option.

How secure is RFID compared with mechanical locks?

Implemented correctly (DESFire EV3 level), it is harder to copy than a mechanical key, which can be copied from an impression. The weakness rarely lies in the technology, but in the implementation.

Can you help us choose a supplier, or only implement?

Both — with no ties to a single supplier, the review of quotes is not driven by commission.

How long does a project take for, say, 40 rooms?

It depends entirely on the door types, any cabling needs and the supplier's delivery time for the hardware. It is one of the first things we work out together in the current-state analysis.