Ambimat GroupAmbimatAmbiSecureSIMAuthAmbiAutomationEngineering BlogAhmedabad · India · Est. 1982
NFC utility

UID analyzer for NFC tags

Inspect a 4 / 7 / 10-byte ISO/IEC 14443 Type A UID. Identifies cascade level, manufacturer ID, and whether the UID is fixed (unique) or random (RID).

Client-sideISO 14443-3 Type A

How to use this tool

What it does

Analyses a contactless card UID — length, randomness indication and manufacturer bytes.

When to use it

Use it to tell a fixed UID from a random one, or to read the manufacturer prefix.

Worked example

Paste a 7-byte UID to see its manufacturer byte and whether it is randomised.

Input

Decoded

Paste hex to decode.
All decoding runs locally.

About UIDs

An ISO/IEC 14443 Type A UID is a 4-, 7-, or 10-byte identifier emitted during anti-collision. Modern cards use 7 bytes with the first byte as the manufacturer ID. The 4-byte form is legacy MIFARE Classic; cards using a leading 0x08 on a 4-byte UID are emitting a random ID (RID, also called nUID), re-randomised per power cycle. UIDs are not secrets — they are visible to any reader within RF range; security architectures must never rely on UID confidentiality.

Spec

ISO/IEC 14443-3 Type A.

Companion tool

ATS parser

Frequently asked questions

What is a cascade level?

How many anti-collision rounds are needed for the UID length: single for 4 bytes, double for 7, triple for 10. Each level after the first is prefixed by the 0x88 cascade tag.

How do I tell a random UID from a fixed one?

A 4-byte UID beginning 0x08 is a random ID generated per activation. Any application keying off the UID will break against such cards, which is precisely why random UIDs exist.

Can a UID be used as a security credential?

No. UIDs are readable by any reader and cloneable onto programmable cards. They are an addressing mechanism, and the authentication has to come from card keys.

What does the first byte tell me?

On a fixed 7-byte UID it is the NXP-assigned manufacturer code. It identifies the chip vendor, not the card issuer or the application.

Does anything I paste leave my browser?

Nothing. The tool is entirely client-side: the page ships a static script, does no network calls, and never transmits what you paste. You can confirm it by opening the network tab, or by loading the page and then going offline.