The MIFARE Ultralight is NXP Semiconductors' historic NFC chip for limited-use ticketing: public transport tickets, event tickets, day passes. The first generation of the family of the same name (reference MF0ICU1), it offers 48 bytes of user memory and served as the basis for the NFC Forum Type 2 format. It can be read and written by virtually all NFC-enabled smartphones.
Information
| Manufacturer | NXP Semiconductors |
| Family | MIFARE Ultralight (first generation) |
| Reference | MF0ICU1 |
| Standard | ISO/IEC 14443 Type A (parts 2 and 3) |
| NFC Forum type | Type 2 Tag compatible |
| Operating frequency | 13.56 MHz |
| Data rate | 106 kbit/s |
| Unique identifier (UID) | 7 bytes, factory programmed |
| Operating distance | Up to approximately 10 cm, depending on the antenna and reader |
| Data retention | 5 years |
| Write endurance | 10,000 cycles |
| Total memory (EEPROM) | 64 bytes |
| User memory | 48 bytes |
Memory
The EEPROM memory of the MIFARE Ultralight is organized into 16 pages of 4 bytes (pages 0 to 15):
| Pages | Content | Access |
|---|---|---|
| 0 to 2 | UID, internal data and static lock bytes | Read-only (UID) / OTP |
| 3 | OTP area (One Time Programmable, 32 bits) | OTP |
| 4 to 15 | User memory (48 bytes) | Read / write |
In practice, the 48 bytes of user memory can hold an NDEF record containing a URL of around 40 characters, as the common prefix (https://www. for example) is compressed into a single byte by the NDEF format: encoding a short redirect link is essential. During NDEF formatting, the Capability Container is written into the OTP page. The chip has no configuration pages at all: there is neither a password nor dedicated counters.
Features & security
- Permanent locking: the static lock bytes can switch each page to read-only irreversibly, with an anti-tearing mechanism protecting the writing of the lock bits. The operation can be performed directly from NFC Tools.
- OTP area: 32 one-time programmable bits, which can be set but never erased, usable as a 32-tick counter to mark the uses of a ticket, with anti-tearing on writes.
- Fast transaction: a complete ticketing transaction is performed in less than 35 ms, a key criterion for transport gates.
The original MIFARE Ultralight offers neither password protection, nor 24-bit counters, nor originality signature, and its endurance (10,000 cycles, 5-year retention) lags behind: these limits were lifted by the MIFARE Ultralight EV1, which succeeds it with full backward compatibility. The MIFARE Ultralight C variant adds 3DES authentication.
Compatibility
The MIFARE Ultralight is compatible with virtually all NFC smartphones. On Android, reading and writing work natively with NFC Tools, without any particular restriction. On iPhone, automatic background reading is available from the iPhone XS and XR onwards; models from the iPhone 7 can read and write the chip via NFC Tools on iOS 15.6 or later, by starting the scan manually from the app.
With NFC Tools, the MIFARE Ultralight chip supports reading technical information, writing records, erasing and permanent locking. The list of compatible models is available in the article on compatibility.
MIFARE Ultralight vs Ultralight C vs Ultralight EV1
| Chip | User memory | Security | Typical use |
|---|---|---|---|
| MIFARE Ultralight (MF0ICU1) | 48 bytes | Locking and OTP area | Limited-use ticketing, first generation |
| MIFARE Ultralight C | 144 bytes | 3DES authentication | Ticketing and access control |
| MIFARE Ultralight EV1 | 48 or 128 bytes | Password, counters, signature | The current version of the range |
All three chips share the same ISO/IEC 14443 Type A foundation and the same smartphone compatibility. The original version is still found in existing systems, but the EV1 has replaced it for new deployments; for a general-purpose NFC tag, the NTAG213 remains the reference choice.
Frequently asked questions
How much data can be stored on a MIFARE Ultralight?
The chip has 48 bytes of user memory, which corresponds to a URL of around 40 characters once the NDEF envelope is taken into account. Encoding a short redirect link is strongly recommended.
What is the difference between the MIFARE Ultralight and the EV1 version?
The EV1 succeeds it with full backward compatibility and fills its gaps: 32-bit password protection, three 24-bit counters, originality signature, endurance raised to 100,000 cycles and a 128-byte version.
Is the MIFARE Ultralight compatible with iPhones?
Yes. Background reading works from the iPhone XS and XR onwards, and both reading and writing are possible via NFC Tools from the iPhone 7 on iOS 15.6 or later.
Can a MIFARE Ultralight be protected against rewriting?
A permanent, irreversible read-only lock is possible page by page, including from NFC Tools, and the OTP area offers one-time marking. However, the chip does not offer password protection: that feature was introduced with the EV1 version.
Useful links
