pm3py Simulated Transponders — Reference & Comparison
Every transponder model that pm3py can simulate, organized by RF frequency and
protocol, with feature-comparison tables. Import any model from pm3py.sim:
Memory figures are user memory (excludes UID/lock/config/OTP pages) per the
manufacturer datasheet. "Faithful" models reproduce the documented command set,
UID prefix, and access rules; a ✓ in a feature column means the model implements
that behaviour (not merely that the silicon has it).
Legend: T2/T4/T5 = NFC Forum Tag type · A/B/V = ISO 14443-A / 14443-B /
15693 (NFC-V) · DI = dual interface (RF + wired I²C/SPI) · EH = energy
harvesting · — = not applicable / not present.
1. Master list — by frequency and protocol
| Model(s) |
Vendor |
Freq |
Protocol |
NFC type |
Module |
| MIFARE Ultralight / C / EV1 (MF0UL11/21) |
NXP |
13.56 MHz |
ISO 14443-A |
T2 |
iso14443a/nxp/ultralight |
| NTAG210/212/213/215/216 |
NXP |
13.56 MHz |
ISO 14443-A |
T2 |
iso14443a/nxp/ntag21x |
| NTAG I²C plus (NT3H2111/2211) |
NXP |
13.56 MHz |
ISO 14443-A |
T2 + I²C |
iso14443a/nxp/ntag_i2c |
| MIFARE Classic 1K/4K |
NXP |
13.56 MHz |
ISO 14443-A |
— (Crypto1) |
iso14443a/nxp/mifare_classic |
| MIFARE DESFire EV1/2/3 |
NXP |
13.56 MHz |
ISO 14443-A |
T4 |
iso14443a/nxp/desfire |
| ST25TN512/01K |
ST |
13.56 MHz |
ISO 14443-A |
T2 |
iso14443a/st/st25tn |
| ST25TA512B/02KB/16K/64K |
ST |
13.56 MHz |
ISO 14443-A |
T4 |
iso14443a/st/st25ta |
| OPTIGA Authenticate NBT |
Infineon |
13.56 MHz |
ISO 14443-A |
T4 + I²C |
iso14443a/infineon/optiga_nbt |
| ST25TB512-AC/AT, 02K, 04K |
ST |
13.56 MHz |
ISO 14443-B (SRIX) |
— |
iso14443b/st/st25tb |
| RF430CL330H |
TI |
13.56 MHz |
ISO 14443-B |
T4 + I²C |
iso14443b/ti/rf430cl330h |
| ICODE SLIX / SLIX2 / 3 / DNA |
NXP |
13.56 MHz |
ISO 15693 |
T5 |
iso15693/nxp/icode_* |
| NTAG 5 Switch / Link / Boost |
NXP |
13.56 MHz |
ISO 15693 |
T5 (+I²C on Link/Boost) |
iso15693/nxp/ntag5_* |
| ST25TV512C/02KC |
ST |
13.56 MHz |
ISO 15693 |
T5 |
iso15693/st/st25tv |
| ST25DV04K/16K/64K |
ST |
13.56 MHz |
ISO 15693 |
T5 + I²C |
iso15693/st/st25dv |
| my-d vicinity SRF55V02P/10P |
Infineon |
13.56 MHz |
ISO 15693 |
T5 |
iso15693/infineon/myd_vicinity |
| Tag-it HF-I Plus |
TI |
13.56 MHz |
ISO 15693 |
T5 |
iso15693/ti/tagit |
| RF430FRL152/153/154H |
TI |
13.56 MHz |
ISO 15693 + sensor |
T5 + I²C/SPI |
iso15693/ti/rf430frl |
| EM4100 |
EM |
125 kHz |
LF ASK |
— |
lf/em/em4100 |
| HID Prox |
HID |
125 kHz |
LF FSK (Wiegand) |
— |
lf/hid/hid |
| T5577 |
Atmel |
125 kHz |
LF (multi) |
— |
lf/atmel/t5577 |
Generic bases you can subclass: NfcType2Tag / NfcType4Tag (14443-A),
NfcType5Tag/Tag15693 (15693), Tag14443B (SRIX) / Tag14443B_4 (standard
Type B), TagLF.
2. HF · ISO 14443-A · NFC Forum Type 2 (Ultralight / NTAG)
| Model |
User mem |
Pages |
GET_VERSION |
FAST_READ |
PWD_AUTH |
Counter |
Signature |
Extra |
| MIFARE Ultralight (MF0ICU1) |
48 B |
16 |
— |
— |
— |
— |
— |
OTP, COMPAT_WRITE |
| MIFARE Ultralight C (MF0ICU2) |
144 B |
48 |
— |
— |
— |
16-bit |
— |
3DES AUTHENTICATE |
| Ultralight EV1 MF0UL11 |
48 B |
20 |
✓ |
✓ |
32-bit |
3 × 24-bit |
✓ |
INCR_CNT, tearing |
| Ultralight EV1 MF0UL21 |
128 B |
41 |
✓ |
✓ |
32-bit |
3 × 24-bit |
✓ |
INCR_CNT, tearing |
| NTAG210 |
48 B |
20 |
✓ |
✓ |
32-bit |
— |
✓ |
— |
| NTAG212 |
128 B |
41 |
✓ |
✓ |
32-bit |
— |
✓ |
— |
| NTAG213 |
144 B |
45 |
✓ |
✓ |
32-bit |
1 × 24-bit NFC |
✓ |
mirror |
| NTAG215 |
504 B |
135 |
✓ |
✓ |
32-bit |
1 × 24-bit NFC |
✓ |
mirror |
| NTAG216 |
888 B |
231 |
✓ |
✓ |
32-bit |
1 × 24-bit NFC |
✓ |
mirror |
| NTAG I²C plus 1K (NT3H2111) |
888 B |
— |
✓ |
✓ |
32-bit |
— |
✓ |
SECTOR_SELECT, 64 B SRAM, DI |
| NTAG I²C plus 2K (NT3H2211) |
1912 B |
— |
✓ |
✓ |
32-bit |
— |
✓ |
2 sectors, FAST_WRITE, DI |
| ST25TN512 |
64 B |
64 |
— |
— |
— |
— |
TruST25 |
Kill password |
| ST25TN01K |
160 B |
64 |
— |
— |
— |
— |
TruST25 |
Kill password |
All: ATQA 0x0044, SAK 0x00, 7-byte UID. NXP UID prefix 04…; ST prefix 02….
NFC counter on NTAG213/215/216 auto-increments once per power cycle when enabled
(ACCESS.NFC_CNT_EN). Ultralight EV1 counters are read/increment (one-way) with
CHECK_TEARING_EVENT.
3. HF · ISO 14443-A · NFC Forum Type 4 (ISO-DEP / APDU)
| Model |
NDEF |
Extra files |
Password |
Crypto auth |
Counter |
Extra |
| ST25TA512B |
64 B |
System |
128-bit R/W |
— |
— |
— |
| ST25TA02KB |
256 B |
System |
128-bit R/W |
— |
20-bit event |
TruST25, GPO (-D/-P) |
| ST25TA16K |
2 KB |
System |
128-bit R/W |
— |
— |
— |
| ST25TA64K |
8 KB |
System |
128-bit R/W |
— |
— |
constants extrapolated |
| OPTIGA Authenticate NBT |
4 KB |
4×1 KB proprietary + FAP |
32-bit (per-file, FAP) |
ECDSA P-256 + AES-CMAC COTT |
— |
DI (I²C), life-cycle |
All ISO-DEP with per-model ATS. ST25TA UID prefix 02…; OPTIGA prefix 05…,
ATS historical bytes = "NBT2000". OPTIGA read/write access is gated by the
File Access Policy (per file, per interface); AUTHENTICATE TAG (INS 0x88)
signs a challenge with the device's NIST P-256 key.
MIFARE DESFire (EV1/2/3) is also Type 4 but uses the proprietary DESFire
command set + DES/3DES/AES auth — see iso14443a/nxp/desfire.
4. HF · ISO 14443-B
| Model |
Anticollision |
Blocks × size |
User |
Counters |
OTP area |
Extra |
| ST25TB512-AC |
SRIX slot-marker |
16 × 4 B |
36 B |
2 × count-down |
blocks 0-4 |
resettable OTP |
| ST25TB512-AT |
SRIX slot-marker |
16 × 4 B |
36 B |
2 × count-down |
— |
plain EEPROM 0-4 |
| ST25TB02K |
SRIX slot-marker |
64 × 4 B |
228 B |
2 × count-down |
blocks 0-4 |
reload counter |
| ST25TB04K |
SRIX slot-marker |
128 × 4 B |
484 B |
2 × count-down |
blocks 0-4 |
reload counter |
| RF430CL330H |
standard REQB/ATTRIB |
3 KB SRAM |
3 KB NDEF |
— |
— |
NFC Type 4, DI (I²C/SPI) |
ST25TB use the simplified SRIX/SRI anticollision (Initiate/Pcall16/Slot_marker
/Select-by-Chip_ID), 64-bit UID prefix D0 02 …, decrement-only counters at
blocks 5/6. RF430CL330H uses full ISO 14443-3 Type B (REQB→ATQB→ATTRIB) and then
Type 4 NDEF APDUs; its NDEF SRAM is volatile (host-filled over I²C/SPI).
5. HF · ISO 15693 (NFC-V / NFC Forum Type 5)
| Model |
User mem |
Blocks |
UID prefix |
Password |
Privacy |
Signature |
Extra |
| ICODE SLIX |
112 B |
28 × 4 B |
E0 04 01 |
EAS/AFI |
— |
✓ |
EAS |
| ICODE SLIX2 |
320 B |
80 × 4 B |
E0 04 02 |
4 × 32-bit |
privacy |
✓ |
DESTROY, protect-page |
| ICODE 3 |
304 B |
76 × 4 B |
E0 04 01 |
4 × 32-bit |
privacy |
✓ |
— |
| ICODE DNA |
256 B |
64 × 4 B |
E0 04 01 |
4 × 32-bit |
privacy |
✓ |
AES-128 mutual auth |
| NTAG 5 Switch (NTP5210) |
512 B |
128 × 4 B |
E0 04 01 |
password |
privacy |
✓ |
PWM/GPIO, EH, ED — no I²C, no AES |
| NTAG 5 Link (NTP53x2) |
2 KB |
512 × 4 B |
E0 04 01 |
password |
privacy |
✓ |
DI (I²C), 256 B SRAM, EH, ED, AES (NTP5332) |
| NTAG 5 Boost (NTA5332) |
2 KB |
512 × 4 B |
E0 04 01 |
password |
privacy |
✓ |
DI (I²C), SRAM, EH, AES always, ALM³ |
| ST25TV512C |
64 B |
16 × 4 B |
E0 02 08 |
64/32-bit areas |
Kill/Silent/Discreet |
TruST25 |
tamper (-T) |
| ST25TV02KC |
320 B |
80 × 4 B |
E0 02 08 |
64/32-bit areas |
Kill/Silent/Discreet |
TruST25 |
tamper (-T) |
| ST25DV04K |
512 B |
128 × 4 B |
E0 02 24 |
3 × 64-bit |
— |
— |
EH, mailbox/FTM, DI |
| ST25DV16K |
2 KB |
512 × 4 B |
E0 02 26 |
3 × 64-bit |
— |
— |
EH, 4 areas, GPO, DI |
| ST25DV64K |
8 KB |
2048 × 4 B |
E0 02 26 |
3 × 64-bit |
— |
— |
EH, mailbox, DI |
| my-d vicinity SRF55V02P |
224 B |
56 × 4 B |
E0 05 40 |
— |
— |
— |
value counters, page mode¹ |
| my-d vicinity SRF55V10P |
992 B |
248 × 4 B |
E0 05 00 |
— |
— |
— |
value counters, page mode¹ |
| Tag-it HF-I Plus |
256 B |
64 × 4 B |
E0 07 … |
— |
— |
— |
Write_2/Lock_2 (0xA2/0xA3) |
| RF430FRL152/3/4H |
256 B² |
64 × 4 B² |
E0 07 A2 |
— |
— |
— |
ADC + temp sensor, DI |
¹ my-d vicinity has no GET SYSTEM INFO (0x2B) — identify via the Chip-ID UID
byte. ² RF430FRL block map + sensor commands are defined by ROM firmware
(SLAU603, not modelled); the model provides identity + standard 15693 I/O.
³ ALM = Active Load Modulation, unique to the NTAG 5 Boost (NTA5332) among
the NTAG 5 family — a physical RF feature (no command-layer effect; at the APDU
layer Boost is a Link NTP5332 with AES permanently enabled).
6. LF · 125 kHz
| Model |
Data |
Encoding |
Writable |
Notes |
| EM4100 |
40-bit ID |
ASK / Manchester |
read-only |
classic access-control tag |
| HID Prox |
26/35/… bit Wiegand |
FSK |
read-only |
facility + card number |
| T5577 |
4×32-bit blocks + config |
ASK/FSK/PSK (multi) |
✓ |
emulates EM4100/HID/etc. via config |
7. Specialized feature comparison
7.1 Energy harvesting (EH output for external circuits)
| Model |
Protocol |
EH mechanism |
| ST25DV04K/16K/64K |
15693 |
V_EH analog output pin; EH_CTRL_Dyn register (EH_EN/EH_ON) |
| NTAG I²C plus |
14443-A |
field-powered I²C host supply (V_OUT) |
| NTAG 5 — all variants (Switch/Link/Boost) |
15693 |
energy-harvesting output + event-detection (ED) pin, shared via the NTAG 5 platform |
| RF430FRL15xH |
15693 |
passive (field-powered) or battery-assisted operation |
7.2 Dual interface — RF + wired host (I²C / SPI bridge)
| Model |
RF |
Wired |
Shared-memory / bridge feature |
| NTAG I²C plus (NT3H2111/2211) |
14443-A T2 |
I²C |
64-byte SRAM, pass-through, SECTOR_SELECT |
| ST25DV04K/16K/64K |
15693 T5 |
I²C |
256-byte mailbox (Fast Transfer Mode) |
| OPTIGA Authenticate NBT |
14443-A T4 |
I²C (GP T=1′) |
NFC↔I²C pass-through, IRQ |
| RF430CL330H |
14443-B T4 |
I²C / SPI |
3 KB NDEF SRAM, host writes NDEF |
| NTAG 5 Link (NTP53x2) |
15693 T5 |
I²C |
256 B SRAM, arbiter, pass-through/mirror/PHDC |
| NTAG 5 Boost (NTA5332) |
15693 T5 |
I²C |
= Link NTP5332 + AES always on + ALM |
| RF430FRL15xH |
15693 |
I²C / SPI |
MSP430 host access to FRAM |
(NTAG 5 Switch (NTP5210) is single-interface — RF + PWM/GPIO only, no I²C.)
7.3 Cryptographic authentication
| Model |
Protocol |
Scheme |
| MIFARE Classic 1K/4K |
14443-A |
Crypto1 (48-bit, per-sector keys A/B) |
| MIFARE Ultralight C |
14443-A |
2-key 3DES challenge-response (AUTHENTICATE 0x1A) |
| MIFARE DESFire |
14443-A T4 |
DES / 3DES / AES-128 |
| ICODE DNA |
15693 |
AES-128 tag + mutual auth |
| NTAG 5 Link (NTP5332) / Boost (NTA5332) |
15693 |
AES-128 TAM/MAM (Switch has none; Link NTP5312 is password-only) |
| OPTIGA Authenticate NBT |
14443-A T4 |
ECDSA P-256 (offline) + AES-128-CMAC COTT (online) |
7.4 Password protection (symmetric secret / verify)
| Model |
Protocol |
Password |
| NTAG21x, Ultralight EV1 |
14443-A |
32-bit PWD_AUTH (+16-bit PACK), AUTH0 page gate |
| ST25TA family |
14443-A T4 |
128-bit read + write passwords (VERIFY) |
| OPTIGA NBT |
14443-A T4 |
32-bit per-file passwords via File Access Policy |
| ICODE SLIX2 / 3 / DNA |
15693 |
4 × 32-bit (read/write/privacy/destroy) |
| ST25TV |
15693 |
64-bit (single-area) or 2 × 32-bit (dual-area) + config pwd |
| ST25DV |
15693 |
3 × 64-bit RF passwords + area protection |
| ST25TN |
14443-A |
32-bit Kill password only |
7.5 Counters
| Model |
Counter(s) |
Type |
| NTAG213/215/216 |
1 × 24-bit |
NFC read counter (auto-increment) |
| Ultralight EV1 |
3 × 24-bit |
one-way, increment + tearing check |
| Ultralight C |
1 × 16-bit |
one-way |
| ST25TA02KB |
20-bit |
event counter (anti-tearing) |
| my-d vicinity |
per-page |
value counters (decrement-only, 0…65535) |
| ST25TB (all) |
2 × 32-bit |
count-down (decrement-only) |
7.6 Tamper detection, privacy & kill
| Model |
Feature |
| ST25TV02KC-T |
tamper loop (TD0/TD1), seal/unseal/reseal event memorization |
| ST25TV |
Kill (permanent), Silent + Discreet (reversible), NUID masking |
| ST25TN |
Kill (permanent RF mute) |
| ICODE SLIX2 / 3 / DNA |
privacy mode, DESTROY (permanent) |
| ST25DV |
RF-disable / RF-sleep dynamic registers |
7.7 Originality / authenticity signatures
| Signature scheme |
Models |
| NXP originality (32-byte ECC, READ_SIG) |
NTAG21x, Ultralight EV1, NTAG I²C, ICODE SLIX/SLIX2/3/DNA, NTAG5 |
| ST TruST25 digital signature |
ST25TN, ST25TA (02KB), ST25TV |
| Certificate-based (X.509 + ECDSA) |
OPTIGA Authenticate NBT |
7.8 Sensors
| Model |
Sensor |
| RF430FRL152/153/154H |
14-bit sigma-delta ADC + internal temperature sensor (over 15693, via ROM firmware) |
8. Implant presets
Pre-configured instances for the common dual/single-frequency implants
(from pm3py.sim import xEM, xNT, xM1, FlexDF, NExT):
| Preset |
Backing model |
Notes |
xEM |
T5577 (EM4100 mode) |
LF |
xNT |
NTAG216 |
HF, NDEF |
xM1 |
MIFARE Classic 1K |
HF |
FlexDF |
DESFire EV2 |
HF |
NExT |
T5577 + NTAG216 |
dual-frequency (LF + HF) |
MagicMifareClassicTag |
gen1a / gen2 Classic |
writable block 0 |
Generated from the pm3py.sim model set. Memory/feature values follow the
manufacturer datasheets; where a datasheet was not supplied (ST25TA64K,
RF430FRL firmware command set) the model is marked accordingly in its module
docstring.
