MIFARE Classic Tool

MIFARE Classic Tool, usually shortened to MCT, is an Android utility for reading, writing and analysing MIFARE Classic RFID tags. It works at sector and block level rather than presenting the tag as a generic web link or contact card. That makes it useful for authorised lab work, backups and examining systems you own, but it also means a wrong write can damage data on a real credential.

This page covers F-Droid’s 4.3.1 build. We matched the APK to F-Droid’s signed index, inspected its two permission declarations and checked the fixed v4.3.1 source tag. We did not test it with a physical tag or NFC chipset.

Reading and analysing a tag

MCT reads sectors with matching keys. It includes standard, extended-standard and hotel-standard dictionaries, so cards using those default keys do not require a new key file. You can also provide a file with other authorised keys, and the dictionary function tries the candidates across selected sectors. A successful read can be saved as a dump, edited, shared or compared with another dump. Analysis views decode access conditions and MIFARE value blocks instead of leaving every byte unexplained.

The app also includes tools for comparing dumps, editing key files and working with UIDs. A dictionary attack is not key recovery: it only checks candidate keys already in the file. The project states that MCT cannot crack unknown keys and does not implement brute force.

Writing, cloning and irreversible choices

You can write an individual block or restore a whole dump when the tag accepts the relevant key. Sector trailers contain keys and access bits; writing invalid access conditions can lock a sector permanently. Verify a dump and its access-bit calculation before writing, keep an untouched backup, and use only tags and systems you own or are authorised to test.

The manufacturer block—block 0—cannot be rewritten on an ordinary genuine MIFARE Classic card. Some special clone tags expose writable UIDs or manufacturer blocks. Generation 1 magic-card commands are not available through Android’s standard NFC API. Generation 2 and CUID tags use ordinary writes; the project says FUID and UFUID have not been tested. A “clone” option therefore does not mean every source card can be copied to every blank tag.

Hardware compatibility and offline data

The direct phone path needs an NFC controller and firmware that implement MIFARE Classic. Some Android devices support NDEF and other tag types but not Classic commands, and software cannot add missing controller capability. As an alternative, the project documents external readers such as the ACR122U on USB-OTG phones through the separate External NFC app. Upstream maintains compatible and incompatible device lists and says they may be incomplete.

The APK declares NFC plus Android’s automatically generated dynamic-receiver permission. It has no internet permission, and our static scan found no tracker SDKs. Dumps and custom key files are stored with the app; upstream warns that uninstalling deletes its private files, so export anything that must survive removal.

Version 4.3.1 updates the target to Android 15 and fixes one possible crash. It does not change the physical limitations of NFC hardware or turn the app into an unknown-key cracking tool.

About this file

• This is F-Droid’s source build of 4.3.1, signed with F-Droid’s key. A differently signed APK cannot update it in place.
• The 4.0 MB APK needs Android 4.4 or later and contains no native libraries. Reading still needs either compatible built-in NFC or the documented USB-OTG external-reader route.
• Its measured SHA-256 is 1e230b26d97d119c7f8034af082fbe6cc41b99a955b6d699d951c59c456a086c, matching the signed F-Droid index.
• Source-file headers permit GPL-3.0 or later, while F-Droid’s listing says GPL-3.0-only; this page follows the source headers. The logo remains CC BY-NC-SA 4.0, Oxygen icons are LGPL, and the RFID-tag image is CC BY 3.0.
• “MIFARE” is an NXP trademark. This independent open-source tool is not a promise of compatibility with any particular access-control or transport system.

Versions currently kept in the F-Droid repository. We host and check only the newest one. Full changelog.