You approved the quote, the cards arrived on time, and the installer swears they are “standard Wiegand.” Then half of them will not open the doors. Nine times out of ten the cards are fine — the problem is the card format and facility code written onto them does not match what your readers expect. This guide explains, in buyer terms, what a format actually is, how 26-bit Wiegand, 37-bit, 40-bit, and Corporate 1000 differ, and exactly what to write in your purchase order so the credentials work the first time.
What a Card “Format” Actually Means (and Why It Breaks Access)
Buyers often confuse the format of a credential with its technology. A card can be a 125 kHz proximity (HID Prox-style) card or a 13.56 MHz contactless (ISO/IEC 14443) card — that is the radio. The format is the bit-level layout the reader decodes: where the start and stop bits sit, how parity is calculated, which block is the facility code, and which block is the card number. Two cards using the same radio but different formats will simply not be read by each other’s readers.
For legacy and many current systems, that layout is expressed in Wiegand bits — named after the wire protocol, now a de-facto industry convention rather than a formal ISO standard. When your supplier says “26-bit,” they are describing a 26-bit Wiegand data structure, not a physical property of the card. Getting this right on the order form is the single highest-leverage thing a buyer can do to avoid a failed rollout.
26-bit Wiegand — The Default Everyone Assumes
26-bit Wiegand is the default because every reader and every cheaper card program supports it. Its structure is 1 parity bit + 8 bits of facility code + 16 bits of card number + 1 parity bit. That gives you a facility code range of 0–255 and a card-number range of 0–65,535.
The convenience is real, but so are the limits. 26-bit Wiegand carries no unique facility-code protection: any two cards that share the same facility code and card number — even from different suppliers or different buildings — will open the same door. The facility-code space is tiny (256 values), so collisions across sites are common, and because the data is transmitted in plaintext, a 26-bit card can be cloned with inexpensive off-the-shelf tools. For a low-risk break room it is fine; for a data center or a government floor it is not enough.
37-bit and 40-bit Wiegand — More Room, More Control
If you stay on the Wiegand protocol but need more addressing room, 37-bit and 40-bit variants extend the facility-code and card-number fields. A typical 37-bit layout expands the facility code to roughly 0–65,535 and the card number into the millions. The reader still speaks Wiegand (still plaintext, still cloneable), but you gain the ability to assign a distinct facility code per site, which sharply reduces the chance that a card issued for Building B accidentally works at Building A.
The trade-off is compatibility: not every legacy reader supports 37/40-bit, so you must confirm the controller and reader firmware before you commit. Moving to 37-bit or 40-bit lets you assign a unique facility code per site, cutting the chance that a card from another building accidentally works at yours. It is a low-cost step up from 26-bit when a full OSDP migration is not yet justified.
Corporate 1000 (35-bit) — The Enterprise Default
Corporate 1000 is HID Global’s registered, non-public 35-bit format used by large enterprises, universities, and government-adjacent programs. Because the bit structure is not published, it is substantially harder to clone with consumer tools than 26-bit Wiegand. It pairs naturally with higher-assurance programs and is a common choice when an organization wants a credential that cannot be trivially duplicated at a mall kiosk.
One caveat buyers miss: Corporate 1000 cards only help if your readers are provisioned for Corporate 1000. Confirm the format is enabled on your access-control system before ordering, and keep a record of the exact variant you specified. See HID Global’s credential overview for the product family: HID Cards and Credentials.
Facility Code vs Card Number — What You Actually Own
Two numbers define every formatted card. The facility code is the group identifier — think of it as your “namespace” across all the cards at a site. The card number is the sequential ID within that facility code. Both are values you choose when you place the order; the supplier does not invent them.
This matters because your facility code is an identifier you assign, not a secret. Treat it as documented metadata, not as a security control. The real protection comes from a larger or non-public format plus encrypted communication — never from hoping nobody guesses your facility code. Keep a registry (facility code, card-number ranges, issue dates, holder) so you can revoke and re-issue cleanly.
How to Specify the Format in Your Purchase Order
A vague line item such as “500 Wiegand cards” is an invitation to a mismatch. Write the order so a factory can execute it without guessing. A complete specification contains:
- The exact format string — e.g., “26-bit Wiegand, Facility Code 101, Card Numbers 0001–0500” or “HID Corporate 1000, card range 000001–000500.”
- The technology — 125 kHz prox or 13.56 MHz contactless (or dual-frequency if your readers require it).
- Reader confirmation — the exact make/model of controller and reader you will enroll against, so the supplier can verify compatibility.
- A sample-test clause — “ship 10 samples first; buyer validates on live readers before bulk release.”
This is where format choices connect to the wider system. If you are still deciding between reader standards, our OSDP vs Wiegand comparison and our Access Control Systems (PACS) 101 guide walk through the controller-and-reader context these cards plug into.
The Costly Mistakes Buyers Keep Making
The same errors show up in audit after audit:
- Reusing one facility code across every site — convenient until a card walks between buildings it should not.
- Losing the format document — the installer leaves, and nobody knows what was programmed. Losing your format documentation means a future re-badge of every cardholder — plan for it from day one.
- Assuming “Wiegand” means compatible — 26-bit, 37-bit, and Corporate 1000 are all “Wiegand” to a salesperson but incompatible to a reader.
- Skipping the sample test — discovering the mismatch after 5,000 cards are printed is the expensive way to learn this lesson.
When to Upgrade From 26-bit to a Higher-Security Format (and OSDP)
If you are installing or refreshing an access system in 2026, the forward-looking move is to pair a larger or non-public format with OSDP (Open Supervised Device Protocol), the encrypted, bidirectional standard published by the Security Industry Association. OSDP is the encrypted, bidirectional standard that replaces plaintext Wiegand for new access-control installs. Unlike Wiegand, OSDP lets the controller continuously supervise the reader and refuse cloned or tampered devices.
For background on the protocol and why it is becoming the baseline for new projects, see the SIA OSDP resource: OSDP.org. If you also run a card-issuance workflow, our ID Card Issuance Program guide shows how format and numbering fit into enrollment and lifecycle.
Frequently Asked Questions
Can I mix 26-bit and Corporate 1000 cards on the same system?
Only if your readers and controller explicitly support both formats and you enroll them as separate credential types. Do not assume compatibility — verify on the reader firmware.
Is a facility code a security feature?
No. It is an identifier, not a secret. Real security comes from a non-public format (Corporate 1000) and encrypted OSDP communication.
What should I put on the purchase order?
The exact format string (e.g., “26-bit Wiegand, FC 101, cards 0001–0500”), the card technology, the reader model, and a sample-test clause.
Next Step: Specify With Confidence
You do not need to become a format engineer to avoid a failed rollout — you need a supplier who asks the right questions and ships samples you can test on your own readers. Request a quote with your format, facility code, and number range, and we will confirm reader compatibility and send validated samples before any bulk production. Explore our card services for encoding, personalization, and lifecycle support.
