You have a smart card quote in front of you that says “chip: compatible,” “memory: sufficient,” and “ISO compliant.” Comforting — until the cards arrive and your readers reject half of them, your access controller will not enroll them, or your auditor asks for the certificate number. A smart card datasheet turns those vague promises into checkable facts. This guide walks B2B buyers — integrators, distributors, and enterprise security teams — through the lines that matter: interface, chip and operating system, memory, voltage, security marks, and lifecycle. Read it before you sign, not after the shipment fails.
Why the Datasheet Is Your First Procurement Filter
A vague quote protects the supplier, not you. The datasheet is the specification your purchase order should reference — and the only document you can hold a supplier to if a card fails interoperability or a compliance audit. Always ask for it before you negotiate price.
Why it is non-negotiable:
- A datasheet tied to a real part number lets you reproduce the exact card on reorder and qualify a second source without re-testing from scratch.
- It is where compatibility claims become measurable: interface, memory size, voltage class, and certification ID are all printed as numbers, not adjectives.
- Buyers who request a full datasheet plus a physical sample before committing consistently avoid the “works on my bench” surprises that show up only at rollout.
Pair the spec with a bench check — our guide on requesting card samples before a bulk order covers exactly what to verify on the physical card.
Interface Line — Contact (ISO/IEC 7816) vs Contactless (ISO/IEC 14443) vs Dual
Every reader you deploy speaks one or more physical interfaces. The interface line of the datasheet tells you which ones this card answers to — and the interface line decides which readers your card will, and will not, work with. Get it wrong and the entire deployment fails at the door.
Contact (ISO/IEC 7816): an eight-contact pad (C1–C8) defined by ISO/IEC 7816-3 (electrical interface and transmission protocols) and ISO/IEC 7816-4 (organization, security, and commands). The card announces itself with an Answer-to-Reset (ATR). This is the world of banking, eID, and PIV credentials.
Contactless (ISO/IEC 14443): a 13.56 MHz proximity interface that splits into Type A (MIFARE, NTAG) and Type B (Calypso and several banking schemes), differing in modulation and framing. Read range and baud rate are printed in the datasheet.
Dual-interface: a single chip that exposes both contact and contactless. It is the usual choice for migration programs because it lets you keep legacy contact readers while rolling out contactless. Our dual-interface card guide explains when the premium is worth it.
Chip Type and Card Operating System — What “Java Card,” “MIFARE,” “NTAG,” “DesFire” Really Tell You
The chip label is not a single spec; it bundles a silicon family, an operating system, and a vendor ecosystem. Knowing which is which changes what your card can do after issuance — and if your program needs multiple applications or future applet updates, you need a Java Card / GlobalPlatform-capable chip. A fixed-function MIFARE chip cannot do that.
Java Card / GlobalPlatform: an applet platform you can load applications onto after the card is issued, managed by the GlobalPlatform specification. This enables multi-application cards and post-issuance updates — the foundation of PIV, eID, and many enterprise programs.
MIFARE / NTAG / ICODE: NXP product families built on ISO/IEC 14443 and ISO/IEC 15693. Excellent for access control and ticketing, but fixed-function and tied to one vendor’s ecosystem — a lock-in risk to weigh in the RFQ.
DesFire EV3: a higher-security contactless platform common in transit and government. Native chips (no open OS) are cheaper and closed; open-OS chips cost more but avoid vendor lock-in. Our chip-selection guide maps use cases to the right family, and our MIFARE vs NTAG vs ICODE comparison breaks down the RFID side.
Memory Classes — EEPROM vs Flash, and How Much Is Actually Yours
The memory line is the most misunderstood number on the page. Two non-volatile technologies dominate, trading density against endurance:
| Attribute | EEPROM | Flash |
|---|---|---|
| Typical capacity | 32–256 KB | 512 KB – 2 MB+ |
| Erase granularity | Byte / page | Block / sector |
| Write endurance | ~100K–500K cycles | ~10K–100K cycles |
| Best for | Frequent small writes (keys, counters, logs) | Large applets, certificate chains, biometric templates |
The file system model these memories present is standardized in ISO/IEC 7816-4. The number that matters for buyers is usable memory, not the headline: a “64 KB” chip rarely gives you 64 KB of usable application memory — reserve 20–40% for the OS, file system, and security objects.
Voltage, Clock, and Power — Why Class A/B/C Still Matters
Contact cards are powered by the reader. If the voltage class does not match, the card will not wake up — a failure that looks like a dead card but is really a spec mismatch. ISO/IEC 7816 defines three classes: Class A = 5 V, Class B = 3 V, Class C = 1.8 V. The reader must supply the class the card supports.
Contactless cards draw from the RF field at 13.56 MHz; their limit is field strength and the chip’s power budget, not a supply pin. The practical trap is legacy hardware: always confirm the voltage class your reader supplies matches the card’s supported class — a 1.8 V (Class C) card will not initialize on a 5 V-only legacy reader. The electrical rules are in ISO/IEC 7816-3.
Security and Certification Marks — What EAL, Common Criteria, FIPS, and EMVCo Actually Certify
Certification marks are the most misunderstood part of a datasheet. Each covers a specific scope, and conflating them is a common audit failure:
- Common Criteria (CC): an EAL level — EAL4+ is typical for secure elements, EAL5+ for high assurance. It evaluates the chip and its operating system, not the finished card.
- FIPS 140-3 validates the cryptographic module; FIPS 201-3 (PIV) governs US federal credential content and interfaces (see the NIST publication).
- EMVCo approval covers payment applications — verify the approval on the EMVCo site.
One rule keeps you safe: a Common Criteria certificate covers the secure element and its operating system — it does not by itself prove the finished card, personalization, or key management are compliant. Search any claimed level on the Common Criteria Portal by the certificate number printed on the datasheet.
Lifecycle and Endurance — What the Read/Write and Retention Numbers Predict
The small print at the bottom of the datasheet predicts field lifespan. For cards rewritten constantly, capacity is irrelevant next to endurance:
Write endurance: EEPROM ~100K–500K cycles, Flash ~10K–100K. A transit, loyalty, or attendance card rewritten daily lives or dies by this number. For cards rewritten daily, the write-endurance figure — not total capacity — is what determines field lifespan.
Data retention: typically 10–20 years under normal conditions. Operating temperature and mechanical durability (bending, torsion, abrasion) are verified by the ISO/IEC 10373 test methods — ask for the test report, don’t assume it.
Reading Between the Lines — Red Flags and What to Ask Your Supplier
Knowing what is missing is as useful as knowing what is printed. Watch for these red flags in any smart card quote or datasheet:
- “Fully compatible” stated with no part number, no memory figure, and no certificate number.
- No ATR (contact) or ATQA/SAK (contactless) values you can match against your readers.
- Vague memory (“enough”) and no write-endurance or data-retention figures.
- No test report (electrical + durability) and no copy of the certificate.
- No sample offered for your own bench verification.
Before you order, ask for four things and verify each: the full datasheet, a sample with a written spec, an in-house or third-party test report, and the certificate number. Treat “fully compatible” without a part number, memory figure, and certificate number as a red flag, not a feature. Our sample-request checklist and shipment inspection checklist turn those asks into a repeatable process.
Frequently asked questions
Contact or contactless — which should I specify?
Match the reader estate you already run. If you operate both, a dual-interface card defers the decision and supports a phased migration — see our dual-interface guide for the trade-offs.
How much memory do I actually need?
Start from your application data: keys, applets, credentials, and logs. A 32–64 KB EEPROM covers most access-control and light enterprise apps; multi-application or biometric programs need Flash-class capacity. Remember the 20–40% OS reserve when you size the chip.
Is a higher EAL always better?
Higher EAL means a more rigorous evaluation, not automatically a better fit. EAL4+ secure elements satisfy most commercial and enterprise programs; EAL5+ suits high-assurance government use. Match the level to your risk profile rather than chasing the biggest number on the page.
Decoding a smart card datasheet is not an academic exercise — it is the difference between a card that deploys on day one and one that becomes a returns line item. Pin down the interface, chip and OS, memory, voltage, certification, and endurance before you order. If you want a second pair of eyes on a supplier’s spec sheet, request a sample and a datasheet review — we will flag the gaps before they cost you a reissue.
