Brivo Cards & Fobs Explained: The Unified Credential, LEAF & Security

Brivo is a cloud access-control provider, and its flagship credential is the Brivo Unified Credential. Brivo builds the Unified Credential on an AES-secured 13.56 MHz smart card using the LEAF file structure, an open and interoperable credential standard, and manages it through the Brivo Access cloud platform.

Alongside the secure smart card, Brivo supplies dual-technology cards that add a 125 kHz proximity layer for sites migrating from older readers, and Bluetooth mobile credentials for phone-based unlock. The secure Unified Credential is provisioned through Brivo and its integrators rather than manufactured by third parties.

LEAF is an open, interoperable credential data structure that runs on AES-secured 13.56 MHz smart cards, and Brivo is a member of the LEAF community. Rather than a proprietary format locked to one vendor, LEAF is designed so a credential works across any LEAF-compatible reader, which is why Brivo describes its Unified Credential as built on the LEAF file structure.

For a buyer, the practical effect is that a Brivo Unified Credential is both encrypted and portable across the LEAF ecosystem, while still being provisioned and keyed through Brivo. The openness is about interoperability between manufacturers, not about the credential being copyable — the underlying smart card still authenticates with AES before releasing any data.

A Brivo Unified Credential is an AES-secured 13.56 MHz smart card, and the current generation of that smart card is independently certified to Common Criteria EAL5+. Brivo's own credential material cites the EAL5+ rating and offers optional card-plus-PIN two-factor authentication for higher-assurance doors.

Because the credential releases its identity only after an AES exchange, a Brivo Unified Credential cannot be cloned by copying a serial number the way a 125 kHz proximity card can. The weaker element is only the optional 125 kHz layer on a dual-technology card, which exists purely so legacy readers keep working during a migration.

Brivo lets a site choose among secure smart cards and fobs, dual-technology cards for migration, and mobile credentials. The options below summarise the main choices, from most secure to most migration-oriented.

Brivo Smart Readers read 125 kHz proximity, 13.56 MHz smart cards, and Bluetooth mobile credentials, and they output over both OSDP and Wiegand. Brivo describes them as supporting "legacy prox cards alongside higher-security encrypted cards and mobile credentials at the same door."

That multi-technology capability is what makes a phased upgrade practical: a Brivo site can accept its existing 125 kHz cards while it issues AES-secured Unified Credentials, then retire the proximity layer once everyone has moved. Using OSDP with secure channel also encrypts the reader-to-controller link, closing a gap that legacy Wiegand wiring leaves open.

Not for the secure Unified Credential. Because a Brivo Unified Credential is an AES-secured, LEAF-structured smart card keyed within Brivo's system, no third party can produce a working compatible version, and Security ID Systems does not offer one. Additional secure cards, fobs, and mobile credentials come from Brivo or your integrator.

What we can supply is the 125 kHz proximity layer a Brivo site runs during migration — including the Brivo 37-bit prox format and the general HID, Indala, and AWID prox formats a mixed site carries. Those open low-frequency formats we encode as fully compatible credentials.