HID Seos Cards Explained: Security, Specs & Credential Options

HID Seos is HID Global's flagship high-security credential. It is a 13.56 MHz contactless credential that stores identity data inside a Secure Identity Object (SIO) — an encrypted, digitally-signed data container — on a secure element, and it is designed to run identically on a plastic card, a key fob, or a smartphone. Unlike older technologies that are tied to one card chip, Seos is a device-independent credential standard.

Its defining feature is cryptography: every transaction between a Seos credential and a Seos-enabled reader is protected by AES-128 mutual authentication, so the card and reader each prove their identity before any data moves. That is a fundamentally different security model from the 125 kHz proximity cards Seos is meant to replace.

HID Seos operates at 13.56 MHz over the ISO/IEC 14443 air interface — the same high-frequency band used by other modern contactless smart cards. The credential data lives in an AES-secured secure element, and the Seos datasheet describes the security model as "key diversification, authentication signatures, and AES-128 based encryption," with "mutual authentication" and a "diversified session key," plus a random 4-byte UID so the card cannot be tracked by a fixed serial number.

Because keys are diversified per credential, recovering the data from one card does not expose any other card in the system — there is no shared secret broadcast in the clear.

No. A Seos credential cannot be cloned by copying its serial number the way a 125 kHz proximity card can, and there is no publicly documented cryptographic break of Seos. The AES-128 mutual authentication means a cloned card would also have to reproduce a secret key it never has access to.

This is a meaningful contrast with HID's own earlier 13.56 MHz technology. The proprietary cipher and key-diversification scheme used by legacy iCLASS were reverse-engineered and published by academic researchers in 2012, who reported recovering the iCLASS Elite master key in roughly 15 authentication attempts. Seos was designed as the standards-based AES replacement for exactly that generation, and no equivalent break has been published against it.

HID's credential technologies span three security eras. Understanding which one a site runs on is the single most important step before ordering any card.

HID has guided customers away from 125 kHz proximity for years — it introduced migration readers that read both 125 kHz and 13.56 MHz specifically so sites could move gradually without swapping every card and reader on the same day. The recommended end-state is Seos, because it moves security from a copyable serial number to an AES-128 credential that also works as a phone-based mobile credential.

A typical migration runs: 125 kHz Prox → iCLASS → iCLASS SE (SIO) → Seos, with multiCLASS SE readers running the old and new technologies side by side during the cutover so no one is locked out mid-transition.

No — and that is by design. Because a Seos credential is cryptographically bound with keys held by HID and your credential-management system, there is no legitimate way for an independent manufacturer to produce a "compatible" Seos card, and Security ID Systems does not offer one. If your access-control system uses Seos, the correct source for additional credentials is HID or the integrator that manages your site's keys.

Where we can help is the other end of the same migration: many sites running Seos still have doors, gates, or legacy readers on 125 kHz proximity during the transition. Those open formats we supply as fully compatible, encoded credentials.