Kantech ioProx Cards Explained: XSF, KSF & 32-bit Formats

What a Kantech ioProx Card Is — and Which Controllers Use It

Kantech ioProx is a 125 kHz LF proximity technology in widespread use across commercial, institutional, and light-industrial sites that installed Kantech hardware during the 2000s and 2010s. The controllers most commonly paired with ioProx credentials are the KT-300 (four-door IP controller) and KT-400 (eight-door variant), both managed through Johnson Controls' EntraPass access-management platform. Because the reader infrastructure is installed and typically long-depreciated, facility managers rarely have any reason to replace it — they need replacement credentials that present the correct data when held to the existing reader head.

ioProx readers operate at 125 kHz, the same carrier frequency as standard 125 kHz LF proximity cards and fobs such as HID H10301 or AWID, but ioProx uses its own proprietary data modulation and Sensor format structure. A raw 26-bit HID card will not authenticate on a Kantech ioProx reader, and vice versa. The distinction matters when ordering replacements: specifying '125 kHz proximity' alone is not enough — the format and bit structure must match the enrolled credential type in EntraPass.

ioProx Part Numbers Decoded: P10SHL, P20DYE, P40KEY

Kantech ioProx credentials follow a consistent part-number scheme that encodes form factor and finish in the designation itself. The P10SHL is a standard ISO CR-80 card (86 × 54 mm) in a plain white or light-coloured printable finish — the workhorse credential found in most ioProx deployments. The P20DYE is the same ISO card format with a dye-sublimation-printable surface, suited to installations that issue photo ID cards combining logical access with visual identification. The P40KEY is the key fob form factor, dimensionally compact and suited to staff or contractors who carry keys rather than cards.

All three part numbers carry the same underlying ioProx RF technology — the Sensor format encoded on the credential is determined at ordering or issuance, not by the part number suffix. When ordering compatible replacements, specifying the part number helps confirm form factor, but the critical data points are the Sensor format (XSF, KSF, or K32), the facility code, and the card-number range. If you are unsure which Sensor format is active in your installation, our card format identification guide walks through the diagnostic steps.

XSF vs KSF vs the 32-bit Wiegand Variant

The three Sensor formats used in ioProx systems are distinct at the data-structure level, and selecting the wrong one will result in reads that the controller refuses — even though the card physically energises at the reader. XSF (eXtended Secure Format) is the current standard format for ioProx deployments and provides a higher-capacity data field than the older KSF. KSF (Kantech Sensor Format) is the legacy variant, still active in older installations that pre-date the XSF rollout. Many long-running sites continue to issue KSF credentials because their EntraPass card-number database was built under KSF, and migrating the card-number scheme to XSF would require re-enrolment of every existing card.

The K32 designation refers to the 32-bit Wiegand variant of ioProx — sometimes listed as the Kantech 32-bit Wiegand format. Its data structure follows a standard Wiegand frame: one leading parity bit, an 8-bit facility code field, a 16-bit card number field, and one trailing parity bit, for 32 bits total. This makes K32 structurally legible to any Wiegand-capable panel, which is why it was adopted at sites running mixed-vendor controller environments alongside Kantech hardware. The complete Wiegand format guide provides additional context on bit-length conventions and parity calculation across common access-control formats.

It is worth noting that XSF and KSF are not simply shorter or longer versions of the same structure — they use different data organisation schemes. A Kantech ioProx XSF compatible card and a Kantech KSF compatible proximity card are ordered separately and cannot be interchanged on the same reader programme, even if facility codes and card numbers are identical.

How a Compatible ioProx Credential Is Encoded

The chip technology underlying a compatible ioProx credential is a T5577 or EM4305-class 125 kHz programmable substrate. These are multi-protocol LF chips that can be written to emulate the modulation scheme, data structure, and bit framing of the target format — in this case, Kantech's ioProx Sensor protocol. The T5577 explained guide covers how this chip class works across different LF proprietary formats. What matters from a facility-management perspective is that the data structure written to the chip must fully match the enrolled Sensor format: bit length, parity, facility code position, and modulation type must all be correct for the reader to produce a valid Wiegand output to the controller.

For a Kantech ioProx compatible card or Kantech ioProx 32-bit compatible card to work on your installation, the credential must be encoded with your specific facility code and the card numbers you designate — not a generic or 'blank' proximity template. This is fundamentally different from a blank ISO card: the ioProx data payload must be written before the credential will produce any useful read at all. Security ID Systems supplies credentials pre-encoded to your facility code and card-number range as specified on your order; no additional programming is required on receipt.

Ordering Compatible Kantech ioProx Replacements: What to Provide

To fulfil a compatible ioProx order accurately, three pieces of information are required: the Sensor format (XSF, KSF, or K32/32-bit Wiegand), the facility code assigned to your site, and the card-number range you need covered. The Sensor format is typically documented in EntraPass under the card format settings for the reader group, or it can be read from the controller's configuration export. If neither is accessible, a working credential from the existing batch can be read to confirm format. For installations that have run ioProx for many years and pre-date accessible documentation, our identification guide covers how to confirm format from a live card.

Facility codes and card numbers for an ioProx deployment are stored in EntraPass and are not printed on credentials as standard — unlike some legacy formats that emboss or print these values. If you cannot retrieve them from the software, replacing a handful of cards sequentially from an existing batch and testing against the reader is the fastest confirmation method. For larger procurement orders covering multiple buildings or card-number ranges, we can supply cards in defined batches across the full range. Compatible Kantech KSF 32-bit compatible cards and compatible cards for mixed-vendor Kantech and AMAG/Lenel/Keri/Indala installations are also available where a site has heterogeneous reader infrastructure. Contact us via the enquiry form to discuss volume, format, and delivery requirements for your site.

Security ID Systems is an independent manufacturer and supplier of compatible access-control credentials and is not affiliated with, authorized by, or endorsed by Kantech or Johnson Controls.