What does a reader actually send to the controller?
In a typical door system the credential is read by the reader, but the decision to unlock is made by a controller, usually in a secure area. The reader's job is to turn a card swipe, tap or PIN into data and pass it along. The wire between them is therefore the interface that matters most. Anyone who can tap that wire, or replace the reader with a device that mimics it, may be able to open the door or collect credentials without ever holding a valid card.
Two protocols dominate the connection. Wiegand is decades old, simple and nearly universal, which is why almost every reader supports it. OSDP, the Open Supervised Device Protocol, is a newer open standard that adds two-way communication, supervision and encryption. Understanding the difference helps when you specify new readers, retrofit an old system, or judge the risk of a legacy installation that is still working fine but may be easier to attack than anyone realizes.
How does Wiegand work, and what is the 26-bit format?
A Wiegand reader uses two data wires, usually called Data 0 and Data 1, plus a ground, alongside power and control lines. Both data lines idle at a high voltage. To send a zero, the reader briefly pulls Data 0 low; to send a one, it pulls Data 1 low. The controller counts these short pulses and builds a string of bits. There is no addressing, no acknowledgment and no clock, just pulses in sequence in one direction.
The common 26-bit format has one leading even parity bit, an eight-bit facility code, a sixteen-bit card number, and one trailing odd parity bit. Parity only catches simple errors. The facility code identifies a site or batch and the card number identifies the individual, so a controller can only distinguish a limited number of unique cards per facility. Many other formats exist, longer and with different field layouts, so reader and controller must be configured to agree. The data is plain, with no encryption and no authentication.
What are the weaknesses and wiring limits of Wiegand?
Because Wiegand carries the credential number in the clear, anyone who can reach the wires can read it. A device hidden behind a reader can log every number and replay it later, and a cloned card can be built from a captured number. Cutting the cable or swapping the reader for a rogue unit is not detected, since there is no supervision. The reader also cannot be configured or updated over the wire, and feedback such as lights and beeps needs separate control wires.
Wiring is point to point: each reader needs its own cable back to a controller, typically a multi-conductor shielded cable carrying power, the two data lines, and LED and buzzer control. Pulses degrade with length, noise and poor shielding, so Wiegand has a practical cable length limit of a few hundred feet, which differs by manufacturer. Keep runs short, use shielded cable with the shield grounded at the controller end only, and separate it from power wiring to avoid false reads.
How does OSDP work over RS-485?
OSDP replaces the pulses with proper serial messages on RS-485, a differential pair of wires where the signal is the voltage difference between the two, which resists noise and allows long runs. It is half-duplex: the controller polls each reader and the reader answers, so communication is two-way. Several readers can share one bus, each with its own address, and runs can be considerably longer than Wiegand. Cable is typically shielded twisted pair, with termination and proper topology following RS-485 practice, often a daisy chain instead of branching stubs.
Because the controller keeps polling, it knows when a reader stops answering, which is called supervision, so a cut cable or a removed reader raises an alarm. The protocol can carry far more than a card number: it supports display and LED commands, tamper status, firmware updates, biometric templates and larger credential data. It is an open standard published through an industry association and adopted internationally, which supports interoperability between different makers' readers and controllers, though feature support should be checked.
How does OSDP secure the connection?
OSDP includes an optional Secure Channel that encrypts messages with AES and authenticates both ends. The reader and controller derive session keys from a shared base key, using random challenges so each session differs, which defeats simple replay. An eavesdropper on the bus sees ciphertext, and a counterfeit reader without the key cannot join. Message integrity checks also detect tampering. Together these features address the biggest weaknesses of Wiegand: eavesdropping, replay and undetected substitution of the reader, though only when the secure channel is actually switched on.
The security still depends on how it is deployed. A reader installed with the default key can be re-enrolled by an attacker, so a unique key must be provisioned. Some readers support only unencrypted OSDP, and the controller must be configured to require the secure channel. The credential itself matters too: a cloneable card read by an OSDP reader is still cloneable at the card, not the wire. Treat OSDP as protecting the cable between reader and controller, and choose credentials that also resist copying.
Which should you choose for a gate or remote site?
For new work, OSDP is generally the better choice: it supports supervision, encryption, longer runs and remote configuration, and it lets a single cable serve several readers. Wiegand remains common because millions of readers and controllers are installed, and a retrofit may be constrained by existing hardware. Many modern readers can speak both, which allows a staged upgrade. Where a gate or enclosure is exposed, the reader is the easiest thing to reach, so protecting the link matters.
At a remote or temporary site, such as a trailer-mounted gate, a construction entrance or a ballot drop box area, consider power, weather and physical access as well as protocol. Keep the controller and wiring inside a locked enclosure, run short protected cables, and log door events. If a site needs it, those events can be forwarded over cellular to a monitoring platform so a person can review them alongside video. Always follow local electrical and life safety codes for locks and egress.
Key terms
- Wiegand
- A legacy interface where a reader sends credential bits as short pulses on two data wires, one way, without encryption.
- OSDP
- The Open Supervised Device Protocol, an open serial standard that gives readers and controllers two-way, supervised, optionally encrypted communication.
- RS-485
- A differential serial signaling standard that tolerates noise and long cable runs, allowing several devices to share one bus.
- Facility code
- A number in the card data identifying a site or batch of cards, used with a card number to identify a credential.
- Secure Channel
- The OSDP mode that encrypts messages with AES and authenticates reader and controller with session keys.
- Supervision
- The controller's ongoing polling of connected devices, which lets it detect and alarm on missing, unplugged, cut or tampered readers.
- Parity bit
- An extra bit used to detect simple transmission errors in a data string; it does not provide security.
A site that controls a gate or door has a reader, a controller, and a lock, with the controller making the unlock decision. If a site needs it, door and reader events can be sent as webhook or gateway events to a monitoring platform, where an operations center can review them with video. A trailer like this has cellular connectivity and DC power, which suit a small controller in a locked enclosure, but wiring and codes remain site-specific.
Common questions
Is Wiegand still safe to use?
It works, but it sends credential numbers in the clear and cannot detect a cut cable or a swapped reader. Keep runs inside secured spaces, protect the reader area, and plan an upgrade to supervised, encrypted OSDP where risk justifies it.
Can I mix OSDP and Wiegand?
Yes, often. Many readers support both, so you can wire them as Wiegand now and switch to OSDP when the controller is ready. A single system can mix them, but each reader still needs the correct mode and wiring.
How far can an OSDP reader be from the controller?
Further than Wiegand, because RS-485 is built for long runs, but the limit depends on cable quality, speed, termination and the number of devices. Follow the manufacturer's wiring guide instead of assuming a single maximum.