Mobile access control: NFC vs. BLE vs. QR codes

Mobile access control, where the user opens doors with their mobile device, typically works with two primary technologies, namely Near Field Communication (NFC) and Bluetooth Low Energy (BLE). This article discusses the pros and cons of each. It will also look at the viability of QR codes as a mobile access control method.
 

NFC pros and cons

 
NFC typically works with the mobile wallet app, such as Apple Wallet or Google Wallet, on the user’s smart device. The technology offers a tap-to-enter experience that most users are already familiar with.
 
“NFC, which is how wallet credentials are read, wins on user experience and assurance. It is the tap people already understand from payments, it works with the phone locked, and with Express Mode the user does not even unlock the phone. Apple's power reserve keeps it working for a window even after the battery dies,” said Matt Bennett, SVP of Digital Transformation at Alert Enterprise.
 
NFC’s short-read range, typically at 2 to 4 cm, also makes the technology secure as accidental or unintentional unlocking can be prevented.
 
“NFC offers several advantages for mobile access control. One of the biggest benefits is that it requires intentional interaction, as users must physically tap their device to unlock a door. This helps reduce accidental or unintended credential reads. In addition, the short read range, combined with encrypted credential exchanges, supports a deliberate and controlled access experience,” said Aaron McGhee, Senior Product Manager at Interface Systems.
 
However, NFC does have some disadvantages. Deployment may require hardware and software upgrades, which can be perceived as costly. Platform compatibility can also be an issue, as features and capabilities may vary across operating systems and device manufacturers, increasing support complexity.
 
“NFC wallet solutions can involve higher commercial and integration requirements, and compatibility must be considered carefully across iOS, Android, regional Android variants, Huawei HarmonyOS and different wallet ecosystems. Projects may also require wallet-capable reader modules and specific deployment arrangements,” said Raymond So, GM of Armatura.
 

BLE pros and cons

 
With BLE, the user is issued a mobile credential that is typically stored in a dedicated app on the phone. The technology offers a longer read range, which can be up to 1 to 3 meters in hands-free mode. This then makes BLE a major draw, especially for organizations where longer read ranges are ideal.
 
“BLE, typically delivered through a vendor app, can support longer-range or touchless access experiences. That can be useful in some environments, such as garages, gates, or areas where hands-free access is desired,” said Kumar Sokka, CEO of Acre Security.
 
“Bluetooth is a great fit for high-traffic or hands-free environments. Organizations can configure BLE to enable hands-free unlock, allowing users to unlock a door by approaching the reader and making a natural gesture, like a hand wave. Time-of-flight sensors confirm a user is standing directly in front of the reader – not just nearby – so convenience doesn't come at the cost of security,” said Manas Baba, Senior Manager of Product Marketing at Verkada.
 
The downsides are that the user needs to download and maintain an app. The longer read range may also trigger accidental or unintentional door unlocking. The system may need to be fine-tuned to prevent that, and this can add friction to the user experience.
 
“BLE … allows users to unlock doors and barriers from a greater distance using their smartphones. While this added convenience is valuable, the longer read range can introduce additional security considerations compared to close-range interactions like NFC. Configuration is typically managed through a dedicated mobile app, which may require an initial setup step for users,” said Julia Bruzzese, Product Marketing Manager at Genetec.
 

QR Codes

 
Increasingly, QR codes are also used as a method for mobile access control, where the user receives a QR code to be scanned by the reader. QR codes offer a viable access control solution for the right use scenarios, mainly temporary visitor or contractor access where low cost and easy issuance are prioritized.
 
“QR codes are also a fully viable method for access control, especially for temporary and guest access. QR is ideal for visitors and other users who should not be required to install an app for one-time or occasional entry: QR codes can be delivered by email configured with time-limited validity leaving a complete audit trail without any physical card to issue or collect. In a multi-credential strategy, that means biometrics secure the highest-risk points, mobile replaces day-to-day cards for regular users, and QR takes care of visitors and short-term access,” said Erik Cornelius, Product Lead of BioStar Air at Suprema.
 
It should be noted that static QR codes can be screenshotted, forwarded or shared. Dynamic QR codes, on the other hand, address some of those security issues.
 
“Static QR codes should not be considered secure enough for most professional access control applications. However, dynamic QR codes with encryption, time-based refresh, expiration control and server-side authorization can be very useful for visitors, contractors, temporary staff, delivery personnel and mobile fallback scenarios,” So said.
 

Deployment depends on use case

 
NFC, BLE and QR codes each have unique characteristics and advantages. Choosing which one to deploy ultimately depends on the end user entity’s own needs and requirements.
 
“Each technology has its own strengths. NFC provides a simple and secure tap-to-open experience, making it ideal for applications where security is the highest priority. BLE offers a more convenient hands-free experience with a longer reading distance, which is especially useful in high traffic environments. On the other hand, the QR codes are cost-effective and work well for visitor or temporary access, but they are generally less secure than NFC and BLE. Overall, we believe NFC and BLE will remain the primary technologies for enterprise mobile access control,” said Jay Jeong, Deputy GM at CMI TECH.
 
In fact, most organizations now support both NFC and BLE and match the protocol to the opening rather than choosing one across the board.
 
“Mobile credentials can be presented to a reader either via NFC or BLE, and in practice the end user should not need to care which technology is being used. Suprema devices support both methods and are tuned so that mobile access feels natural and reliable in daily use on both Android and iPhone, making mobile the ideal path for organizations that want to phase out plastic RFID cards without changing user habits too drastically,” Cornelius said.