Reader mode

Reader mode exposes the shared PN532 interface and PN532Killer's additional ISO/IEC 15693 support.

Start a session

Connect to the device

pn532> hw connect

Searches serial ports and identifies the device as PN532 or PN532Killer.

Read device information

pn532> hw version

On PN532Killer, return to Reader mode before issuing reader commands:

Enter Reader modePN532Killer

pn532> hw mode r

Returns PN532Killer to PN532-compatible reader operation before tag commands are issued.

ISO/IEC 14443 A

Identify a tag before performing any authenticated or write operation:

Scan an ISO/IEC 14443 A tagPN532 + PN532Killer

pn532> hf 14a scan

Performs a non-destructive scan and reports the detected tag identity.

For protocol research, hf 14a raw exposes framing, CRC, timeout, and response options. Use debug on to inspect host/device traffic.

MIFARE Classic

Read one known block or create a backup using authorized keys:

hf mf rdbl --blk 4 -a -k FFFFFFFFFFFF
hf mf dump -k keys.json --file classic.json --bin classic.bin

Use hf mf wrbl only after checking the block number and access conditions. Sector trailers and block 0 need particular care.

MIFARE Ultralight and NTAG

hf mfu rdbl -b 4
hf mfu dump --file tag.json --bin tag.bin

The stable main branch also exposes high-level ntag read and ntag write NDEF commands. They are not registered in the current beta dev command tree, so use hf mfu on beta or switch to the stable channel for those helpers.

ISO/IEC 15693 — PN532Killer

hf 15 scan
hf 15 info

The hf 15 group also contains block read/write, dump, raw, magic-tag, and emulator commands. Enter hf 15 or a subcommand for its installed-version help.

Reliable positioning

Center one tag over the antenna and keep metal, batteries, and unrelated tags away from the field. Read and save a backup before writing, then verify the changed data with another read.