Clocking in with an NFC card
Hold the card in front of the terminal, and clocking in and out alternate by themselves. The card carries only a number, and even that is not stored in the clear. No fingerprint, no face image, no phone of your own needed.
What is on the card, and what of it gets stored
The most common worry about card systems is what is on that piece of plastic. With MetronHR it is exactly one number.
| Where | What sits there |
|---|---|
| On the card | A number. No name, no photo, no working time, no balance. |
| On the terminal | The first name for the receipt and the link between card and person. No surname, no photo. |
| In the system | A check value of the card number (HMAC), from which the number cannot be calculated back. The raw value is not stored. |
| In the entry | The time, the device, the person, a running number and the hash of the previous entry. No location. |
On the card
- What sits there
- A number. No name, no photo, no working time, no balance.
On the terminal
- What sits there
- The first name for the receipt and the link between card and person. No surname, no photo.
In the system
- What sits there
- A check value of the card number (HMAC), from which the number cannot be calculated back. The raw value is not stored.
In the entry
- What sits there
- The time, the device, the person, a running number and the hash of the previous entry. No location.
As of 4 September 2026, checked against the data model and the terminal connection of the software.
The card is an identifier, not a credential
This is the point most vendors stay quiet about, and it decides how seriously a card system should be taken. Many common card types can be copied: 125 kHz EM cards in seconds, MIFARE Classic counts as broken, and with a DESFire card from which only the number is read, its encryption does not help.
MetronHR therefore builds nothing on a card being forgery-proof. It says who claims to be standing in front of the device. What follows from that is decided by the server from the role in the system, never by anything sitting on the device or on the card. At the terminal itself only clocking is possible: no reports, no personnel data, no settings.
- An attempt with an unknown or blocked card is logged and creates no attendance.
- Every entry carries a running number per device and the hash of its predecessor. A gap shows up.
- The same entry cannot arrive twice, not even after a network outage.
- Who assigned which card to which person and when is in the administration log, in every plan.
Card, app or browser, in the same business
The card is one of three routes, not the only one. Anyone at a computer clocks in the browser, anyone out and about in the app for iOS and Android. The three routes can be mixed, and nobody needs a private device.
Frequent questions about the card
What we are asked most often about the NFC card.
A number, nothing else. No name, no photo, no balance, no working time. The link between that number and a person lives in the system, not on the card. Whoever finds the card is holding a number.
Not in the clear. What is stored is an HMAC, a check value formed with a key, from which the number cannot be calculated back. The raw value exists only at the moment the card is held up, on the device and in the request to the server.
With many card types yes, and we claim nothing else. 125 kHz EM cards are cloned in seconds, MIFARE Classic counts as broken, and with a DESFire card from which only the number is read, its encryption does not help. That is why MetronHR treats the card as an identifier and not as a credential: it says who claims to be standing in front of the device. Whether somebody may do something is decided by the server from the role in the system. At the terminal only clocking happens, nothing more is possible there.
The terminal buffers the entries and delivers them once it is reachable again. Every event carries a running number per device, the hash of its predecessor and a check value of its own. A gap in that chain therefore shows up, and the same entry cannot arrive twice.
As a rule yes. We can only say for certain once we have seen one of your cards, and that is exactly what we do before you order. A blanket promise covering all card types would not be provable.
The card is blocked in the system and a new one is assigned. An attempt with a blocked or unknown card is logged but creates no attendance. Who assigned which card to which person and when is in the administration log, and that exists in every plan.
Only for those who are meant to clock at the terminal. Anyone working at a computer anyway uses the browser, anyone out and about uses the app. The three routes stand side by side and can be mixed in the same business.
Question not answered here? Every step is explained in the help centre.
Hold up the card, and the time is in the system.
Try it free for 14 days, no credit card. For the terminal we talk about your existing cards first.
No credit card, cancel any time
Related
Where to go from here, and what waits for you there.
Without a phone
Clocking in without a company phone and without a private device
The card is the technical answer. The answer for the business sits beside it: which route fits which working situation.
See Without a phoneDigital time clock
The device on the wall, thought through from the punch clock.
View