ChameleonUltra by ProxGrind is a pocket-sized, open-source RFID and NFC tool that works as a cloner, copier and emulator in one device. Built on the powerful NRF52840 chip, it is the successor to the ChameleonMini and ChameleonTiny - smaller, faster and far more capable.
Whether you are a penetration tester auditing access control, a security researcher, or a hobbyist exploring RFID, the ChameleonUltra can clone key fobs and access cards, emulate both high-frequency (13.56 MHz) and low-frequency (125 kHz) tags, and store 8 card slots you can switch between instantly with the two buttons. We ship it fast from within the EU. Below: what it does, how it compares to the Flipper Zero and Proxmark3, full specs, and the most common questions answered.
What is the ChameleonUltra?
The ChameleonUltra is an open-source RFID/NFC device that behaves like a real contactless card or key fob - and like a reader. Because the emulation runs on the NRF52840's built-in NFC unit, it starts up and answers a reader in milliseconds, so it reliably opens even low-power, battery-operated door locks that older MCU-based emulators struggle with. It talks to your phone or computer over both USB-C and Bluetooth LE (BLE 5.0).
How the ChameleonUltra works
Clone / copy. Read a supported card or key fob, then write that data to the Chameleon's memory or to a blank tag - a straightforward way to make a working RFID copy when you own the original.
Emulate. Load up to 8 different card profiles and switch between them on the fly. The ChameleonUltra acts as a full RFID emulator, presenting itself to a reader exactly like the original card, including a customizable UID, SAK, ATQA and ATS.
Analyse & attack. The onboard MFRC522 reader chip lets the Ultra read and write HF 14443A tags and run MIFARE Classic key-recovery attacks - MFKEY32 V2, Darkside, Nested, StaticNested and HardNested - to audit weak card security.
What cards and key fobs can it clone?
The ChameleonUltra is a versatile key fob copier and access-card cloner. On the high-frequency 13.56 MHz side it handles MIFARE Classic 1K/2K/4K, MIFARE Ultralight / Ultralight C / EV1, and NTAG 21x - the chips behind most office badges and apartment fobs. On the low-frequency 125 kHz side it reads and emulates EM410x, T5577, HID Prox, Indala, FDX-B, Paradox, Keri, AWID, ioProx and many more.
Because the firmware is open source and community-driven, the list of supported cards keeps growing with every release. Note: sniffing is not supported, and DESFire is limited to low bitrate only.
ChameleonUltra vs Flipper Zero vs Proxmark3
People often ask how the Chameleon Ultra compares to the Flipper Zero. Short answer: the Flipper Zero is a broad multi-tool (sub-GHz, infrared, GPIO and more), while the ChameleonUltra is a specialist - it is a much stronger RFID/NFC emulator, with faster MIFARE emulation and a fuller set of cracking attacks. The Proxmark3 is the classic research workhorse but is bigger and needs a host.
| Feature | ChameleonUltra | Flipper Zero | Proxmark3 |
|---|
| Full MIFARE Classic emulation | Yes | Partial | Yes |
| ISO14443A read / write | Yes | Partial | Yes |
| LF 125 kHz read + emulate | Yes | Yes | Yes |
| Darkside / Nested / HardNested attacks | Yes | No | Yes |
| Relay attack | Yes | No | Yes |
| Emulation speed (opens low-power locks) | Excellent | Weak | Good |
| Pocket size / standalone | Yes | Yes | No |
| Bluetooth LE control | Yes | Yes | No |
If your focus is card cloning, emulation reliability and MIFARE research, the ChameleonUltra is the sharper tool. Many people own both and pair the ChameleonUltra with a Flipper Zero for full coverage.
ChameleonUltra specifications
| Chip | Nordic NRF52840 (ARM Cortex-M4F, 256 KB RAM, 1 MB Flash) |
| HF reader chip | MFRC522 (read/write 13.56 MHz 14443A tags) |
| High frequency | 13.56 MHz - MIFARE Classic 1K/2K/4K, Ultralight/C/EV1, NTAG 21x |
| Low frequency | 125 kHz - EM410x, T5577, HID Prox, Indala, FDX-B and more (ASK/FSK/PSK) |
| Card slots | 8 switchable profiles, indicated by 8 LEDs |
| Connectivity | USB-C (data + charging) and Bluetooth LE 5.0 |
| MIFARE attacks | MFKEY32 V2, Darkside, Nested, StaticNested, HardNested, relay |
| Battery | Rechargeable LiPo - months of everyday use per charge |
| Dimensions | 2.4 cm x 4 cm x 8 mm |
| In the box | ChameleonUltra, USB cable with removable USB-C end, 3.5 hex screwdriver, 2 spare screws, keychain, leather protective case |
| License | Open source (GPLv3), community firmware |
The box also includes a leather protective case with an embossed ProxGrind logo - it keeps your ChameleonUltra scratch-free and easy to carry on a keyring.
Software, app and firmware
You control the ChameleonUltra over USB-C or Bluetooth. There is an official command-line interface (CLI), community GUI apps for desktop, and mobile apps that connect over BLE - so you can manage slots, read cards and run attacks straight from your phone. The firmware is open source and updated regularly, which keeps adding card types and features over time. Full documentation, the CLI, GUI and firmware are maintained by the community on the official project wiki.
