How Remote Entry Works

The two most common remote keyless-entry devices are:

Some home security systems also have remote controls, but these are not so common.

The fob that you carry on your keychain or use to open the garage door is actually a small radio transmitter. When you push a button on the fob, you turn on the transmitter and it sends a code to the receiver (either in the car or in the garage). Inside the car or garage is a radio receiver tuned to the frequency that the transmitter is using (300 or 400 MHz is typical for modern systems). The transmitter is similar to the one in a radio-controlled toy. See How Radio Works for details on radio waves and radio transmitters.

In the very early days of garage door openers, around the 1950s, the transmitters were extremely simple. They sent out a single signal, and the garage door opener responded by opening or closing. As garage door openers became common, the simplicity of this system created a big problem -- anyone could drive down the street with a transmitter and open any garage door! They all used the same frequency and there was no security.

By the 1970s, garage door openers had gotten slightly more sophisticated. You can see this level of sophistication in the photos below. The first shows a controller chip (black) and a DIP switch (blue). A DIP switch has eight tiny switches arranged in a small package and soldered to the circuit board. By setting the DIP switches inside the transmitter, you controlled the code that the transmitter sent. The garage door would only open if the receiver's DIP switch were set to the same pattern. This provided some level of security, but not much. Eight DIP switches provide only 256 possible combinations. That's enough to keep several neighbors from opening each other's doors, but not enough to provide any real security.

The transmitters in these circa-1970 garage door openers were also very simple:

As you can see, the transmitter consisted of two transistors and a couple of resistors, and not much else. A two-transistor transmitter like this, powered by a 9-volt battery, is as simple as a radio transmitter gets. It's the same transmitter that you find in a $10 pair of low-power walkie-talkies.

Remote-entry transmitters have gotten a lot more sophisticated since then. Let's take a look at a modern setup.

With the remote keyless-entry systems that you find on cars today, security is a big issue. If people could easily open other people's cars in a crowded parking lot at the mall, it would be a real problem. And with the proliferation of radio scanners, you also need to prevent people from "capturing" the code that your transmitter sends. Once they have your code, they can simply re-transmit it to open your car.

The photo below shows you the guts of a typical key-ring controller for a modern car:

You can see that everything has been miniaturized. There is a small chip that creates the code that gets transmitted, and the small silver can (about the size of a split pea) is the transmitter.

The controller chip in any modern controller uses something called a hopping code or a rolling code to provide security. For example, if you read this PDF, it describes a system that uses a 40-bit rolling code. Forty bits provide 2⁴⁰ (about 1 trillion) possible codes. Here's how it works:

So, what do you do if your three-year-old child DOES desynchronize your transmitter by pushing the button on it 300 times, so that the receiver no longer recognizes it? Most cars give you a way to resynchronize. Here is a typical procedure:

Given a 40-bit code, four transmitters and up to 256 levels of look-ahead in the pseudo-random number generator to avoid desynchronization, there is a one-in-a-billion chance of your transmitter opening another car's doors. When you take into account the fact that all car manufacturers use different systems and that the newest systems use many more bits, you can see that it is nearly impossible for any given key fob to open any other car door.

You can also see that code capturing will not work with a rolling code transmitter like this. Older garage door transmitters sent the same 8-bit code based on the pattern set on the DIP switches. Someone could capture the code with a radio scanner and easily re-transmit it to open the door. With a rolling code, capturing the transmission is useless. There is no way to predict which random number the transmitter and receiver have chosen to use as the next code, so re-transmitting the captured code has no effect. With trillions of possibilities, there is also no way to scan through all the codes because it would take years to do that.