How to Read User Memory Information from RFID Reader: Accessing Custom Data on Tags

You can read RFID tag IDs all day. That is the easy part. But the tag has more to give—user memory. That is where the real data lives. Maintenance history, expiration dates, destination codes, authentication tokens.

Here is the thing. When people search how to read user memory information from RFID reader, they usually discover that most tutorials stop at reading the EPC. User memory is different. It requires targeting specific memory banks, sometimes passwords, and understanding how the tag organizes data.

Let me walk through what user memory actually is and how to read it.

First: What Is User Memory?

RFID tags have multiple memory areas. The EPC (Electronic Product Code) is just one of them . User memory is separate space where you can store custom information .

For UHF RAIN RFID tags (ISO 18000-6C), there are four memory banks :

Bank	Name	What It Stores
00	Reserved	Kill password and access password
01	EPC	Electronic Product Code—main identifier
10	TID	Tag Identifier—factory programmed, unique per tag
11	User	User memory—size varies by tag type

For HF tags (Mifare, NTAG, ICODE), user memory is organized into sectors and blocks . A Mifare 1K tag has 16 sectors, each with 4 blocks. The last block of each sector is the trailer containing access keys. The other blocks can store user data.

Not every tag has user memory . Some cheap UHF tags only have EPC and TID. Check the tag datasheet before you assume user memory exists.

Why User Memory Matters

User memory solves real problems :

Offline operations: Write destination store numbers directly to tags on pallets. Warehouse workers read the tag and know where it goes without checking a database .

Authentication: Write random serial numbers to user memory when pharmaceuticals are produced. Pharmacists verify against manufacturer database to confirm legitimacy .

Maintenance history: Specialized tags with 32KB user memory store complete history of airplane parts. Mechanics read the tag and get instant access to maintenance records .

Work-in-progress tracking: Write current production stage to tags on manufacturing line. Readers at each station update the data.

Method 1: Read User Memory with CYKEO SDK

The simplest way how to read user memory information from RFID reader is using an SDK that handles the low-level commands.

CYKEO Python SDK for UHF tags:

python

from cykeo_sdk import UHFReader

# Connect to reader
reader = UHFReader("192.168.1.100")
reader.connect()

# Start inventory to find tags
def on_tag(tag):
    print(f"Found tag EPC: {tag.epc}")
    
    # Read user memory from this tag
    # Parameters: tag EPC, memory bank, start word, word count
    # Word = 2 bytes (16 bits)
    user_data = reader.read_tag_memory(
        epc=tag.epc,
        memory_bank="USER",
        offset=0,        # start at word 0
        length=8         # read 8 words (16 bytes)
    )
    
    if user_data:
        print(f"User memory (hex): {user_data.hex()}")
        
        # If data is ASCII text
        try:
            text = user_data.decode('ascii')
            print(f"User memory (text): {text}")
        except:
            pass

reader.on_tag_read = on_tag
reader.start_inventory()

CYKEO Android SDK for UHF handhelds :

java

// Initialize reader from CYKEO CK-B3L or CK-B5L
UHFReader reader = new UHFReader(context);
reader.connect();

// Set tag listener
reader.setTagReadListener(new TagReadListener() {
    @Override
    public void onTagRead(TagRead tag) {
        String epc = tag.getEpc();
        
        // Read 16 bytes from user memory starting at word 0
        byte[] userData = reader.readTagMemory(
            epc, 
            MemoryBank.USER, 
            0,  // offset in words
            8   // length in words (16 bytes)
        );
        
        if (userData != null) {
            Log.d("CYKEO", "User data: " + bytesToHex(userData));
            
            // Update UI
            runOnUiThread(() -> {
                textView.setText("User: " + bytesToHex(userData));
            });
        }
    }
});

reader.startInventory();

Method 2: Read User Memory with Commands (Raw Approach)

If you are working without an SDK, you need to send specific commands to the reader.

For CYKEO readers using serial/TCP protocol :

text

#RD USER,0,8

This command reads 8 words (16 bytes) from user memory starting at word 0 . The reader responds with hex data.

Using a terminal program :

1. Connect to reader via serial (COM port) or TCP (IP address + port)
2. Configure baud rate (often 115200 or 9600) 
3. Send inventory command: #INV
4. When tag appears, send read command: #RD USER,0,8

The response might look like: A1B2C3D4E5F6A7B8C9D0E1F2A3B4C5D6

Important: For the E710 UHF module, you must specify the correct read length based on tag specification . The read length cannot be configured as “0” .

Method 3: Read User Memory from HF Tags (Mifare)

HF tags work differently. They require authentication before reading user data .

CYKEO HF SDK example:

python

from cykeo_sdk import HFReader

reader = HFReader("COM3")
reader.connect()

def on_card(card):
    print(f"Card UID: {card.uid.hex()}")
    
    # Authenticate to sector 1 using default key
    # (production cards use custom keys)
    if card.authenticate(sector=1, key_type="A", key="FFFFFFFFFFFF"):
        # Read block 4 (first block of sector 1)
        # Each block is 16 bytes
        data = card.read_block(4)
        print(f"User data block 4: {data.hex()}")
        
        # Read multiple blocks
        blocks = card.read_blocks(start_block=4, count=3)
        for i, block_data in enumerate(blocks):
            print(f"Block {4+i}: {block_data.hex()}")

reader.on_card = on_card
reader.start_reading()

For HF tags, the access password is required to acquire user data stored in the user memory bank .

Method 4: Using Configuration Software

Sometimes you do not need to code. CYKEO Tag Manager software handles user memory access through a graphical interface.

Steps in CYKEO Tag Manager:

1. Connect reader and select “Tag Detail” 
2. Click “GET EPC” to read a tag
3. Navigate to the “USER” tab 
4. Set “Read Offset (Words)” and “Read Length (Words)” 
5. Enter access password if required 
6. Click “READ” to fetch user memory
7. Data appears in “User Binary (HEX)” field 

The software automatically handles the commands and shows you the raw hex data.

Understanding Access Passwords

User memory is often protected by access passwords. You cannot read it without the correct password .

Reserved memory bank (Bank 00) stores two passwords :

• Kill password: 32 bits (4 bytes), permanently deactivates the tag
• Access password: 32 bits (4 bytes), controls read/write access to memory banks

Default access password is usually 00000000 in hexadecimal . Production systems should change this.

To read user memory on a password-protected tag:

python

# First, authenticate with access password
reader.send_command("access_password=12345678")

# Then read user memory
user_data = reader.read_user_memory(epc, offset=0, length=8)

For HF tags like Mifare, each sector can have its own keys. The last block of each sector (sector trailer) contains Key A, Key B, and access conditions .

Lock Status and Permalock

Some tags have memory that is permanently locked :

• Locked memory: Cannot be overwritten, but can still be read
• Permalocked: Lock status is permanent—cannot be changed
• Read-protected: Some memory banks can be configured to block reads entirely 

The Gen2 standard supports permalock features that make lock status permanent for all or part of tag memory .

Common Problems When Reading User Memory

Problem: User memory reads as all zeros

• Tag may not have user memory 
• User memory might be empty (never written)
• Wrong offset—data starts at different location

Problem: Command returns no data or error

• Access password required 
• Read length exceeds available memory
• Tag not responding—try moving closer

Problem: Some tags read, some don’t

• Different tag models have different user memory sizes
• Some tags may have user memory locked
• Older tags may not support user memory access

Problem: Data reads as garbage

• You are reading raw binary data that needs interpretation
• Data might be encrypted 
• Wrong offset—reading wrong part of memory

Problem: Authentication fails

• Wrong password/key 
• Access conditions changed from defaults
• Tag is permanently locked

Real Example: Warehouse Shipping

Here is how a food distributor in Netherlands uses user memory :

The challenge: 200 pallets per hour need to be routed to correct loading doors. Looking up each destination in database slows workers down.

The solution:

1. At packing station, worker writes destination store number to tag’s user memory
2. Pallet moves down conveyor
3. Fixed readers at each junction read the user memory
4. Store number tells conveyor which direction to send pallet
5. No database lookup required—all data on the tag

Code snippet from their system:

python

# At packing station - write destination
def write_destination(epc, store_number):
    # Convert store number to bytes (e.g., "STORE42" -> ASCII)
    data = store_number.encode('ascii').ljust(16, b'\x00')
    reader.write_tag_memory(epc, "USER", 0, data)
    print(f"Written {store_number} to tag {epc}")

# At sorting junction - read destination
def on_tag(tag):
    user_data = reader.read_tag_memory(tag.epc, "USER", 0, 8)
    if user_data:
        destination = user_data.decode('ascii').strip('\x00')
        print(f"Send pallet to {destination}")
        conveyor.set_direction(destination)

User Memory Size by Tag Type

Different tags have different user memory capacities:

Tag Type	User Memory Size
Standard UHF (ALN-9740)	128 bits (16 bytes)
High-memory UHF (Tego)	Up to 32KB
Mifare Classic 1K	752 bytes (excluding sectors 0 and trailers)
Mifare Classic 4K	3440 bytes
ICODE SLIX	112 bytes
NTAG213	144 bytes

Check your tag datasheet before writing code.

Security Considerations

When storing sensitive data in user memory :

Use access passwords: Protect user memory with strong passwords. Change from defaults.

Consider encryption: For highly sensitive data, encrypt before writing to tag. The tag cannot encrypt for you—encryption happens in reader or middleware .

Lock when appropriate: Once data is written, consider locking user memory to prevent tampering.

Manage keys carefully: Access passwords need secure storage and management .

Testing User Memory Read/Write

Before deploying, test the full cycle :

1. Write known data to user memory
2. Read it back to verify
3. Test with different offsets and lengths
4. Try with access password enabled

python

# Test write and read
test_data = bytes.fromhex("A1B2C3D4A5B6C7D8")
reader.write_tag_memory(epc, "USER", 0, test_data)

read_back = reader.read_tag_memory(epc, "USER", 0, len(test_data)//2)
assert read_back == test_data, "Write/read verification failed"
print("User memory test passed")

The Bottom Line

How to read user memory information from RFID reader comes down to three steps:

1. Identify if your tag has user memory and its size
2. Authenticate if the memory is password protected
3. Target the USER memory bank with correct offset and length

Most people fail because they never move past reading EPC. User memory requires explicit commands and sometimes passwords. But once you have it working, the possibilities expand—offline data, authentication, rich item history.

CYKEO readers and SDKs handle the complexity. Our CK-B3L handheld  and CK-B5L Bluetooth reader both support full user memory access across UHF and HF tags.

Start with the Tag Manager software to see what is on your tags. Then move to SDK for automation. And when you get stuck, CYKEO support has seen every user memory quirk there is.

---

Need to read user memory in your application?
CYKEO offers SDKs for Python, Java, C# with full user memory support. Contact our team for developer samples and documentation.