The radio fob that replaced the key, how it is programmed, and why its security weaknesses have shaped every generation since.
A remote keyless system is an electronic lock that uses a handheld radio fob to lock, unlock and sometimes start a car within a few yards. Patented by Paul Lipschutz in 1981, it reached cars in 1982 and later added passive entry and rolling codes against theft.
A remote keyless system lets a driver lock, unlock and sometimes start a car with a button on a handheld fob, without taking a key out of a pocket or bag. The technology was patented in 1981, reached cars in the early 1980s, and has since developed into passive and phone-based systems. Its security weaknesses have shaped how it has evolved since.
What is a remote keyless system?
A remote keyless system, also called remote keyless entry (RKE) or remote central locking, lets a remote control operate the locks on a car or building. Pressing a button within a few yards of the car can lock or unlock the doors. Some systems also start the engine, a feature called remote keyless ignition.
The remote performs the functions of a standard car key without any physical contact. Systems range from simple handheld fobs to touchless passive entry and smart key systems, which let the key stay in a pocket. Phone-as-a-key systems use an app instead of a fob.
Keypad entry, which came before these systems, uses buttons on the car's door or pillar instead of a remote. Remote keyless systems largely and quickly superseded keyless entry, which had tied locking and unlocking to vehicle-mounted keypads.
The fob replaced the key, but every convenience it added came with a new way for the car to be reached by someone else.
How does a key fob communicate with the car?
A key fob contains a short-range radio transmitter. When a button is pressed, it sends a coded signal to a receiver built into the vehicle body, which locks or unlocks the doors. The fob must be within about 5-20 meters (16-66 ft) of the car for the signal to work.
Most North American cars use 315 MHz, while European, Japanese and Asian cars mostly use 433.92 MHz. Earlier systems used infrared light instead of radio, as found on Mercedes-Benz, BMW and other makes. Infrared was superseded in 1995, when a European frequency was standardised.
Since the mid-1990s, systems have used encryption and rotating codes, so that a thief cannot simply copy a signal and reuse it. Each press produces a different code, which the car recognises. The car confirms its status through its lights, its horn, or both.
A typical chirp pattern gives the driver clear feedback. Two beeps can mean the driver door has unlocked, four beeps mean all doors have unlocked, a long beep signals the trunk or power tailgate, and a short beep confirms locking and arming of the alarm.
What can the buttons on a fob do?
The functions of a remote keyless entry system sit on a key fob or in the handle of the ignition key. Dedicated buttons lock and unlock the doors and open the trunk or tailgate. Some minivans can open or close their power sliding doors remotely, and some cars close open windows and the roof when they lock.
A red panic button on some fobs activates the car alarm as a standard feature. Convenience features include remote starting, which is useful in cold weather, and the ability to raise or lower convertible tops from outside the car while it is parked.
On cars with an electronically operated trunk release, a button on the remote can open it. Premium SUVs and estates with tailgates may have a motorised assist that opens and closes the tailgate. Offices and homes can link the system to a security system, a garage door opener or remotely activated lighting.
Who invented remote keyless entry?
Paul Lipschutz was granted the patent for remote keyless entry in 1981, after submitting it in 1979. He worked for Nieman, a supplier of security components to the car industry, and had already developed a number of automotive security devices.
His system used a handheld fob to send infrared data. It relied on a coded pulse signal generator and a battery-powered infrared emitter to operate an electrically actuated lock. In some areas the system became known as a PLIP system, or Plipper, after its inventor.
The first cars with a handheld transmitter followed in 1982, when the French-made Renault Fuego offered one. American Motors offered the system as an option in 1983 on several of its vehicles, including the Renault Alliance. The feature first became widely available in the United States on several General Motors vehicles in 1989.
How are key fobs programmed?
A fob emits a radio frequency with its own distinct digital identity code. Programming is a proprietary process, so it is typically carried out by the manufacturer. The car is put into programming mode, a fob button sends the identity code to the onboard computer, and the computer saves it.
Entering programming mode usually means cycling the car's power several times while holding a button or lever. The procedure can also involve opening doors or removing fuses, and it varies between makes, models and years. Once the code is saved, the car leaves programming mode.
A secondary market of unprogrammed fobs has grown up, and some websites sell steps for programming them on individual models. The rules have also changed over time. Early keyless remotes from 1998 to 2012 could be programmed by the user, but newer remotes from 2013 onward need a dealer or locksmith with special software.
What are passive keyless systems?
Passive keyless systems lock and unlock a car without any button press by the driver, and later versions can also start it without a key being inserted. General Motors pioneered the approach with its Passive Keyless Entry system on the 1993 Chevrolet Corvette, which still used a traditional keyed start.
Passive systems are now common, although the exact method differs between makes and models. In general the car unlocks as the driver approaches with the fob, and some models can start or stop the vehicle without a key being inserted.
Are remote keyless systems secure?
Not by default. Keyless ignition does not provide better security on its own, and the main risks are replay attacks, relay attacks and devices that capture a code. Rolling codes and encryption have made simple copying much harder, but weaknesses have still been found.
In October 2014, some insurers in the United Kingdom would not cover certain vehicles with keyless ignition unless additional mechanical locks were fitted. The problem was weaknesses in the keyless system itself.
A replay attack records the signal sent by a fob, using a specialised receiver known as a code grabber, and replays it later to open the door. To prevent this, the fob uses a rolling code produced by a pseudorandom number generator. The car's receiver runs a synchronised generator to recognise each code, and the fob encrypts the code so a thief cannot simulate the generator.
A relay attack uses radio repeaters to trick a car into thinking a fob is nearby when it is far away. Media reports have suspected such attacks, although no devices had been found. Suggested precautions include keeping fobs in aluminium foil or a freezer when they are not in use.
In 2015 Samy Kamkar built a device about the size of a wallet that could capture a keyless code for later use. It jammed the rolling code signals while recording two attempts. The first recorded code went to the vehicle on the owner's second attempt, and the second code was kept for future use. Kamkar's demonstration took place at DEF CON 23.
Thefts of luxury cars have been linked to this kind of exploit when the key fob sits near the front of the home. A criminal ring stole about 100 vehicles in Southern and Eastern Ontario using such techniques, and placing the fob in a tin box is one workaround.
What were keypad entry systems?
Keypad entry systems came before remote keyless systems. A code entered on a multi-button keypad on the driver door or pillar unlocked the driver door, and further presses could unlock all the doors, open the trunk or lock the vehicle from outside. No remote was needed.
Keypads allowed tiered or time-restricted permissions, so a code could allow entry without starting the engine. The code could be user programmed and changed if it was shared. Two hikers, for example, could leave the keys in the glove box and each return later with their own code.
Ford introduced its keypad system with physical buttons for the 1980 model year, on the Thunderbird, Mercury Cougar, Lincoln Continental Mark VI and Lincoln Town Car. It was marketed first as Keyless Entry, then as SecuriCode, and most recently as SecuriCode Invisible, which uses a capacitive touch pad that lights up on contact.
Ford offered a keypad on 90% of its vehicles as of 2019 and still offered it in 2025, more than forty years after its introduction. Its other systems, including fob and phone-based entry, have not displaced it. Buick's sixth generation Electra used a sill-mounted keypad from 1985 to 1988, and Nissan offered keypad technology on the 1984 Maxima, Fairlady, Gloria and Cedric.
How did remote keyless systems develop over time?
Remote keyless systems moved from infrared patents in 1981 to radio fobs, passive entry and tighter security within about four decades. Each step widened convenience, and each one also created new ways for the system to be attacked. The timeline below shows the main milestones.
| Year | Development |
|---|---|
| 1979 | Remote keyless entry submitted for patent by Paul Lipschutz |
| 1981 | Patent granted for the infrared remote keyless system |
| 1982 | Renault Fuego offers a handheld transmitter |
| 1989 | Remote keyless systems become widely available on several GM vehicles in the US |
| 1993 | GM Passive Keyless Entry debuts on the Chevrolet Corvette |
| 1995 | Infrared superseded when a European frequency is standardised |
| 1998 to 2012 | Early remotes can be programmed by the user |
| 2013 onward | Newer remotes need dealer or locksmith programming |
| October 2014 | Some UK insurers require extra mechanical locks on certain keyless cars |
| 2015 | Samy Kamkar demonstrates a keyless code capture device at DEF CON 23 |
What are the advantages and drawbacks of remote keyless systems?
The main benefit is convenience, because the car can be locked, unlocked and sometimes started from a few yards away. The drawbacks are mostly about security and the cost of programming. Owners should weigh both when judging how much protection a system provides.
Advantages:
- Locking and unlocking without taking out a key, from a short distance.
- Extra features such as remote trunk release, window closing and remote starting.
- Rolling codes and encryption make simple signal copying much harder.
- Passive systems let the key stay in a pocket or bag.
Drawbacks:
- Keyless ignition does not provide better security by default.
- Replay and relay attacks have been reported or suspected.
- Newer remotes from 2013 onward need dealer or locksmith programming.
- Some insurers have required additional mechanical locks on keyless vehicles.
