The Hardware Behind Skylanders, a Teardown

In 2011, Activision revolutionized the gaming industry with the release of Skylanders: Spyro’s Adventure, Activision's first entry in what was popularized as the "toys-to-life" genre. Combining collectible physical toys with digital gameplay, Skylanders introduced an innovative use of Near Field Communication (NFC) technology that allowed players to transfer character data between the physical and virtual worlds. The concept was wildly successful and by 2015, the franchise had generated over $3 billion in revenue and sold more than 250 million toy figures. However, after several years and multiple sequels, the market became saturated and interest waned.

Skylanders figures of each core elements and a portal of power.

This article takes a deeper look at the hardware that powered Skylanders’ innovative ecosystem, focusing on the technical aspects of the figurines, the Portal of Power, and their homebrew community that grew around the technology.

💡

This is an update to an article originally published in 2019. In the last 7 years, we've learned a lot about Skylanders. This article was updated to reflect these discoveries.

What is NFC?

Near Field Communication (NFC) is a short-range wireless technology that lets two devices exchange small amounts of data when held close together, usually within a few centimeters. It works by using a magnetic field: one device, like a payment terminal or smartphone, generates the field, and the other, like a contactless credit card or key fob, uses that energy to send information back. Because it is fast and does not require any setup, NFC is commonly used for tap-to-pay systems, digital tickets, and building access cards.

A closeup of the NFC tag of in Skylander figure. The black component is the actual chip and the silver spiral is the antenna.

NFC follows international standards that ensure devices can communicate reliably across brands and platforms. A typical NFC tag has a unique ID and a small amount of memory for storing data like account numbers or access codes. Since most tags are passive, they do not need batteries and only work when near a powered reader. This simplicity makes NFC well suited for secure, quick interactions without requiring buttons, menus, or physical connections. That said, NFC can also be used between two powered devices, like phones, thanks to its convenience and widespread standard support.

Inside the Skylanders Figures

At the core of every Skylanders figure is a passive NFC chip, specifically an NXP MIFARE Classic 1K tag. This chip contains 1024 bytes of EEPROM memory, divided into 16 sectors with 4 blocks each. One block in each sector is reserved for security settings, leaving most of the space for game data. The chip also has a 4-byte unique identifier (UID) that helps the game recognize each toy. When placed on the Portal of Power, the figure’s UID tells the game what character it is, while the chip’s memory holds the personalized save data that makes each figure unique.

Sector	Block	Usage (Typical)	Notes
0	0	Manufacturer data (UID)	Read-only, fixed at manufacture
0	1–2	Static info (character type ID, element)	Usually unencrypted
0	3	Sector trailer (Key A, Key B, access bits)	Controls access to Sector 0
1–4	4–19	XP, level, gold, hat ID, owner name	Encrypted, with checksums
5–6	20–27	Unlocked abilities, upgrade flags	Encrypted
7–13	28–55	Game-specific state, extra fields (Imaginators etc.)	Used variably per game title
14	56–58	Checksum blocks or unused	Sometimes value redundancy
15	59–63	Backup data or mirror of earlier blocks	Often used for recovery or rollback
	64 blocks total, 16 sectors of 4 blocks each	One trailer block per sector

Skylanders Figure: Typical MIFARE Classic 1K Memory Map

Skylanders figures store a surprising amount of information in this limited space. Core fields include the character’s level, current experience points, total gold collected, equipped hats or gear, unlocked abilities, and progress toward specific upgrades. Some games also support setting a custom nickname or owner name, which is stored in a fixed-length text block. To preserve this data reliably, Skylanders uses redundancy: critical values are often written in multiple locations or stored using mirrored byte formats with accompanying checksums. If one copy is corrupted, the game can detect the mismatch and revert to a known-good backup. These checksums also discourage clumsy edits, as the original checksum allows the game to identify tampered values and restore defaults instead of accepting broken data.

A Skylander and its NFC chip

To protect this data from unauthorized access or tampering, the memory sectors on the chip are locked using the MIFARE Classic’s Crypto-1 cipher. Each sector requires a 6-byte secret key to read or write, and only devices that know these keys can access the contents. Most figures use a shared Key A across sectors, while Key B is often disabled or left at a default value. On top of this, Activision added a second encryption layer. The actual contents of each memory block, such as experience points or upgrade data, are encrypted using AES-128. This encryption is handled entirely by the game software. The portal authenticates and reads the tag, then passes encrypted data to the console, where the game decrypts it and applies any changes before writing it back.

The NFC tag can be found in the base of most Skylander figures.

Over time, the Skylanders community categorized figures by NFC tag behavior, identifying two broad generations of chip design. Skylanders figures are often grouped into two tag generations by the homebrew community: Gen 1 and Gen 2. Figures from Spyro’s Adventure through Trap Team use standard MIFARE Classic 1K chips, commonly labeled as Gen 1. These tags can be fully cloned using Gen1a “magic” cards, which allow rewriting the normally fixed UID: a key requirement for creating exact duplicates the game will accept.

Skylander vehicles and treasure chests use the same NFC tag as the figures. The tags are typically located at the bottom of the vehicles and the chests.

In later releases, particularly around Imaginators , Activision introduced Gen 2 tags that appeared to use updated hardware like MIFARE Classic EV1 or alternative key schemes. These still relied on Crypto-1 but introduced small changes that broke compatibility with common cracking tools until the community adapted. Although Gen 2 tags made cloning slightly more difficult, both generations have been fully reversed, and today full read, edit, and duplication is possible regardless of figure generation.

The Portal of Power: A Gateway Between Worlds

The Portal of Power served as the physical interface between Skylanders figures and the game, translating passive NFC tags into playable characters and in-game events. It was a USB-powered platform that functioned as a specialized NFC reader, using ISO 14443 protocols and anti-collision polling to manage up to three tags at once, typically two characters and a magic item. While the earliest versions were relatively simple in design, their real-time responsiveness and cross-platform compatibility gave the impression of seamless integration. For most players, the portal "just worked", as long as they used the correct portal version for their game and console.

Robert Leyland, the designer of the Portal of Power. Picture from Make Magazine , which has an amazing article on the origins of the Portal.

Technically, the portal presented itself to consoles or PCs as a standard USB peripheral, often using the Human Interface Device (HID) class. Internally, a microcontroller managed NFC polling, authentication, and tag sequencing with low latency. It also performed MIFARE Classic sector authentication using stored keys, but it did not decrypt or interpret any figure data. That responsibility remained with the game software, which handled higher-level encryption and checksums. Beyond communication, the portal also controlled visual and power elements. It housed RGB LEDs, which lit up in colors matching the elemental type of each Skylander. While the figure-side NFC chip stored game progress, the portal handled all tag-level communication, acting as both a reader and a power source. Compatibility varies between game versions and consoles, so players should verify which portals worked with specific platforms and titles.

EliteBoomer form r/Skylanders opened up his portal of power.

One of the more technically impressive aspects of the Portal of Power was its ability to manage multiple NFC tags simultaneously. Using the ISO 14443-A anti-collision protocol, the portal could detect and communicate with several figures at once by cycling through their UIDs and authenticating each tag in turn. Early models, such as those bundled with Spyro’s Adventure and Giants , could reliably track up to three tags: typically two characters and a magic item. But as the franchise introduced more complex mechanics, like Swap Force ’s dual-tag figures and Trap Team ’s trap slot, the need for expanded tag capacity grew. Newer portals refined their firmware to time-slice across four or more tags without collision, while older models often struggled under the increased load.

The Trap Team portal allowed villains to "talk" to players from their crystal prison.

These improvements marked the most significant changes to portal hardware across the series. Later models added more responsive LED control and, in the case of Trap Team , a speaker for in-game voice playback. A portable variant with battery power and a 2.4 GHz wireless link was also released for the Nintendo 3DS. By the time Imaginators arrived, however, hardware revisions had slowed. Activision encouraged players to reuse existing portals, and on the Nintendo Switch, physical portals were replaced entirely by the console’s built-in NFC reader, signaling a quiet wind-down of peripheral development.

NFC Innovations

While most toys-to-life systems treated NFC tags as simple identifiers, Skylanders consistently pushed the technology further. One of the earliest and most visible innovations came with the introduction of LightCore figures in Skylanders: Giants. These toys featured embedded LEDs that illuminated when placed on or near the Portal of Power. What made the effect impressive was its implementation: the lights were powered entirely by the NFC field itself, with no batteries inside the figure. A chip harvested energy from the portal’s electromagnetic field, activating the lights through inductive coupling. This turned a passive RFID interaction into a dynamic visual response, and players quickly discovered the glow could be triggered by other NFC sources as well, such as smartphones or the Wii U gamepad.

A Skylander with a light core is much more complex. Note the microchip connected to the NFC tag, designed to collect power from the NFC field and transfers it to two leds, one in the head and one in the hand.

Activision advanced NFC integration further with Skylanders: Swap Force , which introduced modular characters that could be split into top and bottom halves. Each half contained its own NFC chip, allowing players to mix and match components to create custom character combinations. This posed a real engineering challenge: the system had to detect not just which halves were present, but how they were combined. The solution was to embed a reader coil inside the bottom half of each figure, enabling it to detect and relay data from the top half.

A Skylander Swap is actually two NFC chips, one for the top component and one for the bottom. The base of the figure includes a relay coil and a "reader" to pickup the value of the top NFC chip and relay it to the portal of power.

The Portal of Power now reads two coils: the base chip, and a coil that acts as a proxy, assembling a complete character profile only when it detected a valid top half in close proximity. The physical magnets used to hold the figure together have no role in data transfer. They simply ensure alignment for short-range radio communication between two relays.

The components needed to relay the signal from the NFC chip in the top part to the relay proxy coil. Communication between the top and bottom parts of the Skylander is done with a relay coil, who are aligned with the pair of magnets.

The dual-NFC architecture seen in Swap Force was expanded even further in Skylanders: SuperChargers , thanks to a collaboration with Nintendo. Special edition figures of Donkey Kong and Bowser included two physically distinct NFC chips: one for Skylanders and one for amiibo. A physical switch on the toy’s base allowed players to toggle between the two modes. Internally, this required careful antenna management to avoid interference, likely through a shared coil routed to different chips depending on the switch position. This marked the first time a Skylanders figure was explicitly designed to operate in two separate platform ecosystems, with full support for both game libraries and figure data structures.

Homebrew Scene

As Skylanders grew in popularity, a homebrew community quickly emerged around its NFC-based toys. Technically minded players began exploring how the figures worked, starting with basic detection using USB readers like the ACR122U or Arduino-based setups. Although the data on the figures was protected by MIFARE Classic encryption, these protections were eventually reverse-engineered. Once the sector keys and encryption scheme were understood, users gained the ability to read, back up, and eventually clone figures. This opened the door to both preservation and piracy, with tools ranging from advanced RFID simulators like Proxmark3 to more accessible consumer devices.

The MaxLander kit includes a USB NFC reader, programmable "Max Tokens," and elemental overlays for organizing characters by type.

One of the most impactful tools was MaxLander, a commercial product released in 2015 that offered full figure backup and cloning functionality. Users could extract a figure’s complete memory to a file and write it to blank NFC tokens, effectively creating duplicate characters. MaxLander worked across all Skylanders titles, including support for Swap Force figures with their two-part design. While some used it to share figures online or play with characters they didn’t own, others found more practical uses, such as preserving rare figures by reading them through sealed packaging. The tool dramatically lowered the barrier to entry for casual users interested in figure manipulation.

Reverse engineering Skylanders’ Toys-to-life mechanicsFrom hardware to software, this post covers everything I have managed to uncover about Skylanders’ Toys-to-life mechanics.Marijn KneppersMarijn Kneppers

Meanwhile, open-source tools and mobile apps made it easier for fans to edit their own Skylanders. Android apps, once community encryption keys became available, enabled reading and writing figure data using a phone’s NFC reader. PC users paired common readers like the ACR122U with custom editing software to modify stats, names, or reset data. Communities compiled full NFC dump archives, like the “Ultimate NFC Pack,” allowing anyone to clone rare figures using inexpensive rewritable tags. The Skylanders system, unlike Nintendo’s amiibo, lacked strong cryptographic authentication, so properly formatted data was often enough to fool the game. This simplicity made the toys accessible not just to players, but to hobbyists and archivists alike. One such repository of information would the The Crypt, a treasure trove of information on the figure themselves and the technology to modify them.

Create Your Own Skylanders

Once Skylanders figure data was fully reverse-engineered, fans developed a range of tools and methods to create their own figures, either by flashing real NFC tags or simulating them entirely in software. Today, there are two main approaches: hardware-based cloning using blank NFC tags, and software emulation that tricks the game into reading a virtual tag. Both methods require the figure’s encrypted memory dump, which can be extracted from a real toy or downloaded from curated community archives like the “Ultimate NFC Pack.”

A NFC card preloaded with Starcast purchased of Ebay for a few dollars.

Hardware cloning is the more physically authentic approach. To replicate a figure, you’ll need a writable MIFARE Classic 1K tag that supports sector 0 modification, commonly known as a Gen1a “magic card.” These allow you to change the UID, which is essential if the game ties encryption keys to a specific serial number. Cheap Gen1a cards, stickers, or coins are widely available online, often marketed for NFC experiments or card backups. You’ll also need a compatible reader/writer, such as the ACR122U (USB) or a Proxmark3 for more advanced control. With the correct tools, users can write the full memory dump, including UID and encrypted blocks, to a blank tag, producing a fully functional clone that behaves just like the original toy on any portal. The legality of hardware cloning is a common topic in community forums; while backing up or replicating your own Skylanders is generally seen as acceptable, distributing or selling cloned figures crosses into clear legal infringement.

Skylander NFC "coins" sold on AliExpress offer an alternative portable solution to carrying a collection of Skylanders. This is not endorse by Activision and certainly violates their copyright.

For users who prefer portability or want to avoid physical tags altogether, software emulators offer a flexible alternative. Tools like the Flipper Zero, Flashiibo, and various PN532-based emulation projects can act as a virtual tag when placed on the Portal of Power (or the Switch). These devices load a dump file into memory and simulate the behavior of a Skylander’s NFC chip on demand. Some Android phones with NFC support and the right apps can even emulate tags directly, though hardware limitations and OS restrictions may reduce reliability. Some emulation solution even bypass the NFC protocol, emulating the portal itself. Although these emulators are especially useful for testing, travel, or situations where carrying original figures isn't practical, most of them are imperfect, only working on a certain combination of platforms and/or games.

GitHub - NicoAICP/KAOS: Pi Pico Skylander Portal EmulatorPi Pico Skylander Portal Emulator. Contribute to NicoAICP/KAOS development by creating an account on GitHub.GitHubNicoAICP

This project uses the Raspberry Pi Pico to emulate a Portal of Power

💡

Creation Crystals and trap tokens also use MIFARE Classic chips, though with slightly different data structures. Crystals store a single custom character, locked to an element and class after creation. Traps, introduced in Trap Team , store a captured villain ID and work in tandem with the portal’s trap slot.

Reading a figure’s data is straightforward once you have the proper hardware and keys. Most dump tools work by authenticating to each sector using known Key A values, then reading all blocks into a single file. If you're starting with a real toy, the ACR122U and the Mifare Classic Tool app (on Android) are popular options. Dumps are typically saved as binary .bin files and may be accompanied by a UID or label to identify the character. Collections of these bins files are also easy to find, including on some of the sites linked in the article.

Writing to a blank tag follows the same process in reverse: authenticate, write each block, and confirm integrity. Editing tools can also modify XP, gold, or unlocks before writing, though the checksum must be recalculated or the game may reject the tag.

Reading the NFC tag using a Flipper Zero.

Whether you’re preserving your collection, building a custom loadout, or just exploring how the system works, the ability to create your own Skylanders has become an accessible entry point into NFC experimentation. The tools are mature, the hardware is cheap, and the knowledge is widely shared. With a small investment and some curiosity, it’s entirely possible to carry a full team of Skylanders in your pocket, no plastic required.

For users who already own a portal, desktop tools like SkyReader and Skylanders GUI Tool allow full access to figure data over USB without any NFC reader. These applications communicate with the portal using reverse-engineered HID commands and can read, decrypt, edit, and write back full character data using only the official hardware. The tools rely on the same AES decryption methods uncovered by the community and offer both command-line and graphical interfaces for batch backups or targeted stat editing. This approach lowers the barrier for archival and modification by turning the portal itself into a development interface. Behind these tools, open-source libraries like TheSkyLib provided APIs for developers to create their own backup utilities, data viewers, or even integration with emulators and custom dashboards.

The Legacy of Skylanders Hardware

Skylanders’ innovative use of NFC technology paved the way for other toys-to-life franchises, such as Disney Infinity and LEGO Dimensions. However, its success also contributed to market saturation, as competitors adopted similar models without significant innovation.

More Skylanders invading the workshop. You might even notice a face from the Playstation universe.

Despite its eventual decline, Skylanders left an indelible mark on the gaming industry. Its combination of physical toys and digital gameplay showcased the potential of NFC technology in gaming and set a high standard for interoperability and cross-platform play. While the franchise’s ambitious expansions may have overstretched its audience, its core hardware remains a fascinating example of blending technology with entertainment.

👍

Thanks to the r/skylanders community, especially u/AdamGamerPL and u/Infinite_palladin, for helping clarify early TTL history and legal gray areas. Thanks also go to u/DEMOFOUX for helping me understand the mechanisms behind Swap Force.

Do you own any toys to life? Sound off in the comments below with your experiences. If you enjoyed reading about NFCs, you might also be interested in reading about the Flipper Zero.

Learn more