"Quick" look at the new OV-pas

Analysing the successor of the OV-Chipkaart from a technical perspective.

"Quick" look at the new OV-pas

The new OV-pas has been launched last november (2025), I got an email, as a pioneer, saying I could order one:

OV-pas available for order email.

So, obviously, I ordered one (for 6 euro. That's 1,50 euro or 50 cents (depending where you get it) cheaper than the predecessor.)

A few pictures of the OV-pas:

Front of OV-pas. Top left is the logo of OV Pay, below it is the text "OV-pas". The bottom half is white as opposed to the rest which is pink. Just above the white part are pictograms of a bus, train, bike, ferry, tram, and metro. On the white part is the card number shown on the top left, and under it is the expiration date. Bottom right is the (slightly blue) contacless symbol. At the top (slightly right) of the card is a thumb notch, shaped like a steep slope down, and a gentle incline up..

Back of OV-Pas, on a beige background with yellow dots plotted in a sine wave form. On the top left the OV pay logo is shown, although smaller than on the front. A lot of dots are on the pink top of the card, three dots are replaced by the tops of arrows. The dots are laid out in a way that looks like a road on a map, with some random curves. Bottom left of the pink part is text which says "Meer info:" (written in a thin font) [newline] "ovpay.nl" (written in a bold font). The bottom (white) part has the changeable text at the top left. Under it is the volgnummer. At the very top, a bit to the left of the card is the thumb notch.

The backside where
[1] "Steeds slimmer,"
[2] "steeds makkelijker"
is written is changeable while ordering. If you choose nothing, that placeholder will be used.

The requirements are:

  • maximum of 22 characters per line
  • letters
  • spaces
  • commas
  • dashes
  • periods

NOTHING else, no numbers, no @s.

My personal opinion is that this arbitrary limitation is stupid. For example, if you lost your card, no one can call/message you (because there can't be any numbers), and no one can email you (because @ is not allowed), though this can be worked around.

When you buy the card in a store (like in Primera or at a service counter at a central station) a barcode will be placed. This barcode is able to be scanned so you can load it with money at the store or a service counter.

The card has a lifetime of 5 years, before you need a replacement.

The hardware

The OV-Pas is a JavaCard. It's made, or at least designed, by Infenion (apparent by the UID and CPLC).

I'm not sure, but the most likely thing what happens after is that Thales DIS (formerly Gemalto) presses the card in shape, loads the software on it, and programs it. After that, the card is printed on and is shipped. I have asked TLS (TransLink systems, the manager of the whole transit payment system) on 04/06/2026 for comment, but have not received a reaction as per 12/09/2026.

The software

The OV-Pas is a white-label EMV card, this means that it does not have any connection to a payment network like Visa or Mastercard. Instead, it uses its own network, simply called "OV-Pas".

The AID of the EMV applet is A0000007800007.

The card runs Thales DIS' Javacard OS, called Gemalto TOP. It is compliant with Javacard version 2.3. It also runs Global Platform version 2.3.

The BIN of the card is 22371700. This BIN is not assigned by MasterCard, the owner of the range it is in.

The card is probably connected to MasterCard as the BIN is theirs, it has the MasterCard card manager, and back when they were planning on connecting a real debit account to the card it was with bunq and MasterCard.

If you want to see more things about the card that I don't understand and thus have not included here, here you go:

Proxmark scan: https://gist.github.com/AliBello/47797bb6f8bbe3e9c2794e2843636c99

NXP TagInfo scan: https://gist.github.com/AliBello/193552a656c79423a46d82fd7c72983a

I have removed the UID and PAN for some anonymity, but it was probably a futile effort as there are likely other ways to identify me.