The Honest Late-Model Encrypted Car Key Map for Windsor and Essex County: 2020+ Coverage by Make

The story behind the 2020+ inflection point

A 2020+ car key is no longer a chip in a plastic head talking to a coil under the steering column. The key, the immobilizer module, and the manufacturer's cloud now form a three-party conversation, and every party authenticates the other two before the engine will crank.

Three things changed at the 2018-to-2020 inflection point:

1. Encryption stepped up to AES-128 and AES-derivative variants. DST-AES on Toyota, AES-128 on most 2020+ platforms, FBS4 SHE-protocol on Mercedes-Benz, HISS encrypted on Honda from 2018, NATS encrypted on Nissan from 2020. The earlier Hitag 2 and DST80 generations are mathematically broken in the open literature; AES-128 is not.
2. Online authentication entered the loop. VW MQB-Evo 2018+, GM Global B 2020+, Land Rover UWB-secured RFA 2022+, and Hyundai / Kia Smartra 3 require either a manufacturer-cloud session or a NASTF PIN retrieval call before a new key can be paired.
3. Secure Gateway modules and DoIP replaced plain OBD-II. Chrysler / Dodge / Jeep / Ram from 2018+ run a Secure Gateway (SGW) that filters every CAN-bus write request. Land Rover from 2018+ runs DoIP (Diagnostic over IP). Direct OBD-II writes do not work on these vehicles without the right session-authentication path.

The practical consequence: a 2020+ key job is a software job with a hardware deliverable. The diagnostic platform, the manufacturer-software subscription, the NASTF-authorized Vehicle Security Professional (VSP) credential, and the technician's training all matter more than the cutter or the key blank.

Coverage matrix by make (2020 and newer)

The table below shows the immobilizer module, the encryption protocol, the aftermarket pathway available to Canadian Locksmiths, and the tool used. Aftermarket Pathway values: Full pool (aftermarket programming is the routine path), Dealer-pathway (J2534 OEM software loaded via dealer-rate authenticated session, performed on-site by the technician), Dealer-only (no aftermarket pathway currently; Canadian Locksmiths can still cut blade and confirm scope).

The footprint covers the large majority of late-model vehicles on the road in Windsor and Essex County. Where a row carries Dealer-pathway or Dealer-only, the honest scope is given on the phone with the VIN, before any dispatch fee is committed, so no customer pays for a trip that ends in a referral.

Where the dealer pathway is required (and why that's expertise, not a gap)

Three platforms currently require either the manufacturer's authenticated session loaded via J2534 (dealer-pathway) or the dealership itself (dealer-only) for new key creation. Knowing exactly which platforms, which years, and which key scenarios is itself the skill. A locksmith who promises any 2020+ smart key for any make without VIN confirmation is selling a dispatch fee, not a programmed key.

Mercedes-Benz FBS4 (2014 and 2015 onward), all key scenarios. The FBS4 SHE-protocol implementation has not been opened by the aftermarket diagnostic ecosystem. CGDI MB, Xhorse VVDI MB Tool, Abrites AVDI Mercedes, and Lonsdor K518 Pro all cover the FBS3 era (pre-2014/2015) full pool. The FBS4 era is honestly dealer-only for spare key, all-keys-lost, and new key creation. Canadian Locksmiths handles FBS3 era full pool, can cut the FBS4 blade from VIN, and refers the FBS4 programming step to the dealer with a clean handoff so the customer does not pay twice.

VW / Audi MQB-Evo (2018 and onward), new key creation. The MQB-Evo platform requires an SVM (Software Version Management) online authentication call to Volkswagen Group's cloud. Canadian Locksmiths handles MQB-Evo on the dealer-pathway: ODIS-online loaded through the J2534 OEM pass-through device, dealer-rate session authenticated, key paired on-site. The pre-MQB-Evo MQB platform (2014 to 2017) is full-pool aftermarket. The honest scope is given by VIN.

GM Global B, strict 2020+ cohort, all-keys-lost. Global B early-platform (2019 transition vehicles, T1XX trucks first) is Autel-supported as full pool on supported variants. The strict 2020+ cohort (Tahoe / Yukon 2021+, CT4 / CT5, Corvette C8, Silverado 1500 2020+, EV platforms) requires online token validation that is currently dealer-only for all-keys-lost. Spare key on supported variants runs through Techline Connect + SPS2 on the dealer-pathway. Canadian Locksmiths confirms by VIN before dispatch and quotes whichever pathway applies.

A locksmith who tells you on the phone that your 2024 Tahoe all-keys-lost is dealer-only saves you a dispatch fee, a tow, and an afternoon. A locksmith who shows up and finds out in your driveway costs you all three.

Why late-model cars are harder to program

The encryption protocols escalated three times in 25 years, and the platforms that handle 2020+ vehicles are a different category of equipment than the kit that handled 2010-era transponders.

The encryption escalation:

• First-generation transponders (1996 to 2008): Texas Instruments DST40, Megamos 13, Philips Crypto 1 / Crypto 2. Fixed challenge-response. Aftermarket clone tools handle these in minutes.
• Second-generation (2008 to 2014): DST80, Hitag 2, AES-light variants. Stronger challenge-response, longer key sequences, but still readable by aftermarket bench tools and OBD programmers.
• Third-generation (2014 to 2018): DST-AES (Toyota chip H, 2014+), CAS3+ / CAS4 / FEM / BDC (BMW, 2014+), FBS3 (Mercedes, pre-2014/2015), MQB (VW Group, 2014+), Smartra 3 (Hyundai/Kia). Real AES-128 encryption with rolling counters. Requires either factory online authentication or specialist EEPROM bench-mode access.
• Fourth-generation (2018 to present): HISS encrypted (Honda 2018+), MQB-Evo with online SVM authentication (VW 2018+), Secure Gateway / SGW (Chrysler 2018+), NATS encrypted (Nissan 2020+), Smartra 3 with online authentication (Hyundai / Kia 2024+), Global B (GM 2019+ transition / 2020+ strict), N5F-ID21A (BMW 2024+), KVM / RFA with UWB (Land Rover 2022+), FBS4 SHE-protocol (Mercedes 2014/2015+). Online authentication, secure-gateway pin codes, manufacturer-cloud key validation.

To program a 2020+ smart key on most platforms, the locksmith needs:

1. NASTF-authorized Vehicle Security Professional (VSP) credential, which gates access to PIN retrieval portals for Nissan, Hyundai/Kia, Ford, GM, Chrysler, and others
2. Manufacturer-tier diagnostic platform (Autel IM608 Pro at the lower end through Abrites AVDI and Lonsdor K518 Pro at the higher end)
3. J2534 OEM pass-through device to load each manufacturer's official factory software directly to the vehicle (this is the same device that loads ODIS-online for VW/Audi MQB-Evo, Techline Connect for GM Global B, FDRS for Ford, wiTECH 2.0 for Chrysler)
4. Specific add-ons or specialty tools per make (Lock50 HW04 for JLR DoIP, Yanhua Mini ACDP for BMW FEM/BDC, specialty Tesla card programmer)
5. Continuous software subscriptions to keep the platforms current with each new model year drop
6. The discipline to confirm scope by VIN before dispatch on FBS4, MQB-Evo, Global B 2020+ strict, and the newest Porsche generations

A budget kiosk locksmith working with a Xhorse VVDI Key Tool Plus and an OBDStar X300 DP cannot reach most 2020+ platforms. The customer who calls every locksmith in town for a 2024 Tahoe smart key replacement and gets four "no" answers before reaching Canadian Locksmiths is hitting that equipment gap directly.

What all-keys-lost looks like on a 2020+ vehicle

The all-keys-lost workflow on a 2020+ vehicle is fundamentally different from the spare-key workflow because there is no existing authenticated key to seed the new pairing.

1. Phone VIN confirmation. The 17-character VIN is decoded against the make-specific module and protocol map (the matrix above). Honest scope is given before dispatch: full pool, dealer-pathway, or dealer-only.
2. Mobile arrival + non-destructive entry. Door cylinder picked or vehicle entered through the mechanical backup blade hidden inside the customer's broken / dead fob if one is available.
3. OBD-II or DoIP connection plus session authentication. On full-pool platforms (Toyota / Honda / Nissan / Hyundai / Kia / Ford / Chrysler), the Autel IM608 Pro authenticates a programming session. On dealer-pathway platforms (MQB-Evo, Global B spare key on supported variants), J2534 + manufacturer software loads the dealer-rate session.
4. NASTF PIN retrieval where required. Nissan, Hyundai/Kia, Ford, GM, Chrysler, and others gate AKL writes behind a NASTF VSP PIN portal call. The NASTF credential is what unlocks this step; a non-credentialed locksmith hits a wall here.
5. All previous keys wiped from the immobilizer. Lost keys can never start the vehicle again, even if found later. This is a security feature, not a limitation.
6. New keys cut, programmed, and verified. Cut to door blade code or VIN-to-cut lookup; paired through the immobilizer; tested on door / ignition / push-button start / remote functions.
7. Hand off. Customer drives away with two working keys (the new and the verified spare-add). Lost keys remain wiped from the system.

The 8-step workflow stays the same across most makes; what varies is which step requires the NASTF VSP credential, which step requires the J2534 OEM session, and which platforms fail step 4 because the make-specific dealer-only protocol has not been opened by aftermarket tools yet.

Insider notes most owners never hear

These are the things a senior locksmith knows about 2020+ encrypted car keys that almost never make it into marketing copy or owner manuals.

1. The NASTF VSP credential is the gate, not the tool

Plenty of shops sell programming devices off the internet. What they cannot buy is a NASTF-authorized Vehicle Security Professional (VSP) credential, which is the access gate to manufacturer PIN portals (Nissan, Hyundai/Kia, Ford, GM, Chrysler), background-checked technician status, and the diagnostic-data access that 2020+ platforms require. Canadian Locksmiths holds active NASTF VSP credentials. A non-credentialed shop with the same hardware will fail step 4 of the AKL workflow above on most modern platforms.

2. "Same module" is not the same job between generations

A 2014 Honda Civic and a 2024 Honda Civic both have Honda HISS in the marketing literature. The 2014 is third-generation HISS with a Hitag 2 / G-chip footprint that aftermarket Autel handles routinely. The 2024 is fourth-generation HISS with encrypted authentication and online registration. Same module name, different protocol generation, very different workflow. The same is true for Nissan NATS (1998 base, NATS-BCM 2003+, NATS7 with HITAG-AES 2020+) and Smartra (Smartra 3 in 2003 through Smartra 3 in 2024).

3. FBS4 is honest dealer-only, and the line is by chassis date, not model year

Two 2015 Mercedes C-Class sedans in the same parking lot can be on different generations. Mercedes rolled FBS4 across chassis in waves, and the cutover date depends on chassis code and production line, not the model-year sticker. The VIN's 10th character (model year code) does not tell you which. The 11th character (assembly plant) plus the production date stamp does. Canadian Locksmiths checks both at the phone stage and again at the vehicle, and refers FBS4 jobs to the Mercedes dealer pathway with a clear explanation.

4. The Secure Gateway (SGW) on Chrysler / Dodge / Jeep / Ram is not a programmer setting

It is a hardware module that sits between the OBD-II port and the CAN bus on 2018+ Stellantis vehicles. Any programmer that does not authenticate against the SGW first will see CAN-bus writes rejected. wiTECH 2.0 includes the SGW bypass; aftermarket Autel IM608 Pro handles it on the routine smart-key flow. Without that bypass, the OBD-II port may as well be unplugged for write operations.

5. UWB pairing on 2022+ Land Rover changes the entry workflow

Land Rover's 2022+ Range Rover and Defender use Ultra-Wideband cryptographic pairing on top of the existing DoIP / RFA architecture. The fob no longer just talks to the car over LF / RF; it triangulates against UWB antennas embedded in the vehicle body. Field-replaceable batteries, but pairing is cryptographically locked through Pathfinder via the JLR cloud. Lock50 HW04 (revisions A, B, C) plus Pathfinder is the only legitimate aftermarket path.

6. ODIS-online for VW Group MQB-Evo is not the same product as ODIS-service

ODIS-service is a paid subscription that lets independent shops do diagnostic and routine programming. ODIS-online is the manufacturer-cloud-authenticated component that handles SVM (Software Version Management), key learning on MQB-Evo, and the actual encrypted session against the Volkswagen Group cloud. Canadian Locksmiths runs ODIS-online via J2534 dealer-rate session on MQB-Evo work. A shop running ODIS-service alone cannot complete MQB-Evo key learning.

7. Global B "early" versus "strict" matters more than the marketing implies

GM Global B rolled out across T1XX trucks first in 2019, then expanded to passenger platforms in 2020. The early-platform variants (2019 transition trucks) accept Autel IM608 Pro full-pool aftermarket programming on supported VINs. The strict 2020+ cohort (Tahoe / Yukon 2021+, CT4 / CT5, Corvette C8, Silverado 1500 2020+, EV platforms) requires online token validation that is currently dealer-only for all-keys-lost. A locksmith advertising "2020+ GM" without naming the early-strict line is glossing over the most important distinction for a customer with a 2024 Tahoe.

8. The "online session" line is the same for VW MQB-Evo, GM Global B, and Ford 2020+ smart key

All three platforms gate write operations behind an authenticated cloud session. The session is loaded via J2534 OEM pass-through and the manufacturer's actual software (ODIS for VW Group, Techline Connect / SPS2 for GM, FDRS for Ford). This is the same workflow the dealer service bay uses; the difference is that Canadian Locksmiths runs it on a mobile-van laptop at the customer's location instead of a fixed dealer-bay computer. The technical capability is identical; the chair is in a different building.

9. Tesla NFC is genuinely on-site serviceable, despite the myth

Tesla NFC key card pairing for Model 3, Model Y, Model S, and Model X is fully serviceable on-site with a specialty Tesla card programmer paired with the Lonsdor K518 Pro. Phone-key activation walk-throughs included. The myth that Tesla requires a service center for new key cards comes from the fact that Tesla does not publish a key-cutting workflow (there is no cylinder to cut), so traditional locksmiths who only think in cuts assume it is dealer-only. It is not. It is one of the shortest 2020+ programming jobs on the menu (30 to 60 minutes typical).

10. The honest scope on the phone is the moat

The single most valuable thing a 2020+ smart key customer can hear is: "Your 2024 Tahoe all-keys-lost is currently dealer-only. I will not dispatch and charge you for a trip that ends in a referral. Here is what the dealer process will look like, and here is what I can do for you on the next vehicle when you replace this one." That kind of phone conversation is what separates Canadian Locksmiths from a competitor who books the dispatch fee, shows up, fails, and bills anyway. The honest map above (and the willingness to refer where the aftermarket pathway is genuinely not yet open) is the long-term competitive moat.

Cost and what to expect

Late-model encrypted car key pricing in Windsor and Essex County varies by platform, key scenario, and whether the job is full-pool aftermarket or runs on the dealer-pathway. Ranges below cover the full service (entry, programming, key blade cut, fob shell, verified working key, warranty paperwork). Upper bounds carry the + suffix because complex situations sometimes exceed the typical maximum.

• Spare smart key on full-pool platforms (Toyota / Honda / Nissan / Hyundai / Kia / Ford / Chrysler / Mazda / Subaru / Mitsubishi): $399 - $599+
• All-keys-lost on full-pool platforms: $499 - $899+
• High-security European bench / EEPROM (BMW CAS / FEM, Mercedes FBS3 EIS, classic Audi MQB, Land Rover KVM): $699 - $1,199+
• Dealer-pathway sessions (VW MQB-Evo, Audi MQB-Evo, GM Global B 2020+ spare): $599 - $1,099+
• Tesla NFC card pairing: $299 - $499+
• FBS4 / Global B 2020+ strict AKL: referred to dealer, no aftermarket charge

These tiers reflect what the mobile van carries versus what a dealer route typically charges, which on a high-security European platform lands between $1,800 and $3,500+ including a tow plus several days of rental. Canadian Locksmiths runs the same NASTF VSP-authorized programming workflow on a mobile-van laptop that the dealer runs on a shop bay computer, with a 90-day programming warranty and a lifetime warranty on the cut blade.

Call (519) 979-1270 with the VIN before booking. The quote is bound to the VIN, not a generic range.

Frequently asked questions

Can any locksmith program a 2020+ smart key?

Most cannot. Programming a 2020+ smart key on most platforms requires a NASTF-authorized Vehicle Security Professional (VSP) credential, a J2534 OEM pass-through device, manufacturer-tier diagnostic software subscriptions, and platform-specific add-on tools. A locksmith working with only a Xhorse VVDI Key Tool Plus and an OBDStar X300 DP cannot reach the post-2018 secure-gateway platforms or the post-2020 online-authenticated platforms. Canadian Locksmiths holds active NASTF VSP credentials and carries the full late-model toolchain.

Why does my 2024 Tahoe need a dealer for all-keys-lost?

The 2020+ strict cohort of GM Global B (Tahoe / Yukon 2021+, CT4 / CT5, Corvette C8, Silverado 1500 2020+, EV platforms) requires an online token validation that currently has no aftermarket pathway for all-keys-lost. Spare key on supported variants runs through Techline Connect + SPS2 on the dealer-pathway. Canadian Locksmiths confirms scope by VIN at the phone stage; if your specific VIN is in the strict cohort, the honest answer is dealer route, given before any dispatch fee is committed.

Is the encryption on my 2020+ key actually unbreakable?

For practical purposes, yes. AES-128 is the symmetric encryption standard used for classified government communication and is mathematically not breakable on the timescales relevant to vehicle theft. The earlier transponder protocols (Hitag 2, DST80, Megamos 13) have published cryptographic attacks that work in minutes; AES-128 does not. This is why the modern attack vector on car keys is the relay attack (capture and amplify the legitimate fob signal) rather than the cryptographic attack.

What is a J2534 pass-through device, and why do I keep hearing about it?

J2534 is a SAE-defined standard for a hardware pass-through device that loads each manufacturer's official factory diagnostic software directly to the vehicle's OBD-II or DoIP port. The same device runs ODIS-online for VW/Audi, Techline Connect / SPS2 for GM, FDRS for Ford, wiTECH 2.0 for Chrysler, Honda HDS / i-HDS, Toyota Techstream, Hyundai/Kia GDS / KDS, and others. It is what makes the "dealer-pathway" workflow possible at a mobile-locksmith level. Without a J2534 device plus subscription, only aftermarket third-party platforms (Autel, Lonsdor, Abrites, Xhorse) are available.

What does NASTF VSP mean and why does it matter?

NASTF (National Automotive Service Task Force) is the industry organization that maintains the registry of background-checked Vehicle Security Professionals. The VSP credential is the access gate for manufacturer PIN retrieval portals (Nissan, Hyundai/Kia, Ford, GM, Chrysler), security-data access, and online programming sessions on the most modern platforms. A locksmith without NASTF VSP credentials can buy the same hardware as a credentialed one and still hit a wall at step 4 of the all-keys-lost workflow.

Does Canadian Locksmiths service all of Windsor and Essex County?

Yes. Canadian Locksmiths provides mobile service throughout Windsor, Tecumseh, LaSalle, Lakeshore, Amherstburg, Essex, Kingsville, Leamington, and surrounding Essex County areas. Service is Monday to Friday, 9:00 am to 5:00 pm. Canadian Locksmiths is NASTF-authorized VSP, CAA Approved, BBB A+ rated, and has been operating in Windsor since 1989. Call (519) 979-1270 with the VIN for a vehicle-specific quote.

Do you check ID and ownership before programming new keys?

Canadian Locksmiths may, at its sole discretion, request proof of vehicle ownership or identity before, during, or after performing services. Proof may include government-issued photo identification, vehicle registration, or other documentation. The decision to request, accept, or waive any particular form of verification rests entirely with Canadian Locksmiths and does not create an obligation to verify ownership in every transaction. By requesting locksmith services, the customer represents and warrants that they are the legal owner of the vehicle, or that they have obtained explicit written authorization from the registered owner.