Land Rover and Range Rover Key Programming: Complete Locksmith Guide

Land Rover is the make that separates the locksmiths who have invested from the ones who have not. A Fiesta pays the bills. A Range Rover pays for the tool that did the Range Rover. The jobs are worth real money, the customers expect to pay it, and yet a large share of the trade still turns them down at the phone because the answer to "can you do a 2021 Velar" is genuinely complicated.

It is complicated because Jaguar Land Rover has changed its key architecture six times over twenty-five years, and because the changes do not line up with the model names. A Range Rover Sport badge covers a first-generation KVM car from 2006 and a DoIP-only PEPS car from 2019, and the fobs look near enough identical in the customer's hand. Get that wrong on the phone and you have quoted a two-hour job as a forty-minute one.

This guide works through every Land Rover generation in the Keysolved database, from the transponderless Discovery 2 to the ultra-wideband L460, with the procedure, the honest tool position and a realistic job time for each. Land Rover key programming is not one job. It is six.

The six JLR security eras

Read this table first and then find the car in front of you. Everything after it makes sense once you know which era you are in.

Two things in that table catch people out. The eras overlap, because JLR rolled architectures in by platform rather than by calendar year. And the model code matters far more than the badge: an L405 Range Rover is a KVM car until MY2018 and a PEPS car after it, with no change to the fob you are handed.

Before 2006: the cars with no transponder and the cars with BMW inside

Discovery 2, 1998 to 2004

The Discovery 2 is the odd one out in the entire Land Rover range, and the single most misdiagnosed vehicle on this list. There is no transponder chip in the key at all. The Valeo BCU authenticates a 70-bit rolling code broadcast by the fob's RF transmitter, either when the unlock button is pressed or when the exciter coil around the ignition barrel induces a signal.

The practical consequence is that a plain uncut blade from any key cutter will turn the barrel and crank the engine mechanically, and the immobiliser will refuse to disarm regardless. Locksmiths who assume a chip problem spend an hour looking for a transponder that was never fitted.

Programming needs two pieces of information: the 4-digit EKA (Emergency Key Access) code stored in the BCU, and the 6-character inner code printed on the PCB inside the fob itself. The EKA is available from a Land Rover dealer against proof of ownership, often free of charge, or it can be read from the BCU directly with a Nanocom.

All-keys-lost procedure

1. Enter the EKA code at the driver's door lock. It is a four-part numeric sequence: unlock turns for odd digits, lock turns for even digits.
2. With the immobiliser disarmed, connect a diagnostic tool to the OBD port — RHD cars have it in the driver's footwell to the left of the column, above the footrest pedal, tucked behind the lower edge of the dash.
3. Open the new fob and read the 6-character code from the circuit board.
4. Select the Valeo BCU module, open Key Inner Codes and press Update to display the stored slots.
5. Enter the new code into a free slot, press Sync, then press a button on the fob when prompted.
6. Press Key Detect and confirm the BCU has accepted it.
7. Cut an NE38 or NE75 blade from the lock code or by impressioning. There is no chip to worry about.
8. Time: 45–75 minutes, assuming the EKA is already in hand. Add a day if the customer has to obtain it from a dealer.

The BCU holds four active fobs plus a fifth slot reserved for the air suspension height control handset. Aftermarket fobs must be 433 MHz Valeo-compatible units with the correct PCB code format — a generic 433 MHz remote will sync and then do nothing.

L322 Range Rover, 2002 to 2005

The early L322 Range Rover is a BMW underneath, and its immobiliser is BMW EWS running a PCF7936 Hitag 2 transponder on an HU101 blade. This is the one Land Rover generation where cloning is genuinely on the table: the Hitag 2 chip can be copied with an Xhorse VVDI Key Tool Plus in Hitag 2 copy mode from a working donor, though the remote half still has to be synchronised to the car afterwards.

Programming to the vehicle is a different proposition. A PIN is required, sourced either from an EWS EEPROM read or from a dealer extraction service, and Abrites AVDI on the JLR and BMW licences covers both add-key and all-keys-lost. Add key: 30–45 minutes. All keys lost: 2–3 hours, most of it bench work on the EWS.

From roughly the 2006 model year JLR replaced the BMW system with its own KVM and moved to PCF7953. The transition is approximate — verify by reading the immobiliser module type through diagnostics rather than trusting the registration date.

Defender, 1998 to 2016

The Defender runs three eras of its own inside one model entry. Pre-1998 cars have no factory immobiliser at all. From 1998 to 2006 the key carries a Megamos Crypto ID48, and add-key and all-keys-lost are both intermediate work over OBD on an Autel MaxiIM IM608 Pro II or a Lonsdor K518Pro. Time: 30–45 minutes either way.

The 2007–2016 Puma cars move to a remote head key on PCF7953 Hitag Pro, and the difficulty jumps: both add-key and all-keys-lost are rated expert, with the Abrites AVDI the preferred route for a lost-key job. Time: 60–90 minutes for add key, 2–3 hours for all keys lost. No Defender of any generation has push-button start.

2005 to 2017: the KVM years, and where the money is

This is the profitable middle of the Land Rover range, and it is where a well-equipped independent competes with the dealer on equal terms.

The Keyless Vehicle Module authenticates a PCF7953 Hitag Pro transponder over LIN and CAN, with key credentials held in KVM EEPROM. There is no manually entered PIN on any professional tool — the tool runs an OBD challenge-response and extracts an encrypted seed. The platform is shared far more widely than the badges suggest: the Range Rover Sport L320, the Evoque L538, the L405 Range Rover to MY2017 and the early L494 Sport all take effectively the same procedure.

Add-key procedure, KVM era

1. Connect the tool to the OBD port in the driver's footwell with the ignition off.
2. Switch the ignition on. Do not crank.
3. Select the make, model and generation, then Add Key for the KVM years.
4. Allow the tool to run the KVM challenge-response. This takes one to three minutes and looks like a hang. It is not.
5. Present the new fob near the start button when prompted.
6. The tool writes the key to the next free KVM slot.
7. Verify lock, unlock and engine start.
8. Time: 30–45 minutes. Up to eight keys can be stored.

All-keys-lost procedure, KVM era

1. Connect with a healthy battery or a support pack on the vehicle. Voltage drop mid-write leaves the module in a state you then recover on the bench.
2. Select All Keys Lost for the KVM generation.
3. The tool reads and decrypts KVM EEPROM over OBD, or through the Lonsdor JLR IMMO adapter where the OBD path is unavailable.
4. The tool clears every existing key slot. Warn the customer first: any spare they find in a drawer afterwards is dead.
5. Present the first new fob, then the second.
6. Verify engine start on both.
7. Time: 90 minutes to 2.5 hours.

Two vehicles in this window sit on the older RFA architecture rather than the KVM, and they behave differently. The Discovery 4 L319 requires either two working keys already present or the TCU placed in Service Mode before an add-key will run, and its all-keys-lost needs both the RFA and the BCM reinitialised — bench EEPROM work before any OBD programming starts. The Freelander 2 L359 is a dash-docking remote on early cars rather than a proximity system, and its fob takes a VL2330 rechargeable lithium cell that charges in the dock, not a CR2032. Fitting the wrong battery is a returned-job classic.

2018 onwards: DoIP, the Secure Gateway and the locked RFA

MY2018 is the hard line across the whole JLR range, and it is the answer to most "why will my tool not connect" questions.

From that point the cars moved to PEPS behind a Secure Gateway, with factory diagnostics running DoIP — Diagnostics over Internet Protocol — rather than plain CAN. A CAN-only interface does not fail partway through a procedure on these cars. It never opens a session at all. This applies to the L551 Evoque, the PEPS-era L405 and L494, the Velar from 18MY and the Discovery Sport L550 in its RFA guise.

The second change is the locked module. JLR specialist Lock50 sets out the shift plainly in its history of JLR security from 2017 to 2026: on an unlocked RFA the tool writes key data through the gateway and the BCM as it always did, while on a locked RFA the port is effectively read-only for security writes and standard OBD tools simply fail. The proportion of locked modules leaving the factory has risen steadily, and a dealer visit can lock a module that was previously open.

The trigger for all of this is not hard to find. JLR has put over £10 million into vehicle security since 2022, updating more than 65,000 UK vehicles from the 2018 model year onwards with BCM software that blocks hacked keyless entry, and reports theft rates on the newest Range Rover and Range Rover Sport down to 0.07 per cent. That is a success for owners and insurers. It is also the reason your tablet stopped working.

Add-key procedure, PEPS era

1. Connect a DoIP-capable interface — a JLR DoIP VCI, the Autel DoIP and Ethernet adapter, or the Abrites CB012 internal-CAN set.
2. Switch the ignition on and select the PEPS Add Key routine for the correct generation.
3. Allow two to five minutes for the DoIP session to establish.
4. Present the new fob in the proximity zone.
5. The tool writes the key to the PEPS module.
6. Verify passive entry and engine start, not just the remote buttons.
7. Time: 60–90 minutes.

All-keys-lost in this window is where honest quoting matters. On an unlocked module with the alarm off it is a long but routine job. On a locked module the tool stops and asks for a 32-digit Secret Key that cannot be read over the port, and the vehicle becomes bench work: the RFA comes out, its NXP secure processor is renewed, virgin initialisation data is written, the module goes back in and the keys are learnt over OBD afterwards. Time: 4–6 hours, and a second visit is realistic.

The Discovery Sport deserves a specific warning. On 2020-onward cars with the K8D2 or M9R3 module, a BCM unlock through the Abrites KP002 route can take up to 72 hours. That is not a job you finish on the driveway, and it is not a job you quote as one.

The newest cars: L460, L663 and ultra-wideband

The 2022-onward Range Rover L460 and the Defender L663 add a layer that changes the shape of the job rather than just its difficulty.

JLR pioneered ultra-wideband ranging in 2018 specifically to defeat relay attacks. Rather than simply asking whether the key is responding, the car measures how far away it is by timing radio pulses to the nanosecond, which is why UWB is so effective against signal relaying — a relayed signal cannot fake the distance.

For a locksmith the consequence is specific and awkward. Programme a standard aftermarket 433 MHz key to an L460 and it will lock and unlock the car perfectly, and it will not start it. The remote half works; the UWB proximity half does not exist in the key. There are three honest answers, and the customer needs to hear which one they are getting.

• Fit a genuine key ordered against the VIN, or a proprietary aftermarket key such as the Abrites TA66.
• Fit a UWB emulator at the RFA, which stands in for one of the ultra-wideband antennas so the transponder half of an ordinary key comes alive.
• Code UWB out of the vehicle configuration so a plain non-UWB key is accepted. This is the cleaner long-term fix the trade is moving towards, and it is also a reduction in the car's security that the customer must agree to explicitly.

There is one more L460 trap worth committing to memory, and it costs a wasted key rather than a wasted hour. Plenty of generic catalogues still list the L460 fob as Hitag Pro or ID49. It is not. The chip is an NXP NCF29A1 in the Megamos AES family. Order against the NCF29A1 or "JLR Type 2" listing, or the key will not programme at all.

The RFA on the L460 also lives in the rear of the car, around the right-hand C-pillar, not behind the dash. That matters when the job turns into bench work, and it matters when you are quoting the labour.

Tool compatibility: an honest position

No tool covers Land Rover end to end. Anyone claiming otherwise has not tried a locked K8D2.

Tier 1: the tools that carry a JLR round

Autel MaxiIM IM608 Pro II — the broadest coverage in the database, and the only tablet in the Autel family that speaks DoIP, which is what everything from 2022 needs. Add-key over the port on an unlocked RFA is clean. Where it falls short is precisely documented: bench MCU work on a locked K8D2 is only moderately reliable on Autel, and the database says so plainly. Do not make it your only plan for a locked-module all-keys-lost. The IM508 and the original IM608 do not carry DoIP at all and no software update changes that.

Abrites AVDI — the deepest JLR position of any aftermarket tool, and the one that finishes jobs others abandon. Its JLR key programming licence for MY2018 to 2026 covers the K8D2 and JPLA modules, with a separate alarm-off licence for a locked BCM on an all-keys-lost. Start every AVDI job with Read Vehicle Info: it reports the platform, whether UWB is fitted, whether the RFA is locked and how many keys are already learnt, which decides the rest of the job in one screen. The cost is the honest problem — licences stack, and an active subscription with a live internet connection is required during the procedure.

Lonsdor K518Pro — strong through the KVM years and into the 2018-onward cars, with the JLR IMMO adapter mandatory for all-keys-lost. Two limitations to state up front: on a locked K8D2 it stops at the 32-digit Secret Key demand, and on a high-specification passive-entry car the resulting key gives remote and emergency start only, with no touch entry and no true keyless start. On a car without passive entry it is fully functional. That distinction belongs in the quote, not in the complaint afterwards.

Tier 2: capable on the older platforms

OBDSTAR X300 DP Plus — solid JLR KVM coverage with the P001 adapter, and pin-code free. The gotcha that catches people out is mechanical: the 16-pin main cable and the green gateway converter both have to be connected at the same time or the P001 will not connect at all. The X300 Classic G3 is the one to reach for on the newest cars, because its built-in CAN-FD and DoIP get to vehicles the older OBDSTAR units cannot reach.

Advanced Diagnostics Smart Pro — confirmed coverage across the L320 and L322 KVM era with the standard Land Rover kit, and the ADS2207 software covers Discovery 4 and late Freelander 2 proximity cars. Verify the kit loaded on your unit rather than the tool itself: some Land Rover kits cover only the KVM era and not the BMW EWS cars, and some 2015 vehicles with the DPLA part-number KVM are not supported at all.

Tier 3: bench specialists

Yanhua Mini ACDP-2 — the bench answer when the module is locked and asking for a Secret Key. On the MC9S12XE-based KVM the ICP connection means no soldering, no lifted pins and no crystal removal, which is the whole reason to use it on a module you have to hand back working. On the L460 the job is heavier: the secure processor is desoldered and replaced with a virgin part before init data is written. Check the module label reads FK72 or HPLA before committing to the ICP route.

The OEM route

JLR's own path now runs through TOPIx Cloud, which authenticates live against JLR servers and logs the job. For the newest cars it is the cleanest and most reliable option, including on a locked RFA, and it is the only route that leaves a car with a genuine UWB key and nothing coded out. The barrier is access rather than capability: a module-programming subscription alone is not enough, and key and security-module work additionally requires security accreditation. In the UK that runs through SERMI, live since 1 April 2026, with business-level approval, individual employee authorisation, DBS checks and two-yearly revalidation. For most independents doing occasional JLR work, buying a remote session in from a specialist is the realistic answer.

Common pitfalls

The tool will not connect at all on a 2018-onward car This is almost always DoIP rather than a fault. A CAN-only interface cannot open a session behind the Secure Gateway. Check the interface before you check anything else.

The OBD socket is there but nothing talks to it Velar owners in particular fit OBD locking boxes, dummy sockets and relocation kits, and they are very common on UK cars. If the bracket holds a connector that will not communicate, the live socket is usually cable-tied behind the same lower dash panel or locked inside a steel box behind the dash end trim. The OBD port location guide covers the genuine positions make by make.

The new key locks and unlocks but will not start the car On an L460, L663 or a 21MY-on Velar this is the ultra-wideband layer, not a failed programming session. The key is fine. Fit the UWB emulator or code UWB out of the configuration, and tell the customer which you did.

Quoting an add-key on a module that is already full On the later RFA generations there are only two key positions in total. A car with two working fobs has no room for a third key or an Activity Key band until a position is freed. Read the key count out of the module before you quote, not after you have ordered the fob.

Ordering the L460 key on a Hitag Pro listing The L460 and L461 use the NCF29A1 in the Megamos AES family. Generic catalogues still list them as ID49. The wrong chip decodes, cuts and then refuses to programme.

Assuming the Discovery 2 has a chip in the key It does not. If the engine cranks and dies on a Discovery 2, you are looking at the Valeo BCU and the EKA code, not a transponder. The transponder chip cross-reference chart is worth a look if you want the families straight across every make.

Running an all-keys-lost without battery support Every JLR key procedure writes to a security module. A voltage dip partway through leaves that module in a state you recover on the bench, on your own time.

Skipping the ownership checks because the car is expensive The opposite applies. High-value JLR vehicles are exactly where proof of ownership, a V5C check and photographic identification matching the keeper are non-negotiable. Land Rover publishes its own security guidance for owners, and the trade expectation has only hardened since SERMI went live.

Frequently asked questions

Can you programme a Range Rover key without the dealer?

Yes, on most generations. KVM-era cars from roughly 2005 to 2017 are routine aftermarket work over OBD with an Autel IM608 Pro II, Lonsdor K518Pro or Abrites AVDI. From MY2018 the car sits behind a Secure Gateway on DoIP and needs a DoIP-capable tool, and where the RFA module has been locked the job becomes bench work or an online JLR session.

Why will my tool not connect to a 2020 Range Rover?

Because the car is DoIP and the tool is not. From the 2018 model year JLR runs diagnostics over Internet Protocol behind a Secure Gateway, and a plain CAN interface cannot open a session at all. The Autel IM508 and original IM608 do not support DoIP; the IM608 Pro II does with its Ethernet adapter.

How long does a Land Rover all-keys-lost take?

It depends entirely on the era. A KVM-era Evoque or L405 runs 90 minutes to 2.5 hours. A 2018-onward PEPS car with an unlocked module is a similar length. A locked RFA needing secure-processor renewal on the bench is 4 to 6 hours and realistically a second visit, and a locked BCM unlock on a 2020-onward Discovery Sport can take up to 72 hours.

Can Land Rover keys be cloned?

Only on the 2002 to 2005 L322 with its BMW EWS system and PCF7936 Hitag 2 chip, and even there the remote must be resynchronised afterwards. Every PCF7953 Hitag Pro and NCF29A1 key from 2005 onwards has to be cryptographically enrolled to the module. There is no clone route.

What is a locked RFA and how do I know before I quote?

A locked RFA or KVM refuses security writes over the OBD port, so a standard tool fails where it would previously have worked. The reliable way to find out before quoting is to read vehicle information with a capable tool first — the Abrites AVDI reports the platform, the lock state, whether UWB is fitted and the learnt key count in one screen.

Do I need SERMI accreditation for Land Rover key work?

Not for aftermarket tools taking security access directly from the vehicle. You do need it for the OEM route: JLR's TOPIx Cloud key and security-module functions sit behind security accreditation, which in the UK has run through SERMI since 1 April 2026 and carries vetting, a fee and two-yearly revalidation.

The short version

Land Rover is not one make for key purposes. It is a pre-2006 era where the cars have no transponder or a BMW immobiliser, a long and profitable KVM middle where a well-equipped independent competes with the dealer directly, and a post-2018 era where the answer depends on whether one specific module has been locked.

Establish the era before you quote. The badge will not tell you, the year alone will not tell you, and the fob in the customer's hand looks the same across a decade of very different jobs.

Before you commit to a price, look the exact vehicle up on Keysolved — the key variants, the transponder and frequency, the OBD port location, the add-key and all-keys-lost procedures and the specific tools named against that car, with the adapters and licences attached. For a wider view of which tablet to buy, the 2026 car key programmer coverage matrix counts confirmed coverage across every tool in the database, and the immobiliser fault diagnosis guide is the place to start when the warning light is the symptom rather than a lost key.