APDU Status Words
Searchable reference for APDU status words. ISO/IEC 7816-4 standard codes plus GlobalPlatform, EMV, and FIDO U2F additions. Search by code or by phrase.
| SW1 SW2 | Meaning | Source | Detail |
|---|---|---|---|
| 9000 # | Success | OK | Normal processing. |
| 6100 # | More data available (use GET RESPONSE) | Warning | SW2 indicates the number of bytes available. |
| 6200 # | Warning — non-volatile memory unchanged | Warning | |
| 6281 # | Returned data may be corrupt | Warning | Card detected possible integrity issue. |
| 6282 # | End of file reached before reading Le bytes | Warning | |
| 6283 # | Selected file invalidated | Warning | |
| 6284 # | FCI not formatted according to spec | Warning | |
| 6300 # | No information given (non-volatile memory changed) | Warning | ISO 7816-4 warning. GlobalPlatform EXTERNAL AUTHENTICATE returns it when the host cryptogram fails. Retry counters use 63Cx, not 6300. |
| 6381 # | File filled up by last write | Warning | |
| 6400 # | Execution error (state unchanged) | Error | |
| 6500 # | Execution error (state changed) | Error | |
| 6581 # | Memory failure | Error | Hardware fault during write. |
| 6700 # | Wrong length | Error | Lc, Le, or APDU length is incorrect. |
| 6800 # | CLA function not supported | Error | |
| 6881 # | Logical channel not supported | Error | |
| 6882 # | Secure messaging not supported | Error | |
| 6883 # | Last command of chain expected | Error | |
| 6884 # | Command chaining not supported | Error | |
| 6900 # | Command not allowed | Error | |
| 6981 # | Command incompatible with file structure | Error | |
| 6982 # | Security status not satisfied | Error | PIN, secure messaging, or auth required first. |
| 6983 # | Authentication method blocked | Error | Retry counter exhausted. |
| 6984 # | Referenced data invalidated | Error | |
| 6985 # | Conditions of use not satisfied | Error | |
| 6986 # | Command not allowed (no current EF) | Error | |
| 6987 # | Expected SM data objects missing | Error | |
| 6988 # | SM data objects incorrect | Error | |
| 6A00 # | Wrong parameters P1-P2 | Error | |
| 6A80 # | Incorrect parameters in data field | Error | |
| 6A81 # | Function not supported | Error | |
| 6A82 # | File not found | Error | |
| 6A83 # | Record not found | Error | |
| 6A84 # | Not enough memory in file | Error | |
| 6A85 # | Lc inconsistent with TLV structure | Error | |
| 6A86 # | Incorrect parameters P1-P2 | Error | |
| 6A87 # | Lc inconsistent with P1-P2 | Error | |
| 6A88 # | Referenced data not found | Error | |
| 6A89 # | File already exists | Error | |
| 6B00 # | Wrong P1 / P2 | Error | |
| 6C00 # | Correct length is in SW2 | Warning | Reissue with correct Le. |
| 6D00 # | INS not supported | Error | |
| 6E00 # | CLA not supported | Error | |
| 6F00 # | No precise diagnosis | Error | Implementation-defined error. |
| 9484 # | Algorithm not supported (GP) | GP | |
| 9485 # | Invalid key check value (GP) | GP | |
| 6985 # | CONDITIONS_NOT_SATISFIED — user presence required (U2F) | FIDO | Common during U2F register/authenticate when test-of-user-presence has not been completed. |
| 6A80 # | WRONG_DATA — invalid data (U2F) | FIDO | |
| 6D00 # | INS_NOT_SUPPORTED (U2F) | FIDO |
What this reference covers
Spec
ISO/IEC 7816-4 §5.1.6.
Companion tool
Reading
Usage notes
Read SW1 SW2 as one 16-bit value. SW1 broadly classifies the outcome and SW2 refines it: 0x9000 is success, 0x61xx tells you SW2 bytes are still waiting (issue a GET RESPONSE), and 0x6Cxx tells you to re-issue the command with SW2 as the expected length. The 0x62xx/0x63xx ranges are warnings — the command completed but with a caveat (e.g. 0x63Cx reports x verification attempts remaining).
- Codes are card- and applet-dependent: the same
0x6A80can mean different things across ISO, EMV, and vendor definitions, so always check against the card's specification. - Never log a raw PIN or key when decoding a
0x63Cxretry-counter response. - Pair this reference with the SW1/SW2 lookup and the ISO 7816 reference when debugging a command exchange.
Frequently asked questions
What is a status word?
The two bytes, SW1 and SW2, that end every APDU response. 9000 is success; everything else is a warning or error.
Why do the same bytes mean different things?
ISO/IEC 7816-4 defines a common set and leaves ranges to the application, so GlobalPlatform, EMV and FIDO each define their own within those ranges.
What do 61xx and 6Cxx mean?
Neither is a failure. 61xx means XX more bytes are waiting and you should issue GET RESPONSE; 6Cxx means the Le you sent was wrong and XX is the correct value.
What is the difference between the 62/63 and 6A families?
62 and 63 are warnings: the command completed but with qualification. 6A values are checking errors, meaning the command was rejected before execution.
What does 6982 indicate?
Security status not satisfied — a valid command issued without the authentication it requires, typically before a secure channel has been established.