Ambimat GroupAmbimatAmbiSecureSIMAuthAmbiAutomationEngineering BlogAhmedabad · India · Est. 1982
ASAmbiSecureHardware-rooted security
Contact

APDU status words are the two trailing bytes (SW1 SW2) a smart card returns after every command APDU, telling the host whether the command succeeded and, if not, why. 0x9000 means normal completion; the 0x61xx range signals more data is available; 0x63xx warns of a state change (for example a retry counter); and the 0x6xxx error ranges cover everything from wrong length (0x6700) to security-status-not-satisfied (0x6982) and file-not-found (0x6A82). ISO/IEC 7816-4 defines the core set, which GlobalPlatform, EMV, and FIDO U2F extend with their own codes.

ISO 7816-4 / GP / EMV / FIDO

APDU Status Words

Searchable reference for APDU status words. ISO/IEC 7816-4 standard codes plus GlobalPlatform, EMV, and FIDO U2F additions. Search by code or by phrase.

What this reference covers

Spec

ISO/IEC 7816-4 §5.1.6.

Companion tool

SW1/SW2 lookup · APDU status dictionary

Reading

APDU from first principles

Usage notes

Read SW1 SW2 as one 16-bit value. SW1 broadly classifies the outcome and SW2 refines it: 0x9000 is success, 0x61xx tells you SW2 bytes are still waiting (issue a GET RESPONSE), and 0x6Cxx tells you to re-issue the command with SW2 as the expected length. The 0x62xx/0x63xx ranges are warnings — the command completed but with a caveat (e.g. 0x63Cx reports x verification attempts remaining).

  • Codes are card- and applet-dependent: the same 0x6A80 can mean different things across ISO, EMV, and vendor definitions, so always check against the card's specification.
  • Never log a raw PIN or key when decoding a 0x63Cx retry-counter response.
  • Pair this reference with the SW1/SW2 lookup and the ISO 7816 reference when debugging a command exchange.

Frequently asked questions

What is a status word?

The two bytes, SW1 and SW2, that end every APDU response. 9000 is success; everything else is a warning or error.

Why do the same bytes mean different things?

ISO/IEC 7816-4 defines a common set and leaves ranges to the application, so GlobalPlatform, EMV and FIDO each define their own within those ranges.

What do 61xx and 6Cxx mean?

Neither is a failure. 61xx means XX more bytes are waiting and you should issue GET RESPONSE; 6Cxx means the Le you sent was wrong and XX is the correct value.

What is the difference between the 62/63 and 6A families?

62 and 63 are warnings: the command completed but with qualification. 6A values are checking errors, meaning the command was rejected before execution.

What does 6982 indicate?

Security status not satisfied — a valid command issued without the authentication it requires, typically before a secure channel has been established.