DESFire Status Codes
Documented DESFire EV1/EV2/EV3 response status codes with meaning and context. Search by code or by phrase.
What this reference covers
Spec
NXP DESFire EV1 / EV2 / EV3 datasheets.
Companion tool
What this reference does not cover
These are native DESFire status bytes — the single byte a native command returns. If your reader stack wraps commands in ISO 7816-4 APDUs, you will see two-byte SW1/SW2 values instead, and 91xx is the usual carrier for a native status inside a wrapped response. Check which framing you are using before looking a value up here.
Coverage is the documented EV1, EV2 and EV3 set. Later generations add codes for the features they introduce, and some readers surface their own transport-level errors that never came from the card at all — a timeout or a field drop is not a DESFire status.
Frequently asked questions
What does a DESFire status byte look like?
A single byte rather than the two-byte SW1/SW2 of ISO 7816-4 — 0x00 for OPERATION_OK, and specific codes for each error condition.
What is ADDITIONAL_FRAME?
Status 0xAF, meaning the card has more to send or expects more from you. Continue the exchange rather than treating it as a failure.
What causes AUTHENTICATION_ERROR?
The wrong key, wrong key number, or wrong crypto type for the application — or issuing a command that requires a session before authenticating.
Why do I see PERMISSION_DENIED on a readable file?
The access-rights word names a key you have not authenticated with in this session. Selecting an application clears authentication state.
Do status codes differ between EV1, EV2 and EV3?
The common set is stable across generations; later generations add codes for the features they introduce, such as transaction MAC and proximity check.