APDU parser for ISO 7816
Decode ISO/IEC 7816-4 command APDUs (Case 1–4, short and extended length) and response APDUs (with SW1/SW2 status-word lookup against the ISO + GlobalPlatform + EMV common dictionary). Auto-detect or force command vs response.
Input
Decoded
APDU in one line
An APDU (Application Protocol Data Unit) is the message format used between a smart-card terminal and the card. ISO/IEC 7816-4 defines four cases — combinations of command-data (Lc) and expected-response (Le) presence — and two length forms (short, where each length field is 1 byte; and extended, where they are 3 bytes). This parser handles all eight combinations and, on the response side, decodes the SW1/SW2 status word against the common dictionary (ISO 7816-4, GlobalPlatform, EMV).
Spec
ISO/IEC 7816-4 (and Annex G for extended length).
Related tools
What is an APDU?
An APDU (Application Protocol Data Unit) is the message format smart cards speak, defined by ISO/IEC 7816-4. A command APDU sent to the card starts with four header bytes — CLA (class), INS (instruction), P1 and P2 (parameters) — optionally followed by Lc (data length), the data itself, and Le (expected response length). The card replies with response data and a two-byte status word, SW1 SW2.
This tool breaks a raw APDU into those fields so you can read a reader trace or debug a failing command. Worked example: 00 A4 04 00 07 A0000002471001 is a SELECT (INS A4) by name (P1 04) of a 7-byte AID. A response ending in 90 00 means success; 6A 82 means "file or application not found". Proprietary CLA byte ranges are card-specific and are not interpreted.
Frequently asked questions
What does status word 90 00 mean?
90 00 is the ISO 7816-4 status for "command completed successfully". Other common words include 6A 82 (not found) and 69 82 (security status not satisfied).
What is the difference between Lc and Le?
Lc is the number of data bytes you send to the card; Le is the maximum number of bytes you expect back. A case-4 APDU has both.
Is my APDU trace uploaded?
No — the APDU is parsed locally in your browser.
What is the difference between a Case 3 and a Case 4 APDU?
Case 3 sends command data and expects no response body, so it carries Lc but no Le. Case 4 sends data and expects data back, so it carries both. Getting this wrong is the usual cause of a 6700 wrong-length reply.
What do status words beginning 61 or 6C mean?
They are not errors. 61 XX means the card has XX more bytes waiting and you should issue GET RESPONSE; 6C XX means your Le was wrong and XX is the correct length to re-send.