APDU Script Validator
Validate a multi-line APDU script line-by-line. Each APDU is classified into ISO 7816-4 case 1 / 2 / 3 / 4 (short or extended) and checked for shape consistency. Validation only — no execution against any card.
How to use this tool
What it does
Checks an APDU script for structural correctness — lengths, cases and status-word expectations.
When to use it
Use it before running a personalisation or test script to catch malformed commands early.
Worked example
Validate a multi-command script and get flagged where an Lc does not match the data field.
Script
Validation
About APDU validation
An APDU has a fixed 4-byte header (CLA INS P1 P2). The body shape distinguishes case 1 (none), 2 (Le only), 3 (Lc + data), 4 (Lc + data + Le). Extended length is signalled by Lc starting with 0x00. This validator is shape-only — it never executes APDUs.
Spec
ISO/IEC 7816-4 §5.3 (APDU structure).
Reading
Frequently asked questions
What does this validator check?
Structure only: that each line is well-formed for ISO 7816-4 case 1, 2, 3 or 4, that Lc matches the data actually present, and that short and extended length encodings are used consistently.
Does it execute the APDUs against a card?
No. It never talks to a reader or a card — it is a static syntax check, which is what makes it safe to paste a production script into.
What are the four APDU cases?
Case 1 is header only; case 2 expects a response but sends no data (Le only); case 3 sends data and expects none (Lc only); case 4 sends and expects data (both). Most malformed scripts are a case-3 command written with an Le byte.
Why does my extended-length command fail validation?
Extended length requires a leading 00 byte and three-byte Lc/Le fields, and the two cannot be mixed within one APDU. A short Lc followed by an extended Le is the most common error.
Does anything I paste leave my browser?
Nothing. The tool is entirely client-side: the page ships a static script, does no network calls, and never transmits what you paste. You can confirm it by opening the network tab, or by loading the page and then going offline.