Ambimat GroupAmbimatAmbiSecureSIMAuthAmbiAutomationEngineering BlogAhmedabad · India · Est. 1982
Smart-card reference

APDU Status Dictionary

The full reference table of smart-card status words (SW1 SW2). Filter by source (ISO 7816-4, GlobalPlatform, EMV, FIDO) and search by hex or by description. A bookmark-worthy quick reference.

ReferenceISO + GP + EMV + FIDO

How to use this tool

What it does

Presents the full reference table of smart-card status words, filterable by source (ISO 7816-4, GlobalPlatform, EMV, FIDO) and searchable by hex or description.

When to use it

Use it when you want the whole status-word landscape in one place — for building a decoder, writing test assertions, or learning the ranges rather than one code at a time.

Worked example

Filter to GlobalPlatform and scan the 0x69xx range to compare related security-condition codes side by side.

Search

Static reference — no input leaves your browser.

Reading the table

Status words are 2 bytes; we group 9XYY as success/proprietary, 6XYY as warnings or errors. 61XX means “more data”; 6CXX means “wrong Le, exact length is XX”. 63CX is the PIN-retries-remaining encoding.

Search

For a single SW lookup with multi-match support.

SW lookup →

Pillar post

How APDUs work, with examples.

APDU from first principles →

Companion tool

Decode a full APDU including its SW.

APDU parser →

Frequently asked questions

Which specifications does this dictionary cover?

ISO/IEC 7816-4 as the base, plus the application-specific ranges defined by GlobalPlatform, EMV and FIDO U2F.

Why can one status word appear more than once?

Because ISO leaves ranges to the application. The same bytes carry different meanings depending on which specification the command belongs to, so context decides.

What is the general shape of the 6x family?

62 and 63 are warnings where the command completed with qualification, 64 to 66 are execution errors, 67 to 6F are checking errors where the command was rejected before execution.

What does 6982 mean in practice?

Security status not satisfied — the command is valid but the session lacks the required authentication. It is the usual response to acting before establishing a secure channel.

Does anything I paste leave my browser?

Nothing. The tool is entirely client-side: the page ships a static script, does no network calls, and never transmits what you paste. You can confirm it by opening the network tab, or by loading the page and then going offline.