DESFire Access-Rights Decoder
Decode the 16-bit DESFire access-rights word into the four key references it controls: Read, Write, Read+Write, and ChangeAccessRights. Reference content based on public ISO/IEC 14443-4 framing and NXP application notes.
How to use this tool
What it does
Expands a DESFire access-rights value into the four key references it encodes (read, write, read&write, change).
When to use it
Use it when a file's two access-rights bytes need translating into which key authorises each operation.
Worked example
Enter 0x1234 to map each nibble to its authorising key number.
Input
Decoded
What the four nibbles mean
DESFire access-rights are encoded as a 16-bit value, four 4-bit fields: b15..b12 Read, b11..b8 Write, b7..b4 Read+Write, b3..b0 ChangeAccessRights. Each field is a key number 0…13, or 0xE for free access (no authentication required), or 0xF for “always denied”. So 0x1230 means: read with key 1, write with key 2, read+write with key 3, and change-rights with key 0.
Companion tool
Command reference
Architecture
Closed-loop
Frequently asked questions
What does the access-rights word encode?
Four 4-bit key references packed into 16 bits: Read, Write, Read+Write and ChangeAccessRights, in that order from the high nibble down.
What do key references 0xE and 0xF mean?
0xE means free access with no authentication required; 0xF means the operation is denied to everyone, permanently. Any other value is the number of the key that must be authenticated first.
What is the difference between Read+Write and holding both?
Read+Write is a single key reference permitted to do either. It exists so one key can cover both operations without granting the separate Read and Write keys.
Why can I no longer change a file's access rights?
Because ChangeAccessRights was set to 0xF, which is irreversible for that file. This is the most common way to brick a file's configuration during development.
Does anything I paste leave my browser?
Nothing. The tool is entirely client-side: the page ships a static script, does no network calls, and never transmits what you paste. You can confirm it by opening the network tab, or by loading the page and then going offline.