DESFire File Settings Parser
Decode the DESFire GetFileSettings (0xF5) response: file type, comm settings, access rights word, and per-type fields for Standard / Backup / Value / Record / TMAC files. Reference only — no key compute.
How to use this tool
What it does
Decodes MIFARE DESFire file settings — file type, communication mode and access-rights nibbles.
When to use it
Use it when provisioning or auditing a DESFire application and you need to read a file's security configuration.
Worked example
Paste a file-settings byte string to see its read/write/change access keys resolved.
Input
Decoded
About DESFire file types
DESFire EV1/EV2/EV3 supports six file types: Standard Data, Backup Data, Value, Linear Record, Cyclic Record, and (EV2/EV3) Transaction MAC. Each carries a 16-bit access-rights word with four 4-bit fields: Read, Write, Read/Write, ChangeAccessRights. Special key values 0xE = free, 0xF = denied.
Spec
NXP DESFire EV1/EV2/EV3 datasheet; AN10922.
Companion
Command reference
Reading
Frequently asked questions
What does GetFileSettings return?
File type, communication mode, the 16-bit access-rights word, and then type-specific fields — size for standard and backup files, bounds and limited-credit flags for value files, record size and count for record files.
What are the communication settings?
Plain, MACed or fully enciphered. It is fixed per file at creation and determines how the data is protected on the contactless interface for every subsequent access.
What is the difference between a standard and a backup file?
A backup file is transactional: writes stage until a CommitTransaction and roll back on failure. A standard file writes directly, so a card torn from the field mid-write can leave partial data.
When would I use a value file rather than a standard file?
When the content is a balance. Value files provide atomic credit and debit with configurable limits and optional limited-credit, which is what closed-loop ticketing needs.
Does anything I paste leave my browser?
Nothing. The tool is entirely client-side: the page ships a static script, does no network calls, and never transmits what you paste. You can confirm it by opening the network tab, or by loading the page and then going offline.