DESFire Key Settings Interpreter
Decode the 2-byte DESFire GetKeySettings (0x45) response: keySettings byte (ChangeKey access, config flags, master-key changeable), and the numKeys / crypto-type byte.
How to use this tool
What it does
Decodes DESFire key-settings and key-configuration bytes into their individual flags.
When to use it
Use it when reviewing a DESFire application's key policy — whether keys can be changed, listed, or the master settings frozen.
Worked example
Decode a key-settings byte to see whether the change-key and configuration-change permissions are set.
Input
Decoded
About DESFire key settings
The keySettings byte governs ChangeKey privilege, configuration freeze, and whether the application master key can be rolled. The companion byte carries the crypto type (DES / 3DES / AES-128) and the number of application keys (0–14).
Frequently asked questions
What does GetKeySettings return?
Two bytes plus a crypto indicator: the keySettings byte of configuration flags, and a byte whose low nibble is the number of keys in the application and whose high bits indicate DES, 3DES or AES.
What is in the keySettings byte?
Which key may change other keys, whether the configuration is still changeable, whether directory listing requires authentication, and whether the master key itself may be changed.
What does 'configuration changeable' being cleared mean?
That the settings are frozen for the life of the application. It is deliberately irreversible, so it belongs at the end of personalisation rather than during development.
How many keys can an application hold?
Up to 14, referenced 0 to 13. Key 0 is the application master key and is the one authenticated for most management operations.
Does anything I paste leave my browser?
Nothing. The tool is entirely client-side: the page ships a static script, does no network calls, and never transmits what you paste. You can confirm it by opening the network tab, or by loading the page and then going offline.