DESFire Status Decoder
Look up DESFire response status bytes (OPERATION_OK, AUTHENTICATION_ERROR, ADDITIONAL_FRAME, etc.). Reference table from public NXP application notes — no exploit content, no proprietary keys.
How to use this tool
What it does
Looks up DESFire status and error codes returned by the PICC.
When to use it
Use it when a DESFire command fails and you need the meaning of the returned status byte.
Worked example
Look up 0x9D (permission denied) after an access-controlled command is rejected.
Search
About this list
Status bytes appear at the end of every DESFire response. 00 is success; AF means there is more to come (chained response); AE means the operation isn’t allowed in the current authentication state. The full table is in NXP’s public application notes; we summarise the values you actually meet in the field.
Companion tool
Command reference
Architecture
Frequently asked questions
What does 0x00 OPERATION_OK mean in a DESFire response?
The command completed. DESFire native status is a single byte rather than the two-byte SW1/SW2 that ISO 7816-4 commands return, which is why it does not look like 90 00.
What is ADDITIONAL_FRAME (0xAF)?
Not an error: the card has more data or expects more from you. Respond with the continuation command until it returns a terminal status. Treating 0xAF as a failure is a very common integration bug.
What causes AUTHENTICATION_ERROR?
The wrong key, the wrong key number, or the wrong crypto method for the application. It also appears when a command requires an authenticated session and none has been established.
Why do I get PERMISSION_DENIED on a file I can read?
Because the access-rights word names a key you have not authenticated with in this session. Authentication state resets on select, so it must be re-established after switching application.
Does anything I paste leave my browser?
Nothing. The tool is entirely client-side: the page ships a static script, does no network calls, and never transmits what you paste. You can confirm it by opening the network tab, or by loading the page and then going offline.