GlobalPlatform Status Reference
GlobalPlatform 2.3.1 card and application lifecycle states, with the corresponding GET STATUS / SET STATUS bytes and the implications for what you can do at each stage.
How to use this tool
What it does
Looks up GlobalPlatform card and applet life-cycle states and status words.
When to use it
Use it when managing a card's content and you need to interpret a life-cycle or GET STATUS value.
Worked example
Resolve an applet state byte to SELECTABLE or LOCKED.
Card lifecycle states
| Hex | State | Meaning |
|---|---|---|
| 01 | OP_READY | Initial state after personalisation. Card is ready to load applications and accept commands. |
| 07 | INITIALIZED | Default ready-for-use state for many issuers. Apps may be installed and made selectable. |
| 0F | SECURED | Operational lifecycle for end-users. ISD privileges restricted; secure channel required for management operations. |
| 7F | CARD_LOCKED | Card management blocked; only the ISD can move it back. End-user apps may still be selectable depending on policy. |
| FF | TERMINATED | Permanent end-of-life. Card cannot be unlocked. All management commands rejected. |
Application lifecycle states
| Hex | State | Meaning |
|---|---|---|
| 03 | INSTALLED | Linked but not selectable. Result of INSTALL [for install] before INSTALL [for make selectable]. |
| 07 | SELECTABLE | Selectable by AID; may receive APDUs. |
| 0F | PERSONALIZED | Application has been personalised (issuer-defined transition). |
| 83 | LOCKED | Selectable=No. Only ISD can transition out. APDUs to it are rejected. |
Common ISD privileges
Privileges control what an Issuer Security Domain (or other SD) is allowed to do. Encoded as a bitmap in INSTALL / SET STATUS commands.
- Security Domain — the entity is a SD.
- DAP Verification — verifies application code signatures during loading.
- Mandated DAP — may force DAP verification on others.
- Card Reset — may reset the card.
- CVM Management — may handle global PIN.
- Final Application — selected by default if no other AID is selected.
- Token Verification — may verify install tokens.
- Authorized Management — may load apps without DAP if policy allows.
When you need this
When a GET STATUS APDU returns lifecycle bytes you don’t recognise, or when you’re trying to figure out why your applet isn’t selectable, this table is the fast answer.
Spec
GlobalPlatform Card Specification 2.3.1.
Frequently asked questions
What are GlobalPlatform card lifecycle states?
OP_READY, INITIALIZED, SECURED, CARD_LOCKED and TERMINATED. Production cards ship in SECURED; TERMINATED is irreversible and permanently ends the card's life.
What are application lifecycle states?
INSTALLED, SELECTABLE, and application-specific states such as PERSONALIZED, plus LOCKED. An applet must be SELECTABLE before it can be chosen by AID.
What is the Issuer Security Domain?
The on-card representation of the issuer, holding the keys that authorise card-management commands. Its privileges determine what may be loaded, installed or deleted.
Why does INSTALL fail with a security status error?
Because no authenticated secure channel is in place, or the security domain lacks the privilege for the operation. Card management requires a mutually authenticated SCP session first.
Does anything I paste leave my browser?
Nothing. The tool is entirely client-side: the page ships a static script, does no network calls, and never transmits what you paste. You can confirm it by opening the network tab, or by loading the page and then going offline.