Ambimat GroupAmbimatAmbiSecureSIMAuthAmbiAutomationEngineering BlogAhmedabad · India · Est. 1982
NFC / 14443

ISO/IEC 14443 Frame Explorer

Decode ISO/IEC 14443-3 anti-collision frames (REQA, WUPA, ATQA, SAK) and 14443-4 T=CL frames (RATS, I-block, R-block, S-block). The contactless-protocol counterpart to the APDU parser.

How to use this tool

What it does

Decodes ISO/IEC 14443 frames — the contactless link layer beneath NFC card communication.

When to use it

Use it when analysing a contactless capture and you need to read the frame type and payload.

Worked example

Decode a frame to distinguish a short frame, standard frame and its CRC.

Input

Decoded

Pick a frame type and paste bytes.
All decoding runs locally.

About ISO 14443

ISO/IEC 14443 is the contactless protocol stack used by transit cards, payment cards, and FIDO NFC authenticators. Part 3 covers anti-collision; part 4 (T=CL) carries APDU traffic on top of the I-block / R-block / S-block envelope.

Spec

ISO/IEC 14443-3 §6 (anti-collision); 14443-4 §7 (block format).

Frequently asked questions

What are REQA, WUPA, ATQA and SAK?

The Type A discovery sequence: the reader sends REQA (or WUPA to wake halted cards), the card answers with ATQA, anti-collision resolves the UID, and SAK reports whether the card supports ISO 14443-4.

What is RATS for?

Request for Answer To Select — it moves a card from the anti-collision layer into the ISO 14443-4 half-duplex block protocol, and the card replies with its ATS.

What are I-blocks, R-blocks and S-blocks?

I-blocks carry application data, R-blocks acknowledge or request retransmission, and S-blocks handle control such as waiting-time extension and deselect.

Why does my transaction stall on a long card operation?

The card is asking for more time with an S(WTX) request, and the reader must answer with a matching S(WTX) response. A stack that ignores WTX will time out on any slow cryptographic operation.

Does anything I paste leave my browser?

Nothing. The tool is entirely client-side: the page ships a static script, does no network calls, and never transmits what you paste. You can confirm it by opening the network tab, or by loading the page and then going offline.