ISO/IEC 7816 Quick Reference
A condensed, bookmark-friendly view of the parts of ISO/IEC 7816 you reach for most often: APDU structure, common INS bytes, file/record types, and the secure-messaging bits in CLA.
How to use this tool
What it does
Provides a quick reference to ISO 7816-4 interindustry commands and their CLA/INS values.
When to use it
Use it to recall the instruction byte for SELECT, READ BINARY, VERIFY and the rest without opening the standard.
Worked example
Confirm that GET RESPONSE is 0xC0, the command you issue after a 0x61xx status.
APDU shape
A command APDU is a 4-byte header — CLA, INS, P1, P2 — plus optional Lc + data + Le.
| Case | Shape | Meaning |
|---|---|---|
| 1 | CLA INS P1 P2 | No data, no response body. |
| 2 | CLA INS P1 P2 Le | No data, expecting Le bytes. |
| 3 | CLA INS P1 P2 Lc Data | Sending data, no body expected. |
| 4 | CLA INS P1 P2 Lc Data Le | Both directions. |
Extended-length APDUs prefix Lc and Le with a 0x00 byte and use 2-byte values, allowing up to 65535 bytes per direction. Negotiated via T0 historical bytes / SELECT response.
CLA bits
| Bits | Meaning |
|---|---|
| b8..b5 = 0000 | Inter-industry, ISO 7816-4. |
| b8 = 1 | Proprietary range (e.g. 0x80–0xBF — GlobalPlatform uses 0x80). |
| b4..b3 = 00 | No secure messaging. |
| b4..b3 = 10 | Secure messaging — header authenticated. |
| b4..b3 = 11 | Secure messaging — full (cmd + body). |
| b2..b1 | Logical channel (0–3). |
Common INS bytes
| INS | Name |
|---|---|
| 20 | VERIFY (PIN/CHV) |
| 22 | MANAGE SECURITY ENVIRONMENT |
| 24 | CHANGE REFERENCE DATA |
| 2A | PERFORM SECURITY OPERATION |
| 2C | RESET RETRY COUNTER |
| 46 | GENERATE ASYMMETRIC KEY PAIR |
| 70 | MANAGE CHANNEL |
| 82 | EXTERNAL AUTHENTICATE |
| 84 | GET CHALLENGE |
| 86 | GENERAL AUTHENTICATE |
| 88 | INTERNAL AUTHENTICATE |
| A4 | SELECT (FILE / AID) |
| B0 | READ BINARY |
| B2 | READ RECORD |
| C0 | GET RESPONSE |
| CA | GET DATA |
| D0 | WRITE BINARY |
| D2 | WRITE RECORD |
| D6 | UPDATE BINARY |
| DA | PUT DATA |
| DC | UPDATE RECORD |
| E0 | CREATE FILE |
| E2 | APPEND RECORD |
| E4 | DELETE FILE / DELETE (GP) |
| E6 | TERMINATE DF / INSTALL (GP) |
| E8 | TERMINATE EF / LOAD (GP) |
| F2 | STATUS / GET STATUS (GP) |
Standards in this family
ISO/IEC 7816 has 15+ parts; the ones smart-card developers reach for most: -3 (electrical, ATR), -4 (organisation, security, commands), -8 (commands for security operations), -9 (commands for card management), -15 (cryptographic information application).
Spec
ISO 7816-4 (the one to read first).
Frequently asked questions
What is in a command APDU?
A four-byte header of CLA, INS, P1 and P2, then optionally Lc with command data, and optionally Le giving the expected response length.
What are the common INS bytes?
A4 SELECT, B0 READ BINARY, D0 WRITE BINARY, B2 READ RECORD, E2 APPEND RECORD, 20 VERIFY, 88 INTERNAL AUTHENTICATE, 84 GET CHALLENGE, C0 GET RESPONSE.
What file types does ISO 7816 define?
The master file, dedicated files as directories, and elementary files holding data — transparent, linear fixed, linear variable and cyclic.
When are extended-length APDUs needed?
Above 255 bytes of command data or 256 of response. Both card and reader must support it, and Lc and Le then occupy three bytes each.
Does anything I paste leave my browser?
Nothing. The tool is entirely client-side: the page ships a static script, does no network calls, and never transmits what you paste. You can confirm it by opening the network tab, or by loading the page and then going offline.