Ambimat GroupAmbimatAmbiSecureSIMAuthAmbiAutomationEngineering BlogAhmedabad · India · Est. 1982
NFC utility

NDEF decoder for NFC records

Walk an NDEF (NFC Data Exchange Format) message into individual records and decode the well-known types: URI, Text, Smart Poster, MIME, External (including Android AAR). Client-side only.

Client-sideNFC Forum NDEF 1.0

How to use this tool

What it does

Decodes NFC Forum NDEF messages into their records — type, payload and flags.

When to use it

Use it when reading an NFC tag or an SDM message and you need to interpret its NDEF content.

Worked example

Decode a URI record to recover the encoded link and its abbreviation prefix.

Input

Decoded

Paste hex to decode.
All decoding runs locally.

About NDEF

NDEF is the NFC Forum’s record-based message format used by NFC tags, smart posters, and Android beam handovers. A message is a sequence of records; each record has a type, an optional ID, and a payload. Well-known type U carries URIs (with a 1-byte prefix code that expands to http://www., tel:, etc.); type T carries text with a language code; type Sp is a Smart Poster (a nested NDEF message).

Spec

NFC Forum — NDEF Technical Specification.

Companion tool

UID analyzer

Architecture

DESFire

Frequently asked questions

What is NDEF?

The NFC Data Exchange Format — a lightweight record structure for carrying URIs, text, MIME payloads and custom types on NFC tags.

What is TNF?

Type Name Format: the 3-bit field that says how to interpret the record type — well-known, MIME media, absolute URI, external, or empty.

Why does my URI record look truncated at the start?

Because well-known URI records compress the scheme into a single prefix byte. 0x01 means http://www., 0x03 http://, 0x04 https:// — the tool expands it for you.

Can NDEF records be trusted?

Not by themselves. NDEF has no integrity or authenticity guarantee, so anything read from a tag is untrusted input. Signed records exist but are rarely deployed.

Does anything I paste leave my browser?

Nothing. The tool is entirely client-side: the page ships a static script, does no network calls, and never transmits what you paste. You can confirm it by opening the network tab, or by loading the page and then going offline.