Secure Messaging Field Visualizer
Walk the BER-TLV body of an ISO/IEC 7816-4 secure-messaging APDU: 87 (encrypted with padding indicator), 97 (Le), 99 (status), 8E (MAC), 84 (legacy cryptogram). The companion to the SCP03 walkthrough.
How to use this tool
What it does
Visualises smart-card secure messaging — how command and response APDUs are wrapped, MACed and encrypted.
When to use it
Use it to understand how a secure channel protects each APDU once a session is established.
Worked example
Walk a wrapped command to see which parts are encrypted and where the C-MAC is appended.
Input
Decoded
About secure messaging
ISO/IEC 7816-4 §6 defines a BER-TLV encoding where data objects in the body of an APDU describe encrypted payloads (87/86), expected-length (97), processing status (99), and a cryptographic checksum (8E) over the command. The CLA byte signals SM is in effect via bits b3..b2.
Spec
ISO/IEC 7816-4 §6 and Annex A.
Companion
Sequence diagram generator · CLA decoder · SCP03 walkthrough
Reading
Frequently asked questions
What is secure messaging?
ISO 7816-4 protection of APDU content, wrapping command and response data in BER-TLV data objects that provide confidentiality, integrity, or both.
What do DOs 87, 97, 99 and 8E carry?
87 is the enciphered data with a padding indicator, 97 the protected Le, 99 the protected status word, and 8E the cryptographic checksum over the preceding objects.
Why does the MAC cover the status word?
So a response cannot be altered to report success. Protecting the data but leaving SW1/SW2 in the clear leaves an attacker able to flip a failure into an OK.
What is DO 84 for?
It is the legacy cryptogram object, present in older schemes that predate the 87 padding-indicator form. Seeing it usually means an older specification profile is in use.
Does anything I paste leave my browser?
Nothing. The tool is entirely client-side: the page ships a static script, does no network calls, and never transmits what you paste. You can confirm it by opening the network tab, or by loading the page and then going offline.