APDU Trace Decoder
🔒 Runs in your browser
Paste a hex trace above. Each command and each status word (4 hex chars) is decoded separately.
Traces can contain subscriber identifiers (IMSI/IMEI). This runs in your browser — nothing is uploaded. Use the masker before sharing a trace. Open the IMSI/ICCID masker
For lawful, educational and professional-testing use. Provided as is, without warranty.
What an APDU is
An APDU (Application Protocol Data Unit) is the command-and-response unit that
a phone exchanges with a SIM or smart card, defined by ISO/IEC 7816-4. A
command APDU begins with four header bytes — CLA (class), INS
(instruction), and two parameters P1 and P2 — optionally followed by
Lc (the length of the command data), the data itself, and Le (how many
response bytes are expected). This tool splits a pasted hex trace into whitespace-separated
chunks and decodes each one: a longer chunk is treated as a command and a four-hex-digit chunk
as a status word.
The status word
The card answers every command with any response data followed by a two-byte
status word (SW1 SW2). 9000 means success; 61xx
means xx response bytes are waiting behind a GET RESPONSE;
6A82 is file not found; 63Cx is a failed PIN with x tries
left; and there are many more. The decoder labels each status word in plain English so you do
not have to keep the table in your head. The CLA byte also hints at the card
generation — A0 for a 2G SIM, 00/80 for a UICC/USIM.
Privacy
Everything runs in your browser — nothing is uploaded. Because SIM traces can carry subscriber identifiers such as an IMSI or IMEI, mask them first if you plan to share a trace. This is a structural decoder for lawful, educational and professional-testing use.
Frequently asked questions
What is an APDU?
An APDU (Application Protocol Data Unit) is the command-response unit exchanged between a phone and a SIM/smart card (ISO 7816-4). A command carries CLA, INS, P1, P2 and optional data; the card answers with data and a two-byte status word. This tool decodes a pasted hex trace into readable fields.
What do the status words mean?
The final two bytes are the status word: 9000 is success, 61xx means response bytes are available, 6A82 file not found, 63Cx a failed PIN with x tries left, and so on. The decoder labels each one so you do not have to memorise the table.
Is my trace uploaded?
No. Decoding runs entirely in your browser. Because traces can contain subscriber data, nothing is transmitted — and you can mask identifiers first with the IMSI/ICCID masker.