STK Proactive Command Decoder
🔒 Runs in your browser
Paste a proactive command above to decode it.
Traces can contain subscriber identifiers (IMSI/IMEI). This runs in your browser — nothing is uploaded. Use the masker before sharing a trace.
For lawful, educational and professional-testing use. Provided as is, without warranty.
What a proactive command is
A SIM Toolkit (STK) applet cannot act on its own — the SIM is a passive card that only answers
the phone. So the card uses a reversed conversation called the Card Application Toolkit (CAT,
ETSI TS 102 223): when the handset polls it, the SIM replies with a proactive
command that tells the phone what to do — show a menu, display a line of text, ask for
input, place a call, send an SMS or a USSD string, refresh a file, open a data channel, and so
on. Every command is a single BER-TLV object whose outer tag is D0. Paste that hex
string here to see the command type and each of its fields.
BER-TLV and comprehension-TLVs
Inside the D0 wrapper the command is a list of tag-length-value (TLV) records.
CAT uses a variant called the comprehension-TLV, where the top bit of the tag is a
comprehension-required (CR) flag telling the phone whether it must understand that record. The
first record is always the Command details TLV (tag 01), whose third byte
holds the command type — 0x21 for DISPLAY TEXT, 0x25 for SET UP MENU, 0x13 for SEND SHORT
MESSAGE and so on. The records that follow carry the payload: a Text string (tag 0D) begins
with a data-coding byte then the message, an Alpha identifier (85) labels a menu, Item records
(0F) list menu entries, and Device identities (02) name the source and destination.
Reading the output
The decoder shows the command type on top, then every TLV with its tag name, raw hex value and, where the value is human-readable text, the decoded string. Text encoded with an 8-bit data-coding scheme is shown directly; GSM-7 packed or UCS-2 text is left as hex. Everything runs in your browser — nothing is uploaded, which matters because captured STK traces can carry subscriber-related data. Mask a trace before sharing it.
Frequently asked questions
What does this decode?
SIM Toolkit applets drive the phone with proactive commands (ETSI TS 102 223), sent as a BER-TLV structure starting with tag D0. This tool parses that structure into the command type and its comprehension-TLVs, decoding text strings, items and identities.
Which commands are recognised?
DISPLAY TEXT, GET INKEY, GET INPUT, SET UP MENU, SELECT ITEM, SEND SHORT MESSAGE, SEND USSD, SET UP CALL, REFRESH, OPEN/CLOSE CHANNEL and more, read from the command details TLV.
Does it run offline?
Yes — the decoding is pure client-side JavaScript. Nothing is uploaded, which matters because STK traces can carry subscriber-related data.