APDU Response Codes

What Are APDU Response Codes?

apduapduProtocolCommunication unit between card and reader.Click to view →-response-codes/" class="text-yellow-600 dark:text-yellow-400 underline decoration-dotted decoration-yellow-300 dark:decoration-yellow-700 underline-offset-2 hover:decoration-solid transition-colors" @mouseenter="o=true" @mouseleave="o=false" @click.prevent.stop="o=!o">APDU response codesAPDU response codesProtocolTwo-byte status codes in APDU responses.Click to view → -- also called status words -- are two-byte values (SW1-SW2) appended to every response APDU returned by a smart card. They indicate whether a command succeeded, completed with a warning, or failed with a specific error condition. Every smart card interaction, from selecting an application to verifying a PIN, ends with a status word that the host software must interpret before proceeding.

The status word system is defined by ISO 7816-4 and extended by application-specific standards such as EMV, GlobalPlatform, and ICAO 9303ICAO 9303ComplianceICAO standard for ePassport chip data and security protocols.Click to view → for ePassports.

Status Word Structure

The two bytes SW1 and SW2 are interpreted together:

Common Status Words

Engineers encounter these status words most frequently when developing smart card applications:

• 9000 -- command executed successfully without error
• 6100 -- response data available; issue GET RESPONSE with Le = SW2
• 6283 -- selected file deactivated (invalidated)
• 6982 -- security status not satisfied (authentication required)
• 6983 -- authentication method blocked (PIN locked)
• 6984 -- reference data not usable (key corrupted)
• 6985 -- conditions of use not satisfied
• 6A82 -- file or application not found
• 6A86 -- incorrect parameters P1-P2
• 6D00 -- instruction code not supported or invalid
• 6E00 -- class (CLA) not supported

Handling in Application Code

Robust smart card middleware must check the status word after every APDU exchange. A common pattern is to treat SW1=61 as a signal to issue a GET RESPONSE command to retrieve remaining data, and to map error codes to domain-specific exceptions. For SCP03 secure channels, status words are also covered by the session MAC, so tampering with the response code is detectable.

When debugging card interactions, the ATR parser and APDU trace tools are invaluable for correlating status words with the command sequence that produced them.