Why a DESFire Card Shows No NDEF Records on Your Phone

Short answer

Your phone shows no NDEF records because the card has no NDEF data in the layout phones look for. A MIFARE DESFire card is a toolbox of applications and files. It only looks like an NDEF tag once someone sets it up that way. This guide is for cards you own, such as a blank DESFire you bought for a project.

Why the phone sees nothing

DESFire EV1 is compatible with the NFC Forum Type 4 format, but it only hosts an NDEF application once it has been set up. WakDev's DESFire EV1 notes say NDEF reading and writing in NFC Tools needs the card formatted as Type 4 first.

Cards built for other jobs, like access control or transit, carry their own applications and no NDEF one. The phone detects the card, then finds nothing it can parse as a message. For what each platform can and can't do with these cards, see what iPhone and Android can read from a DESFire card.

What a phone-readable layout looks like

One community example, from a Dangerous Things forum thread, shows the pieces:

• An application with AID 000001 and DF name D2760000850101, the standard NDEF application name.
• File 01 with ISO ID E103, 15 bytes: the capability container (CC).
• File 02 with ISO ID E104, 2000 bytes: the NDEF file itself.
• Free access rights, so no key is needed to read.

The phone selects the NDEF application, reads the CC, learns which file holds the message, then reads that file. Miss any step and you get an empty read.

The usual culprits

No capability container

The reference reader code in libfreefare parses the CC for an NDEF File Control TLV (tag 04) to find the NDEF file and its maximum size. In the forum thread above, the CC file had to be written before an NDEF record would work.

A wrong or zero length

The first two bytes of the NDEF file are the message length, known as NLEN. The libfreefare reader reads those two bytes first, stops if the length plus two exceeds the maximum size, then reads that many bytes. A zero length means an empty message, and a wrong one means a failed read.

A malformed message

In the same thread, a short test payload read fine in NFC Tools while a longer one didn't. That points at the message bytes rather than the card's settings. Check the record header, the payload length and the NLEN value against each other.

Different IDs on older cards

Version 0 DESFire tags use different identifiers than EV1 and later. The libfreefare reader uses AID 0xEEEE10 and CC file 0x03 for version 0, and AID 0x000001 and CC file 0x01 otherwise. A tool written for one layout can miss the other.

Version and iPhone quirks

On iPhone, an app's Info.plist can list an application ID for Core NFC. An Apple engineer explained in a developer forum answer that listing D2760000850101 makes the system treat the tag as ISO 7816. Leaving it out gives you an NFCMiFareTag instead, where native commands go through sendMiFareCommand. Building an app? Pick the mode that matches how you talk to the card. Choosing a card generation? How DESFire EV2 and EV3 differ is worth a look too.

How to fix it

1. Confirm what's on the card. A reader app that shows raw tag data, such as NFCore, tells you whether the phone sees any NDEF at all.
2. Format the card as Type 4 with a tool that supports DESFire. This usually needs the card's keys. A factory-blank card typically uses default keys. A card that has been keyed for someone else's system is not yours to reformat.
3. Write a short test message first, like a few characters of text. If that reads, move on to longer payloads.
4. Check NLEN, the record header and the CC against each other if a longer message fails.

Only do this on cards you own. Reformatting a card that belongs to a transit system, employer or building won't work, and it isn't something to try.

Conclusion

An empty NDEF read on a DESFire card almost always means the NDEF layout is missing or incomplete, not that the card is broken. Check for the NDEF application, the CC file, the NDEF file and a correct length, in that order, and test with a short message.

Frequently Asked Questions

Is my DESFire card broken if the phone shows no NDEF records?

Usually not. Most DESFire cards ship for access control or transit with their own applications and no NDEF application. The phone isn't failing; there's simply no NDEF data in the layout it looks for.

Can I just write a URL to a DESFire card like an NTAG sticker?

Not directly. An NTAG has a fixed memory map, while DESFire needs an application and files created first. A tool that formats the card as Type 4 does that step for you, provided you have the card's keys.

Why does a short test message read but a longer one doesn't?

That points at the message bytes, not the card settings. In one community case a short test payload read fine while a longer one didn't, which fits a wrong length or a malformed message.