Raw NFC Commands: APDUs, Page Reads, and What the Command Console Sends

A raw NFC command is a short string of bytes you send straight to the chip, with nothing decoding it for you on the way. Instead of asking the tag for "the URL" or "the contact card," you ask for specific bytes from specific addresses and read back exactly what the silicon returns. There are really two byte languages at play: the short page commands that Type 2 tags understand, and the longer ISO 7816-4 APDUs that smart cards expect. Knowing which one a tag speaks is most of the battle.

What a raw command actually is

Most NFC apps hand you a decoded result. They run the low-level conversation, parse the NDEF records, and show you a tidy link or text. Raw mode removes that translation layer. You write the command bytes, the reader adds error-checking and timing, and the tag answers in bytes. Nothing is interpreted for you, which is exactly the point when you want to see lock bytes, a capability container, or a counter that the friendly view hides.

The Type 2 command set — READ, FAST_READ, WRITE

Consumer tags like NTAG213, NTAG215, and NTAG216 are NFC Forum Type 2 chips, and their memory is organized into pages of exactly four bytes each, per the NXP NTAG datasheet. The commands are short:

READ       0x30 <page>              -> 16 bytes (four pages)
FAST_READ  0x3A <start> <end>       -> every page in that range
WRITE      0xA2 <page> <4 bytes>    -> writes one page
GET_VERSION 0x60                    -> chip product/version bytes

The quirk that trips people up: READ 0x30 always returns sixteen bytes — four consecutive pages — even when you only cared about one. FAST_READ 0x3A is the efficient way to pull a whole memory dump in a single exchange, because you give it a start and end page and it streams everything between them. WRITE 0xA2 is the opposite: it touches exactly one four-byte page, so changing a larger record means several writes in a row.

APDUs — the ISO 7816-4 format

Smart cards and the more capable tags speak a different, longer format called an APDU. A command APDU starts with a four-byte header — CLA, INS, P1, P2 — and then optionally carries Lc (how many data bytes follow), the data itself, and Le (how many bytes you expect back), as described in the ISO 7816-4 APDU reference. The reply is an optional data field followed by a mandatory two-byte trailer, SW1 and SW2. When you see 90 00 at the end of a response, that is the conventional "command succeeded" status.

This is also where the MIFARE family diverges. MIFARE Classic uses sixteen-byte blocks and requires an authentication step before it will read or write, and some chips use a two-part COMP_WRITE sequence rather than the simple one-shot page write. Same idea, more ceremony.

Where you'll see it — iOS vs Android

On Android, raw access is straightforward: open the tag's technology class and call transceive with your byte array. NfcA, IsoDep, NfcV, and the MifareUltralight helper all expose this, as the Android NfcA reference shows. On iOS, Core NFC supports raw commands too, through types like NFCMiFareTag and NFCISO7816Tag, but the reader/writer stack is narrower than Android's, so a few low-level operations simply are not available.

Tips, gotchas, and a quick how-to with NFCore

A few things save time. Type 2 commands address pages, not bytes, so multiply by four to find an offset. The reader adds the CRC and handles timing, so you send only the command bytes shown above. Password-protected pages answer reads with all-zero bytes rather than an error, which can look like a blank tag when it is just locked.

In NFCore, the Command Console lets you type these bytes directly and watch the raw response come back, hex and ASCII side by side — handy for confirming a write landed or checking which pages are protected before you change anything. Keep it to tags you own: your own stickers, business cards, and smart-home triggers. Try it from the App Store or Google Play.

FAQ

What is the difference between a page read and an APDU? A page read is a tiny Type 2 command (like 0x30) that returns fixed four-byte pages. An APDU is the longer ISO 7816-4 format with a CLA/INS/P1/P2 header used by smart cards and richer tags.

Why does my READ return 16 bytes when I asked for one page? That is by design. READ 0x30 always replies with four consecutive pages — sixteen bytes — starting at the page you named.

Can I send raw commands on an iPhone? Yes, through Core NFC, but the supported command set is narrower than Android's, so some operations are Android-only.

What does 90 00 mean? It is the status trailer SW1 SW2 that conventionally means the command completed successfully.