IAD Decoder
Decode Issuer Application Data (EMV tag 9F10) for Visa and Mastercard. Parses the CVN, DKI, ATC, and Card Verification Results with full bit-level breakdown.
What the Issuer Application Data (9F10) carries
The Issuer Application Data (IAD), EMV tag 9F10, is a variable-length, scheme-proprietary container the card generates and the terminal passes transparently to the issuer host in the authorisation request. Its job is to let the card speak directly to its issuer: it carries the data needed to validate the application cryptogram and to report what the card's own risk management decided.
Why the format depends on the scheme
Unlike a fixed EMV bitmap, the IAD's internal layout is defined by each payment scheme, so the same tag is parsed differently for Visa (VIS) and Mastercard (M/Chip). This decoder selects the format and breaks out the common elements: the Derivation Key Index (DKI), the Cryptogram Version Number (CVN) — which tells the issuer exactly how the ARQC was computed — and the Card Verification Results (CVR), a sub-bitmap of what the card's risk management did, plus counters such as the application transaction and offline-decline counts.
The CVN is the field to read first: it determines the cryptogram key derivation, the session key method, and the exact data the issuer must assemble to verify the ARQC. A mismatch here is a leading cause of cryptogram-validation failures at the host.
Common questions
Why does my IAD not parse?
You are probably decoding it against the wrong scheme. Confirm whether the card is Visa or Mastercard and select the matching format — the byte boundaries differ.
What is the CVR used for?
The Card Verification Results report the card's own risk-management decisions (offline PIN outcome, counters exceeded, last-online status) so the issuer can see what the chip did, not just what the terminal reported.
Layouts follow the Visa and Mastercard cryptogram specifications. All parsing happens locally in your browser — nothing you paste is transmitted or stored.