Native analysis traces use envelope schema 1 and their own payload.schemaVersion: 1. This is independent of HCE card-profile payload schemas. Import also accepts legacy payload.payloadVersion; if both fields are supplied they must be valid and equal. New exports use schemaVersion only.
Before starting
- Use an Android device with NFC enabled.
- Analyze only cards and test media that you are authorized to inspect.
- Keep other NFC cards and tags away, and hold the card steadily within the phone's NFC field during analysis.
EMV Card Analyzer is a bounded diagnostic reader, not a payment kernel. It does not authorize transactions, validate issuer cryptography or determine whether a card is genuine.
Run an analysis
- Open the Analyzer and confirm that NFC is available and enabled.
- Start an analysis, then hold the contactless card against the device's NFC antenna.
- Keep the card in place while the application performs bounded directory selection, application selection, processing-options retrieval and supported AFL record reading.
- Keep the card in place until the app reports Completed, Incomplete, Unsupported, Interrupted or Failed.
Understand the result
Completed means that the supported analysis procedure reached its normal boundary. Incomplete preserves useful data when one or more applications could not be read completely. Unsupported identifies a card technology or application outside the supported reading procedure. Interrupted identifies lost communication, while Failed provides the available technical reason.
Compatibility varies between cards, devices and application profiles. An incomplete analysis does not by itself establish that a card is invalid.
Inspect APDU and EMV data
Application details organize discovered records and tags. The APDU timeline exposes raw commands and responses with contextual command, status-word, BER-TLV and DOL decoding where their meaning is known. All tags is an offline view of the already captured analysis, not an additional card read. Bundled Tag reference and APDU response-code screens help interpret recognized values without sending analysis data to a network service.
Understand Card response timing
Card response shows the recorded time spent exchanging one APDU command with the card, including reader communication and waiting for the response. It is not a measurement of card processing alone. If no complete response arrives, the available timing describes the unsuccessful exchange. Duration in the analysis summary covers the overall analysis. Older captures without a measurement show Not recorded rather than zero.
Keep results while moving between screens
Switching tabs, backgrounding the app or rotating the screen stops NFC reading without restarting it automatically. The live result stays available while the app process remains alive. Start replaces it; changing the selected brand clears it. Saved History is independent of this temporary workspace.
Use history, reports and traces
Analysis snapshots and optional notes are stored locally on the device. History supports result filtering, single-record deletion with Undo, clearing history, detailed report export and portable diagnostic traces through Android system interfaces. Reports can be saved or shared in Markdown, HTML or PDF; Trace exports a native JSON file. Choose History → Import to open a local trace for preview; choose Save to history only if you want to keep that imported analysis.
Full evidence exports may contain captured APDUs, notes and sensitive card data. Redacted exports remove card-derived values and notes while preserving diagnostic structure. Redacted is not a guarantee of anonymity: review the retained diagnostic context before sharing either form. An imported Redacted trace cannot restore the removed values and can only be exported again as Redacted. Review the selected evidence level and resulting file before sharing it.
A .hceimage.json trace identifies itself as com.hceimage.diagnostic / emv-analysis. It is a recorded diagnostic result, not an HCE card profile.
Settings and data safety
Settings controls analysis lifecycle, an optional no-card timeout, history retention, appearance and Logcat detail. Release builds default to session-level diagnostics; choosing APDU-level logging can place complete card data in local device logs. The summary masks card numbers until explicitly revealed, but APDU details and Full evidence exports can still contain sensitive values. Check screenshots, clipboard contents and exported files before sharing them.