NPA-TOOL(1)

💅 NPA-TOOL — the OpenSC tool that reads your ID card / ePassport

okay bestie, welcome to npa-tool(1) from the OpenSC Tools collection 🫶 she's a whole main character in the smartcard world and she's about to tell you everything about the little chip in your ID card or passport.

---

✨ NAME ✨

npa-tool — displays information of an ID card or ePassport. 💳🛂

---

🌸 SYNOPSIS 🌸

npa-tool [OPTIONS]

literally that's it. no positional args, just vibes and options 💅

---

🦋 DESCRIPTION 🦋

The npa-tool utility is used to display information stored on an ID card or on a passport and to perform some write and verification operations. no cap, she does reads and writes and checks.

Extended Access Control version 2 is performed according to ICAO Doc 9303 or BSI TR-03110 so that an ICAO compliant machine readable travel document (MRTD) as well as EAC compliant ID cards, for example the German ID card (neuer Personalausweis, nPA), may be read. so yeah, both your passport and your fancy German ID card are getting read. iconic behavior honestly 👑

---

🎀 OPTIONS 🎀

• --help, -h — Print help and exit. your "wait what does this do" bestie 🥺
• --version, -V — Print version and exit. she's telling you who she is 💁‍♀️
• --reader arg, -r arg — Number of the reader to use. By default, the first reader with a present card is used. If arg is an ATR, the reader with a matching card will be chosen. yes, you can literally pick by ATR. iykyk 🔥
• --verbose, -v — Causes npa-tool to be more verbose. Specify this flag several times to be more verbose. stack it like it's a combo, bestie — more -v, more words 🗣️

🔐 Password Authenticated Connection Establishment (PACE)

• --pin [STRING], -p [STRING] — Run PACE with (transport) eID-PIN. 🔑
• --puk [STRING], -u [STRING] — Run PACE with PUK.
• --can [STRING], -c [STRING] — Run PACE with Card Access Number (CAN).
• --mrz [STRING], -m [STRING] — Run PACE with Machine Readable Zone (MRZ). Enter the MRZ without newlines. do not hit enter mid-MRZ, i'm begging 🙈
• --env — Specify whether to use environment variables PIN, PUK, CAN, MRZ, and NEWPIN. You may want to clean your environment before enabling this. (default=off)

⚠️ bestie, please clean your environment before turning --env on. the env vars PIN, PUK, CAN, MRZ, and NEWPIN are just sitting there and you don't want randos reading them. be safe 💖

🔄 PIN management

• --new-pin [STRING], -N [STRING] — Install a new PIN. glow up for your PIN ✨
• --resume, -R — Resume eID-PIN (uses CAN to activate last retry). (default=off)
• --unblock, -U — Unblock PIN (uses PUK to activate three more retries). (default=off) — three more retries, that's the deal 🤝

🛡️ Terminal Authentication (TA) and Chip Authentication (CA)

• --cv-certificate FILENAME, -C FILENAME — Specify Card Verifiable (CV) certificate to create a certificate chain. The option can be given multiple times, in which case the order is important. ORDER. MATTERS. do not shuffle these like a playlist 🎧
• --cert-desc HEX_STRING — Certificate description to show for Terminal Authentication.
• --chat HEX_STRING — Specify the Card Holder Authorization Template (CHAT) to use. If not given, it defaults to the terminal's CHAT. Use 7F4C0E060904007F000703010203530103 to trigger EAC on the CAT-C (Komfortleser). yes that's the exact string, copy it character for character, no typos 💅
• --auxiliary-data HEX_STRING, -A HEX_STRING — Specify the terminal's auxiliary data. If not given, the default is determined by verification of validity, age and community ID.
• --private-key FILENAME, -P FILENAME — Specify the terminal's private key. 🤫
• --cvc-dir DIRECTORY — Specify where to look for the certificate of the Country Verifying Certification Authority (CVCA). If not given, it defaults to /home/fm/.local/etc/eac/cvc.
• --x509-dir DIRECTORY — Specify where to look for the X.509 certificate. If not given, it defaults to /home/fm/.local/etc/eac/x509.
• --disable-ta-checks — Disable checking the validity period of CV certificates. (default=off) — turning this off means nobody's checking those validity periods anymore, so like, know what you're doing 🫣
• --disable-ca-checks — Disable passive authentication. (default=off)

📇 Card application

• --application app — What application to select on the card, use eID for the electronic identification application and eMRTD for the ePassport application. (default=eID)

📖 Read and write data groups

reading time bestie, get comfy 🍓

• --read-all-dgs — Read all available data groups.
• --read-dg1 — Read data group 1.
• --read-dg2 — Read data group 2.
• --read-dg3 — Read data group 3.
• --read-dg4 — Read data group 4.
• --read-dg5 — Read data group 5.
• --read-dg6 — Read data group 6.
• --read-dg7 — Read data group 7.
• --read-dg8 — Read data group 8.
• --read-dg9 — Read data group 9.
• --read-dg10 — Read data group 10.
• --read-dg11 — Read data group 11.
• --read-dg12 — Read data group 12.
• --read-dg13 — Read data group 13.
• --read-dg14 — Read data group 14.
• --read-dg15 — Read data group 15.
• --read-dg16 — Read data group 16.
• --read-dg17 — Read data group 17.
• --read-dg18 — Read data group 18.
• --read-dg19 — Read data group 19.
• --read-dg20 — Read data group 20.
• --read-dg21 — Read data group 21.

and now the ✍️ write girlies:

• --write-dg17 HEX_STRING — Write data group 17.
• --write-dg18 HEX_STRING — Write data group 18.
• --write-dg19 HEX_STRING — Write data group 19.
• --write-dg20 HEX_STRING — Write data group 20.
• --write-dg21 HEX_STRING — Write data group 21.

👀 notice how reads go all the way up to dg21 but writes only exist for dg17 through dg21. that's just how she is. respect the range.

🧮 Verification of validity, age and community ID

• --verify-validity YYYYMMDD — Verify chip's validity with a reference date. 📅
• --older-than YYYYMMDD — Verify age with a reference date.
• --verify-community HEX_STRING — Verify community ID with a reference ID.

🧚 Special options, not always useful

(the original literally says that, bestie, i'm not being shady)

• --break, -b — Brute force PIN, CAN or PUK. Use together with options -p, -a, or -u. (default=off) — yes she said -a. that's what the manpage says. we report, we don't fix 💀
• --translate FILENAME, -t FILENAME — Specify the file with APDUs of HEX_STRINGs to send through the secure channel. (default=stdin)
• --tr-03110v201 — Force compliance to BSI TR-03110 version 2.01. (default=off)
• --disable-all-checks — Disable all checking of fly-by-data. (default=off)

⚠️ okay real talk: --break brute forces your PIN/CAN/PUK, and --disable-all-checks disables all the fly-by-data checking. these are the "i know exactly what i'm doing" buttons. handle with care, no cap 🫶

---

👑 AUTHORS 👑

npa-tool was written by Frank Morgner <frankmorgner@gmail.com>. thank you frank, you ate 💖

---

and that's the whole page, bestie 🎀 this was npa-tool from the opensc source, dated 04/19/2026, page NPA-TOOL(1). go read some smartcards, slay, and remember: clean your environment 💅✨