TSI Decoder
Decode the EMV Transaction Status Information (tag 9B) bitfield — the functions the terminal and card actually performed during a transaction.
Follows EMV 4.4 Book 3 Annex C6Transaction Status Information (tag 9B)·verified Oct 2026· double-checked Oct 2026— every bit checked against openemv/emv-utils, proxmark3 and binaryfoo
Try it as a puzzle: put the steps of a chip payment in order →
What the Transaction Status Information (9B) records
The Transaction Status Information (TSI), EMV tag 9B, is a 2-byte bitmap that records which EMV functions were actually performed during a transaction. It is the card-and-terminal's audit trail: offline data authentication, cardholder verification, card risk management, issuer authentication, terminal risk management, and issuer script processing each have a bit that is set once that step runs.
Read the TSI alongside the TVR. The TVR says what went wrong; the TSI says what was done. Together they answer the two questions every EMV investigation starts with — "which checks ran, and which of them failed?"
Reading the bits
All defined flags live in byte 1; byte 2 is reserved for future use and is normally 00. A common diagnostic pattern is "Offline data authentication performed" set while the matching TVR bit reports it failed — that tells you authentication ran and was rejected, rather than being skipped because the terminal or card did not support it.
Common questions
"Cardholder verification was performed" is clear — is that a problem?
Not necessarily. The bit says that cardholder verification processing ran, not that a PIN or signature was taken: when the terminal works through the CVM List and ends on "No CVM required", the bit is still set. It is clear when CVM processing was skipped altogether — for example because the AIP says the card does not support cardholder verification (byte 1 bit 5). Whether that matters depends on whether the transaction needed verification; the CVM Results (9F34) show which method, if any, was used.
Why is "Issuer authentication performed" not set on an online txn?
The terminal sets it when it sends the issuer's authentication data (the ARPC) to the card in an EXTERNAL AUTHENTICATE command, which it does only if the AIP says the card supports issuer authentication (byte 1 bit 3). A missing bit here often points to the host not sending issuer authentication data back, or to a card that takes the ARPC in the second GENERATE AC instead.
Bit definitions follow EMV 4.4 Book 3 Annex C6. All decoding happens locally in your browser.