javacard-curated-list
Curated list of open-source Java Card applets and related applications for cryptographic smartcards
Last updated Jul 8, 2026
540
Stars
118
Forks
7
Issues
+1
Stars/day
Attention Score
89
Language breakdown
No language data available.
▸ Files
click to expand
README
Curated list of JavaCard applications
The goal is to provide curated catalog of all open-source JavaCard applets and applications relevant for JavaCard development. The list is compiled by complete search for all GitHub, SourceForge and GitLab repositories with 'javacard.framework' keyword.| :point_up: | You are encouraged to contribute - please create a pull request and insert entry into suitable section lexicographically. Thank you! | |---------------|:------------------------|
The projects collected in this list were analyzed and published (June 2017) in Analysis of JavaCard open-source ecosystem and again in June 2023 in The adoption rate of JavaCard features by certified products and open-source projects. If you will find this list helpful, please consider citing our work as:
@inproceedings{2023-cardis-javacard, title = {The adoption rate of JavaCard features by certified products and open-source projects }, author = {Zaoral, Lukas and Dufka, Antonin and Svenda, Petr}, booktitle = {Proceedings of the 22nd Smart Card Research and Advanced Application Conference, Lecture Notes in Computer Science, vol 14530}, doi = {10.1007/978-3-031-54409-5_9}, isbn = {978-3-031-54409-5}, pages = {169--189}, publisher = {Springer}, year = {2023} }Backup of listed repositories
As repositores are sometimes moved or completely removed, the fork of each repository under the virtual organization 'javacard-curated-list' is created, preserving also repository metadata like forks and stars. Another archival option is SoftwareHerritage archive which preserves history including automatic periodic updates (but not github metadata). Try to find a repository there if the original link no longer works (and please let us know via issue or PR).Format and notation
Project name [activity]If is the project located on GitHub as primary project (not only source code in some subfolder), last commit date, number of contributors and number of stars received is retrieved directly from GitHub. Otherwise, source like SourceForge or BitBucket is signalized with manual last commit date entry.
Short description, often taken from a project readme.md
Contents
- Electronic passports and citizen ID - Authentication and access control - Payments and loyalty - Key and password managers - Digital signing, OpenPGP and mail security - e-Health - NDEF tags - CryptoCurrency wallets - Emulation of some proprietary cards - Mobile telephone, SIM toolkits - Unsorted applications - Applet build, upload and management - Card capabilities testing (algorithms support, performance, security issues) - Formal verification and code transformation tools- JavaCard simulators and emulators
- Learning (various school projects, simple hello world applets, etc)
- Unsorted
Applets (standalone applications)
Electronic passports and citizen ID
Belgian e-id applet
- Electronic Driving License (GitHub) [last commit 2015]_
- FedICT Quick-Key Toolset (GitHub) [last commit 2011]_
EidCard project
- IdentityCard applet (GitHub) [last commit 2017]_
Vrije University Brussels applet (be.msec.smartcard.IdentityCard.java) with authentication, identity metadata storage and retrieval and time update functionality. JavaCard applet designed to work with Web-eID project which enables usage of European Union electronic identity (eID) smart cards for secure authentication and digital signing of documents on the web using public-key cryptography.
- JMRTD: Machine Readable Travel Documents (SourceForge) [last commit 2017]_
A privacy-friendly alternative for the Belgian eID card. The project aims to improve security of Belgian ID holders by limiting the current extensive exposure of their profiles. To do so, we build an alternative ID card which limits service providers to strickly necessary ID holder profile information.
BoB MTS7 Travelcard Implementation, Swedish public transport card applet.
Authentication and access control
OTP authentication applet for VivoKey javacard implants based on Yubico OTP applet.
Fuzzy extractor to authenticate with biometric data. CoolKey Applet with the idea of making it a fresh JavaCard 2.2.2 applet meant to be revival of CardEdge Muscle card applet.
A feature-complete MIT-licensed implementation of the FIDO2 CTAP2.1 authenticator standard. Passes the official FIDO compatibility test suite. As is required by CTAP, also implements U2F.
This CCU2F JavaCard Applet is based on the Ledger U2F Applet. I imported this applet to Eclipse with installed JCOP Tools and modified the AID of this applet to the standardized AID for FIDO NFC token ( 0xA0000006472F0001). I also provided some example data (Attestation Certificate and Key) to bring this applet to run. This Applet was succesfully tested on JCOP v2.4.2 R3 cards with KeyAgreementX.ALGECSVDPDHPLAINXY from NXPs JCOP library for EC Point Multiplication.
de.fac2 is a Javacard applet which implements a Fido U2F token. It was designed and implemented based on the Common Criteria Protection Profile BSI-CC-PP-0096-V3-2018 "FIDO Universal Second Factor (U2F) Authenticator Version 3". Generic Identity Device Specification (GIDS) smart card is the only PKI smart card whose driver is integrated on each Windows since Windows 7 SP1 and which can be used read and write. No Windows driver installation is required. Based on ISOApplet PKI GidsApp is a javacard applet which was developed according the specification GIDS 2.0 (Generic Identity Device Specification).This project is based on GidsApplet (above). It provides a generic identity command set for interaction with smart cards that are used for identity applications. JavaCard HMAC-based One Time Password generator which delivers new code via URL tag of NDEF every time the card is put close to NFC-enabled phone. As the Android (and soon also iOS) handles the NDEF tags natively, no additional software is required (after initial card personalization with OTP secret key). A Java Card PKI Applet aiming to be ISO 7816 compliant. The Applet is capable of saving a PKCS#15 file structure and performing PKI related operations using the private key, such as signing or decrypting. Private keys can be generated directly on the smartcard or imported from the host computer. The import of private keys is disabled in the default security configuration. Javacard Implementation for the Android Identity Credential HAL
This applet is a Java Card implementation of the FIDO Alliance U2F standard. It uses no proprietary vendor API and is freely available on Ledger Unplugged and for a small fee on other Fidesmo devices through Fidesmo store.
This applet is a Fork of Ledger U2F repository with some changes. At first, in the releases a compiled source is available along with a script for GpPro tool to both instal and personalise the applet. Secondly, a proprietary APDU was changed from
F0 CLA to 80. All personalisation APDU on other ledger forks threw 6881, but the 80 CLA personalisation succeeded. The repository also claims to support iOS.
Significant, but outdated applet used for OpenSC. Superseeded by PKCS#15 and PIV standards.
radiius.com Radiius applet, applet seems to be just starting to implement required functionality as per specification. Originally from https://github.com/SharkyHarky/OneCard, but repository was moved. Personal Identity Verification (PIV) applet. Commissioned and funded by the Australian Department of Defence
Contains applets for KeyFOB NFC Secure Element for performing association, authentication and identification. Relates to ORWL secure computer.
This is proof-of-concept implementation of One Time password JavaCard STK applet and authentication server. Load JavaCard applet to SIM card and use STK menu.
A Javacard applet to provide an OTP (One Time Password) implementation which can be used in conjunction with a Barclays PinSentry device. Personal Identity Verification (PIV) applet (NIST SP 800-73-4). Target is JavaCard 2.2.2, with 2-3k of transient memory.
Personal Identity Verification (PIV) applet Implementation of card according to RSA PKCS#15 specification. (seems like extensive implementation, but fails to convert under ant-javacard so far)
- PKI applet
last commit 2016, original repository [removed]_
Extensive PKI applet, requires JavaCard 3.0.5
The implementation of the adapted Smart-ID scheme for smart cards. Performs 2-of-2 RSA signature using secure multiparty computation.- SSH support applet (GitHub)
SIMple ID: QR codes for authentication on basic and feature phones. Using Java Card 3.0.4+ applet which generates and displays QR codes for authentication using (almost*) the standard SIM ToolKit (STK) API. The itention is to permit low-cost, basic and feature phones (e.g., Jio) to offer SIM-secured authentication modes based on QR codes.
A local smartphone module acting as an OpenID Connect Server proxy and delivers trusted tokens to installed native applications. The TIM improves the user experience with single sign on, security and privacy enhancement. The Trusted Identity Module project is a set of four projects: an Android service (tim_service), a JAVA Card Service (TimCardlet), a modified OpenID Connect Server (phpOpTim) and a basic Android TIM-Client app enabling to test the TIM services (HelloTim). The OIDC-TIM server is based on an open source implementation of OpenID Connect in PHP by Nomura Research Institute, Ltd. Seems to be extensive and well documented.
An U2F Token implementation based on Ledger U2F Applet which cannot pass the NFC self-conformance test in the phase: "U2F_REGISTER, Short APDU, Change BlockSize", as it doesn't handle the situation which Le(BlockSize) is not 256 bytes.)
Javacard applet emulating the Yubikey challenge-response interface
This is a JavaCard applet that emulates the HMAC challenge-response functionality of the Yubikey NEO/4/5. It presents the same interface that a real Yubikey presents over CCID (i.e. this applet does not have any HID features). The goal is to be able to write applications that use the HMAC-SHA1 Challenge-Response mode of the Yubikey, and have a JavaCard with this applet be a drop-in replacement.
This project implement the HOTP/TOTP card functionality used on the YubiKey NEO device that is sold by Yubico. Its primary use is to use the YubiKey NEO to generate OATH HOTP/TOTP one-time-passwords. GPLv3+
This project has been submitted to the YubiKing 2015 Hackathon. Yubisec is an implementation of a One Time Pad for secure communication between two Android phones using keys stored and generated on YubiKey Neo tokens.
Payments and loyalty
AppSecure uses Gemalto's eGate smart card framework to enforce pay as you go services for Win32 applications. This entry made it to the pre-final round of Gemalto's eGate Open Contest in 2004
just started, unifinished (04/2017) JavaCard implementation of an EMV card for payment terminal functional and security testing.
Collection of source code for many EMV-related projects: SimpleEMVApplet, java-card-openEMV, card-spy, emvdemoBook, emv-bertlv...
This tool emulates an EMV-CAP device, to illustrate the article "Banque en ligne : a la decouverte d'EMV-CAP" published in MISC, issue #56.
Static analysis of java code applied to example of very old Gemplus Purse applet
Client/Server application of an electronic wallet (Pin, Storage, control, payment..)
Loyalty Card System based on a Java Card featuring a smart card and a terminal. This is a system that allows customers to get credits by shopping in the same store repeatedly. Customers can spend credits to buy products in the store.
Mobile banking solution using SIM Toolkit The OpenEMV is a Java Card implementation of the EMV standard. This applet is a very basic EMV applet supporting only SDA and plaintext offline PIN.It does not offer personalisation support - everything is hard-coded. This is a fully working EMV applet for javacard 2.2.1. It does not offer personalisation support - everything is hard-coded. Contains some custom feature commands. Unfortunately, no personalization commands are implemented (use ArrayEdit or modify code manually). This applet was stitched using source code from all over the internet and a lot of dev's code. The Crypto.java file is of unknown origin, was entirely made by another person.
Javacard Applet for functioning paypass credential. The javacard code included will answer to any reader that requests MasterCard PayPass contactless cards.
This repository contains multiple card applet/card agent examples for using on simplytapp, GPL to v1.2.1. Originally from https://github.com/SimplyTapp/CardExamples, but repository was removed. Possible reupload available at https://github.com/julianosalvi/CardExamples---SwipeYours.
payment applet
Some old PBOC3JC211ICFC_SIO applet and documentation, likely payments.
This is a simple wallet simply maintains a running account balance allowing you to credit, debit, or review the current balance of the wallet. This is simply for pure demonstration on various wearable technologies where a javacard secure element is available.
Key and password managers
A JavaCard key manager for Cryptsetup. School project, but well documented and extensive A more efficient version of Microsoft's Double Key Encryption System.
This is a Java Card implementation of the OpenPGP smart card specifications.
JavaCard implementation of the Android Keymaster 4.1 HAL (most of the specification is in the Android Keymaster 4.0 HAL), intended for creation of StrongBox Keymaster instances to support the Android Hardware-backed Keystore. JavaCard Password Manager is a java applet used to create and securely store a strong password used with the steganography app created by. School project, but well documented.
KeepassNFC is a applet in javacard platform that can protect the secret key of KeePass database.
A hobby project for OMNI ring. It's a programmable javacard NFC ring, which I plan to program as a secure password storage.
Password manager for javacards. Tested on J3A081 card.
Android password manager app that implements password encryption inside a secure element (SE). Can only run on a device that supports the Open Mobile API (aka SmartCardService). Requires associated Java Card applet to be loaded in the SE (SIM card or embedded SE) in advance.
SIM toolkit application allowing storage and retrieval of the logins and passwords by SMS in a secure way. It demonstates how to develop a SIM toolkit application that can securely store and manage information on the SIM and communcate with an external world via SMS.
Android application interacting with a JavaCard applet installed on SIM card.
This repository constains the same source code ( -Februrary 2020- ) as the repository listed above (KeepassNFCApplet)
Using TrueCrypt with a JavaCard. The app stores the user container passwords on a SmartCard and automatically loads the passwords from it to the choosen Containers. The user just remember a four digit PIN to access the SmartCard. Additionally I've implented an password-share methode. The user is able to share passwords with previous stored PublicKeys (RSA 2048 Bit). The private key is generated during the of the card and don't leave this.
Digital signing, OpenPGP and mail security
SmartPGP is a free and open source implementation of the OpenPGP card 3.x specification in JavaCard. The main improvement introduced in OpenPGP card 3.x specification from previous version is the support of elliptic curve cryptography with several existing curves (NIST P-256, NIST P-384, NIST P-521, brainpool p256r1, brainpool p384r1 and brainpool p512r1). The SmartPGP Card applet is typically used through GnuPG. The FluffyPGP Applet implements the OpenGPG Card v 2.0.1 specification without using secure channels or Global Platform for portability. GPL3
- JCOpenPGP (SourceForge) [last commit 2016]_
NeoPGP is a free and open souce Java card applet which implements the OpenPGP 3.4.1 specification. It aims to be robust, lightweight (in a sense of RAM consumption) and highly configurable. The applet supports ECC as well as RSA keys. Secure multiparty Schnorr-based EC signatures implemented without proprietary ECPoint API. SigAnima is an JavaCard ECDSA signing applet. This applet is based on the javacardsign applet from Wojciech Mostowski . The applet supports the following standardized EC domain parameters: secp224r1, BrainpoolP224r1, secp256r1, BrainpoolP256r1, BrainpoolP320r1. This software system allows you to decrypt and sign your e-mails with your smartphone instead of using a contactless smartcard. The smartphone communicates with your PC via NFC (as a contactless smartcard would). bachelor's thesis. Warning: This is just proof-of-concept code and should NOT be used in production environments.
The repository contains only CardEdge applet but it is not the applet development repository. Main purpose of this repo is to run card simulator inside a smartphone; the applet is just used here.
This project implement the OpenPGP card functionality used on the YubiKey NEO device. This project is based on the Java Card OpenPGP Card project made by Joeri de Ruiter. The OpenPGP Card applet is typically used through GnuPG.
e-Health
A project to read the German health insurance card (Elektronische Gesundheitskarte (EGK)), transform the read data to FHIR@copy; ressources, and send them to a choosable FHIR Endpoint. This repository does not contain an applet, it is only client tool.
eHealth card implementation
- HealthCard: JavaCard + JML specs (SourceForge) [last commit 2014]_
NDEF tags
A (hopfully) highly feature-packed NDEF applet, available through Fidesmo A constant work in progress, but I use it personally.
This project contains a JavaCard applet acting as an NFC NDEF Tag. It is intended as a convenience applet, allowing storage of an NDEF record on a smartcard to direct the user to a relevant host-device application, such as a smartphone app related to the card or a web page for which the card serves as an authorization token. Data can be preloaded at install time using standards-compliant methods so that this generic applet can be used in different use cases without modification.
JavaCard applet for speaking NDEF. Implementation of the NDEF Nfc-Forum specification for JavaCard 2.2.1. The aim is to support sending of urls to smartphones, and provoiding only compile time writeability.
- Pico NDEF Applet (GitHub) [last commit 2017]_
CryptoCurrency wallets
BitcoinWallet is a Bitcoin Hardware Wallet implementation. It is based on the project Ledger Wallet and can be run on JavaCard platform with JCRE version 3.0.x above.
BitaWallet is a JavaCard-based crypto wallet designed with advanced security features, including cryptographic backup and a super-wallet/sub-wallet architecture. It uses ePaper technology for trusted display on the card and NXP proprietary packages found on older NXP cards jcop-2.3.x - jcopx-2.4.2.R3.
CoolWallet Pro Firmware is a Javacard firmware designed specifically for the CoolWallet Pro. It offers advanced features for private key management, signing, and transaction data composition. Private key management: Safely store and manage private keys within the secure element of the CoolWallet Pro. Signing: Perform secure and verifiable digital signatures for transactions and authentication purposes. Transaction data composition: Generate and compose transaction data in a secure manner, ensuring data integrity and confidentiality.
This applet is an implementation of the Ledger Wallet Hardware Wallet specification emulating an NFC Forum Type 4 tag to display the second factor, with specific extensions.
This project is DISCONTINUED according to issues section.. Derived project can be found here.
This applet let you test the performance of your Java Card platform to run a Hierarchical Deterministic Bitcoin Hardware Wallet implementation. It tries to find out all available algorithms, provide a pure Java implementation for the missing ones and gives a detailed report on support and performance. If you have access to proprietary APIs, you can easily enable additional tests by providing an implementation of the ProprietaryAPI class
Very simple applet used by Lamassu Bitcoin machines to sign transaction with ECDSA. Originally from https://github.com/lamassu/ssu-card/ which was removed.
The goal is to allow third-party Monoid applets to interact with Monoid Applet Shareable interface for signing/verifying and data access, so that Monoid can manage those keys and data and make it easy for users to backup, restore or even synchronize securely with unified UX. It can be used to create a hardware crypto wallet, a FIDO2 authenticator, a One-Time Password (OTP) generator and a Tesla key.
SatoChip stands for Secure Anonymous Trustless and Open Chip. It is a javacard applet that can be used as a secure hardware wallet running for example on a Yubikey Neo. The SatoChip has full BIP32 supports but due to technical limitations on current javacards, hardened keys (i.e. child keys using indices 2^31 through 2^32-1) are derived much faster than normal keys.
Open source javacard applet implementing a secure vault. Store your most precious secrets, including seeds, masterseed and others inside a secure chip, protected by a PIN code.
This is a sample Applet based on the Java Card standard platform that combines a cold wallet with a BIP. Usable for Taisys SIMoME card.
This project is the JavaCard applet for the Secure Bitcoin Wallet App.
This is a collection of JavaCardOS applets for Specter-DIY secrets storage for use by Specter Bitcoin multisignature wallet.
Keycard is a an implementation of a BIP-32 HD wallet running on Javacard 3.0.4+. Supports among others key generation, derivation and signing, exporting keys defined in the context of EIP-1581, card duplicationand setting up a NFC NDEF tag.
Emulation of some proprietary cards
reimplementation of DESFire card - master's thesis proof of concept Gauss Key Card is a Java Card applet that implements the minimal working subset of the Tesla Key Card Protocol. Supported Java Card implementations that load this application will be able to be paired with a compatible vehicle and subsequently unlock, start, or lock the vehicle in the same way you would with an official key card. An APDU layer emulator for the secure element found in PS4 officially licensed peripherals. It tries to be legal unlike its name suggests. Emulation of DESFire card
- MobileEDEPV3 (GitHub) la
README truncated. [View on GitHub
