Chris Collins

Tools · radio

LoRaWAN frame decoder

Decode a LoRaWAN PHYPayload — join requests and accepts, uplinks and downlinks with every FHDR field — check the MIC, decrypt the payload with your session keys, decrypt join accepts and derive the session keys, read MAC commands, and decode CayenneLPP.

Added

Works with

How to use it

Paste a frame from your gateway, network server console or packet forwarder log and see what’s in it, field by field, with the keys you have.

How to use it

  • Frame — the PHYPayload as hex (40F17DBE49…) or base64 (QPF9vkkA…, as Semtech’s packet forwarder and most consoles show it). The examples load working frames with their keys.

  • Keys — 32 hex digits each:

    • NwkSKey checks a data frame’s MIC (LoRaWAN 1.0.x) and decrypts FPort 0 payloads (MAC commands).

    • AppSKey decrypts the application payload (FPort 1–223).

    • AppKey checks a join request’s MIC and decrypts a join accept. Add the DevNonce from the matching join request and the tool derives NwkSKey and AppSKey (LoRaWAN 1.0.x); Use these session keys puts them in the fields above.

    • FCnt upper 16 bits — the frame carries only the low 16 bits of the counter, but the MIC and the encryption use all 32. When a device has sent more than 65,535 frames, put the upper half here.

  • Decoded — the bytes coloured by field, then MHDR (message type), DevAddr, the FCtrl flags (ADR, ADRACKReq, ACK, FPending/Class B), FCnt, FOpts, FPort, the MIC and whether it matches. Join requests show JoinEUI, DevEUI and DevNonce; join accepts show AppNonce, NetID, DevAddr, DLSettings, RxDelay and the CFList (extra frequencies or channel masks).

  • MAC commands in FOpts or an FPort 0 payload are decoded in the right direction: LinkADRReq, DevStatusAns (battery and SNR margin), NewChannelReq, RXParamSetupReq, DutyCycleReq, TxParamSetupReq, DeviceTimeAns (GPS time), LinkCheckAns and the rest of LoRaWAN 1.0 and 1.1.

  • Payload — CayenneLPP (all the common types, including GPS, accelerometer and gyro), text, or a byte table with each offset read as 8-, 16- and 32-bit integers. You can also paste a decrypted payload on its own, such as a console’s frm_payload.

  • Airtime of this frame opens the LoRa airtime calculator with this frame’s sizes at the region and data rate you pick.

AES runs in the browser’s Web Crypto: CMAC (RFC 4493) for the MICs, the Ai counter blocks for the payload and AES-ECB for join accepts and session keys.

Checks

  • The well-known example frame 40F17DBE4900020001954378762B11FF0D with NwkSKey 44024241…3FD3 and AppSKey EC925802…C588 has a valid MIC and decrypts to test.

  • Frames built with the lora-packet library (uplinks, downlinks with FOpts, MAC commands on FPort 0, a 32-bit frame counter, a join request, join accepts with and without a CFList) decode, verify and decrypt to the same bytes, and the derived session keys match its.

  • AES-CMAC matches the RFC 4493 test vectors.

  • CayenneLPP decodes the examples in its documentation (27.2 °C, −4.1 °C, GPS 42.3519, −87.9094, 10 m).

Limits

  • LoRaWAN 1.1 data frames use two integrity keys and encrypt FOpts; this checks 1.0.x MICs and shows 1.1 FOpts as they are. 1.1 join accepts (OptNeg) decrypt but their session keys aren’t derived.

  • Rejoin requests and proprietary frames are shown as bytes.

Privacy

Nothing leaves your browser. Keys are kept in this browser’s storage so you don’t have to paste them again, and are never put in a share link; clear the fields to remove them.

Runs entirely in your browser; nothing you type leaves this page.