nfc-laboratory: a signal and protocol analyzer for NFC using an SDR

Decoding NFC by demodulating the radio yourself

nfc-laboratory is described as an NFC signal sniffer and protocol decoder using an SDR receiver for demodulation and decoding NFC-A, NFC-B, NFC-F and NFC-V signals in real time up to 424 Kbps, and as a logic analyzer for contact smart cards with the ISO7816 protocol. The mechanism is the interesting part. Rather than asking a reader what it saw, the tool samples the radio and works out what was transmitted, which means it sees the whole exchange including the parts a reader implementation discards. That is what makes it useful for two different audiences: a developer debugging a reader, who needs to know what the card actually sent, and someone curious about the protocol, who needs to see the modulation rather than the application layer. The trade is that you need a radio that can sample fast enough, and the tool supports AirSpy, HackRF, HydraSDR and RTL-SDR receivers.

The modulation matrix, and what is still preliminary

The description section lists what is implemented, and the per-protocol detail matters if you are trying to catch a specific thing. NFC-A under ISO14443A is supported at 106, 212 and 424 Kbps with ASK or BPSK modulation, and NFC-B under ISO14443B covers the same three rates with the same two modulations. NFC-V under ISO15693 is supported at 26 and 53 Kbps with 1 of 4 code and 1 of 256 code PPM or BPSK, with FSK marked as pending. NFC-F under ISO18092 has preliminary support at 212 and 424 Kbps with manchester modulation. For contact smart cards, the ISO7816 protocol is implemented with the help of a logic analyzer from DreamSourceLab. The word preliminary on NFC-F is the one to note, and the FSK pending note on NFC-V matters if you are looking at a tag that uses it.

Installing on Windows and Debian, from releases

There are prebuilt packages on the releases page. On Windows you can install with the compiled installer, or take the portable version. On Debian and Ubuntu the .deb package installs with a single command.

sudo dpkg -i nfc-lab_*_amd64.deb

The release artefacts are named so you can tell them apart, with a Windows installer built for x86_64 and a Debian package for amd64. The project is at version 3.4.2, with 3.4.1 and 3.4.0 before it in November 2025, and the repository is not archived with the last push on 2026-09-21. The licence is GPL-3.0. The source layout shows a C++ project with a CMakeLists.txt, a cmake directory, a src directory, a tools directory, a doc directory, a dat directory holding data, a wav directory, a dll directory, a debian directory for packaging, and a FLATPAK.md alongside a .gdbinit for debugging.

The interface is split into frames, signal and receiver views

The screenshots are described as the application splitting functionality across tabs. At the top left there are three panels. The frames view is a graphic view of the decoded frames captured in the contact and contactless interfaces. The signal view shows the raw signal captured with the logic analyzer and the radio interface with protocol markers. The receiver view shows the spectrum of the signal captured in the radio interface during acquisition. At the bottom there is a second frames panel, a table view of the same decoded frames, which is where you read the actual protocol exchange line by line. The screenshots cover the main signal view, the contactless card wave detail view, the ISO7816 wave detail view, the radio spectrum view and the protocol detail view with filtering capabilities. The wave and spectrum views are the ones that make the tool more than a protocol decoder, since they let you see the modulation itself.

An INI settings file with three kinds of section

Settings live in the user home directory, and on Windows the file is at a path under the roaming application data folder with an .ini extension. The file is created on first run and updated automatically every time the application closes, and it is divided into sections with different rules. The window section holds the window geometry and interface preferences, and it is rewritten by the application each time it closes.

[window]
windowWidth=1024
windowHeight=720
windowState=0
timeFormat=false
followEnabled=true
filterEnabled=true

The settings section is different. Those values are not modified by the application and must be edited by hand in the file.

[settings]
splashScreen=2500
theme=dark
quitConfirmation=true

The splash screen duration is in milliseconds and setting it to 0 disables it, the theme key currently supports only dark, and the quit confirmation toggles the dialog before the application exits.

Feature toggles that also skip the hardware initialisation

The third section controls which features are available in the user interface, and all of them are enabled by default. Disabling one hides the corresponding toolbar button and skips the initialisation of the related hardware or processing thread, which is the part worth knowing. A dead display is therefore not necessarily a decoding failure, it may be a radio that never got initialised because that toggle was off.

[features]
radioDevice=true
logicDevice=true
radioDecode=true
logicDecode=true
radioSpectrum=true
signalRecord=true

The six toggles are the SDR radio receiver, the logic analyser, radio NFC protocol decoding, contact card ISO7816 protocol decoding, the radio spectrum view and signal recording to disk. The recording one connects to the export and import features, since captures go out to the compressed TRZ format and come back in from WAV and TRZ files.

Editorial conclusion

nfc-laboratory fits a reader who needs to see what a card and a reader are actually exchanging, whether to debug a reader implementation, to check a claim about a payment card, or to study the modulation itself. It does not fit a developer who just needs an NFC library, since it decodes rather than talks, and it does not fit anyone without an SDR or a logic analyzer. Verify first that your radio is on the supported list, since the demodulation path depends on the sample format the hardware produces, and check the feature toggles before you blame the tool for a dead display, because the radio and logic devices can be disabled independently in the settings file.

Frequently asked questions

Official sources

1. Issues
2. josevcm/nfc-laboratory on GitHub
3. License: GPL-3.0
4. README
5. Releases