# GlobalPlatformPro: managing JavaCard applets and keys from the command line

> GlobalPlatformPro is a Java tool for loading and managing applets and keys on JavaCard smart cards, with a command line interface that aims to do what you mean and a Maven based multi module layout. The card it talks to matters more than the code, and the README itself warns that running without keys falls back to a well known default.

**martinpaljak/GlobalPlatformPro** — Manage applets and keys on JavaCard-s like a pro 🌐 🔐

- Repository: https://github.com/martinpaljak/GlobalPlatformPro
- Website: https://javacard.pro/globalplatform
- Stars: 954 · Forks: 256
- Language: Java
- License: LGPL-3.0
- Published: 2026-10-20 · Updated: 2026-10-20 · Language: en
- Canonical page: https://hysenlabs.com/projects/martinpaljak-globalplatformpro

## Applet management as a command line problem

GlobalPlatformPro is described as the Swiss Army Knife for JavaCards, and the README states the purpose plainly: load and manage applets and keys on JavaCards from the command line or from your Java project with a Do What I Mean approach.

That audience is specific. JavaCard development means writing applets, installing them onto a card, giving them privileges, listing what is already there, and doing all of that against a physical card or an emulator over a reader. The tooling for that is often a vendor specific GUI, and the alternative is writing raw APDU exchanges by hand.

The design goal stated in the README is a high level interface that most of the time just works, and that is flexible, and that is 100% open source. The tools it lists as related matter for the same reason, since the README recommends ant-javacard for building JavaCard applets as an equally pleasant experience.

The implementation is Java, built with Maven, and the repository root holds a tool/ module, a library/ module, a tlv/ module, a pace/ module and a nextgen/ module, with tests/ and docs/ alongside. The default branch for the repository is next, and the homepage is javacard.pro/globalplatform, where professional support is offered.

The README is short, which is worth noting before you commit to anything. The real documentation lives in the project wiki, starting from the Getting Started guide.

## The install and list cycle, and the key warning

The README shows the whole tool in two commands. The first installs an applet, giving it a privilege and a parameter blob:

```
$ gp -install HelloWorld.cap -privs CardReset -params 48692074686572652C2077686174277320796F7572206E616D653F
# Warning: no keys given, defaulting to 404142434445464748494A4B4C4D4E4F
HelloWorld.cap loaded: com.example.helloworld A048656C6C6F576F726C64

$ gp -l
# Warning: no keys given, defaulting to 404142434445464748494A4B4C4D4E4F
ISD: A000000151000000 (OP_READY)
     Parent:   A000000151000000
     From:     A0000001515350
     Privs:    SecurityDomain, CardLock, CardTerminate, CVMManagement, TrustedPath, AuthorizedManagement, TokenVerification, GlobalDelete, GlobalLock, GlobalRegistry, FinalApplication, ReceiptGeneration

APP: A048656C6C6F576F726C64 (SELECTABLE) (|.HelloWorld|)
     Parent:   A000000151000000
     From:     A048656C6C6F576F726C64
     Privs:    CardReset
```

The second command lists the card contents, and the rest of the listing continues with the loaded packages:

```
PKG: A0000001515350 (LOADED) (SSD creation package)
     Parent:   A000000151000000
     Version:  255.255
     Applet:   A000000151535041 (SSD creation applet)

PKG: A0000000620204 (LOADED) (javacardx.biometry1toN)
     Parent:   A000000151000000
     Version:  1.0

PKG: A0000000620202 (LOADED) (javacardx.biometry)
     Parent:   A000000151000000
     Version:  1.3

PKG: A048656C6C6F576F726C6401 (LOADED) (|.HelloWorld.|)
     Parent:   A000000151000000
     Version:  1.0
```

Note the parameter value on the install line. It is a hex encoded string, and read as ASCII it spells a question, which is the kind of detail the README does not explain but the tool takes as an opaque blob.

Note also the warning that appears on both commands, which leads to the next section.

## The default key is a convenience, and a real risk on a real card

Every command in the README example prints the same warning: no keys given, defaulting to 404142434445464748494A4B4C4D4E4F.

That value is 16 bytes of ASCII digits, and it is printed in the documentation in full. For a developer at a desk with a test card and an emulator, the default is what makes the two command example work at all: no key arguments, no configuration file, no setup step between installing the tool and loading an applet.

The same value is why the example must never be applied to a card that matters. The keys here are the GlobalPlatform keys used to establish a secure channel, and if you talk to a real card using a key that is published in a README, then anyone who has read the documentation can do the same. The tool is telling you it defaulted, which is the last warning you get before that becomes your problem.

So the practical rule is that the default is fine for a scratch card and a defect in a script that automates against a card you care about. The README does not document a key file format or a key management workflow, so the key handling is something you have to design yourself around the tool rather than something it hands you.

It is also worth noting what the warning does not say. It does not say the connection is encrypted with a weak key, because the key is not weak, it is public. The distinction matters when you write your own automation: the failure mode is not cryptographic, it is procedural.

## Reading the listing: ISD, applets, packages and privileges

The output of the list command is a compact description of the card's security state, and understanding it teaches most of what you need to know about GlobalPlatform administration.

The ISD entry, with AID A000000151000000 and state OP_READY, is the Issuer Security Domain, the root of the card's card management hierarchy. Everything else in the listing is shown with a Parent line pointing at it, which is the whole tree in one attribute.

The Privs line for the ISD lists the privileges it holds: SecurityDomain, CardLock, CardTerminate, CVMManagement, TrustedPath, AuthorizedManagement, TokenVerification, GlobalDelete, GlobalLock, GlobalRegistry, FinalApplication and ReceiptGeneration. Those are the administrative powers on the card, and a domain that has them can install and delete applets.

The APP entry, A048656C6C6F576F726C64 in state SELECTABLE, is the installed applet, and its Privs line shows the privilege you granted at install time, CardReset. The name appears in a marked form alongside the AID, which makes it easy to spot which package a given applet came from.

The PKG entries are the packages on the card. A0000001515350 is the SSD creation package at version 255.255, and the two javacardx.biometry packages are the JavaCard Biometry API libraries at versions 1.0 and 1.3. The last package, A048656C6C6F576F726C6401, is the one you just loaded, containing the HelloWorld applet at version 1.0.

For an engineer new to GlobalPlatform, this listing is the most useful artefact in the README, because it shows what a well formed card looks like.

## A multi module Maven project with a real build

The repository is not a single jar source directory, and the build tooling reflects a project with several audiences.

The Makefile wraps Maven. The default target produces tool/target/gp.jar by running the Maven wrapper with javadoc, tests and SpotBugs skipped, and it declares its inputs by globbing the Java sources and poms across the tlv, library, pace, nextgen and tool directories, so a change in any module triggers a rebuild. Other targets cover install, a fast path with tests skipped, a ci target that runs the wrapper with CI set and the exe profile, and a versions target that uses the versions-maven-plugin to display parent, dependency, plugin and extension updates under the rules in version-rules.xml.

There is also a source target that runs OpenRewrite and then the Spotless formatter, with a comment explaining the ordering, because OpenRewrite edits every module during the last one and so it has to finish before the formatter starts.

The licensing hygiene is visible too. There is a REUSE.toml at the root and a LICENSES/ directory, and the Makefile has a reuse target that runs the REUSE lint, which checks that every file carries a licence and copyright notice. That is what the LGPL and MIT terms in the README are delivered through.

The other directories tell you what the project contains: a TLV module for the tag length value encoding that GlobalPlatform messages are built from, a PACE module for the password authenticated connection establishment, a nextgen module for the newer generation of card features, a library module for using the tool from Java code, and tests/ and docs/.

## The Q2 2026 release and a date based version scheme

The NEWS section records the most recent release, v26.06.04, and its contents are worth reading because they describe where the project is going.

The release adds ARA-M access control and contactless services in the nextgen module, introduces a new path addressed TLV editing API across all modules, and brings PACE and SCP03 improvements along with Java 25 builds and many fixes. The full history is in CHANGELOG.md.

That TLV change deserves a note for anyone with an existing integration. A path addressed editing API means the way you locate and modify a nested TLV is different from walking the structure yourself, and it is offered across all modules rather than only the new one, which is the shape of a deliberate migration rather than an addition.

The version scheme itself is unusual and worth understanding before you write it into a build. The releases are dated: v26.06.04 for 2026, June 4, and also v26.04.20.1 and v26.04.20 on the same day, the former with a patch suffix. The Makefile sets the development version from the current date with a -SNAPSHOT suffix, so an unreleased build is named after the day it was cut.

The consequence for you is that versions sort chronologically by date rather than by semantic feature level, so a tool that compares versions for compatibility has to be told how to do it, and two different builds on the same day are distinguished by that trailing counter.

## Licensing, support and where the tool fits

The licence is the one detail in the README that requires careful reading, because it is dual.

The README states LGPL-3.0 for derived code and MIT or LGPL3 for original code, and the badge in the header shows LGPL. The repository implements the REUSE specification, with a REUSE.toml file and a LICENSES/ directory, so the terms are attached per file rather than only in a single LICENSE. In practice this means you can take the original code under the permissive option, and modifications you distribute come with the LGPL obligations.

For a commercial tool that links against the library module, that distinction decides whether you are shipping a derived work or making a call into an unmodified library, and that is a question for your own legal reading rather than for this article.

Support comes in two shapes. Professional support is available from javacard.pro, which is also where the project homepage lives, and community help is through the wiki section called Support & Questions. The Users's Guide points to the Getting Started guide in the wiki as the place to begin, and the wiki also holds the testimonials the README links to.

The last push was on 2026-09-29 and the repository is not archived, with releases v26.06.04 on 2026-06-04, v26.04.20.1 on 2026-04-20 and v26.04.20 on 2026-04-20. The default branch is next while the build badge in the README points at master, so a fork that tracks the default branch is following the development line and not a released tag.

## Conclusion

Adopt GlobalPlatformPro if you develop or test JavaCard applets and want applet installation, privilege listing and key handling in one CLI, or as a Java library inside your own tooling. Do not run it against a production card with the default keys, since the README prints the fallback key it uses when none is given. Before you start, check the version scheme, because releases are dated, note that the default branch is next while the badge points at master, and read the dual licence terms, LGPL-3.0 for derived code and MIT or LGPL3 for the original code, with the last push on 2026-09-29.

## FAQ

### How do I install an applet with GlobalPlatformPro?

Run gp -install HelloWorld.cap -privs CardReset -params with your hex encoded parameter blob, then use gp -l to list the card and confirm the applet was loaded.

### What does the default key warning mean in GlobalPlatformPro?

It means no keys were supplied, so the tool falls back to the published default 404142434445464748494A4B4C4D4E4F. That is fine for a test card and a risk against a card that matters.

### How do I build GlobalPlatformPro from source?

The Makefile wraps the Maven wrapper, with the default target producing tool/target/gp.jar, and a ci target that runs CI=true ./mvnw -U -P exe. The wrapper scripts mvnw and mvnw.cmd are included.

### What changed in the v26.06.04 release of GlobalPlatformPro?

It adds ARA-M access control and contactless services in the nextgen module, a new path addressed TLV editing API across all modules, PACE and SCP03 improvements, and Java 25 builds.

### What licence does GlobalPlatformPro use?

The README states LGPL-3.0 for derived code and MIT or LGPL3 for original code, and the repository carries a LICENSES directory plus a REUSE.toml so licence information is attached per file.

## Sources

- [License: LGPL-3.0](https://github.com/martinpaljak/GlobalPlatformPro/blob/next/LICENSE)
- [martinpaljak/GlobalPlatformPro on GitHub](https://github.com/martinpaljak/GlobalPlatformPro)
- [Project website](https://javacard.pro/globalplatform)
- [README](https://github.com/martinpaljak/GlobalPlatformPro/blob/next/README.md)
- [Releases](https://github.com/martinpaljak/GlobalPlatformPro/releases)

---

Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/martinpaljak-globalplatformpro