Free tool
Mode S message builder
Enter a position, a callsign or a raw payload and get a valid 112-bit frame back with a correct CRC-24.
What to build
Or click an example
Enter an address, a position and an altitude to build the even and odd pair.
How this works
- What a valid frame requires
- The builder zeroes the last 24 bits, runs the CRC-24 polynomial over the first 88 bits, and writes the remainder into those 24 bits. That is the same procedure a real transponder uses. Any decoder or CRC checker that divides the full 112 bits by the same polynomial gets a zero remainder, confirming the frame is intact. The builder and the checker share no code path — the match is a genuine cross-check.
- Why CPR needs two frames
- Compact Position Reporting compresses a latitude and longitude into 17 bits each — far too few to be unambiguous. The trick is that an even frame and an odd frame divide the globe into slightly different grids. One frame alone maps to multiple positions a few degrees apart. Overlaying both grids narrows it to one. The builder emits both frames because a single frame is not a position — it is an index into a repeating grid, and anyone who decodes it alone gets the wrong coordinate.
bit 1112 bitsbit 112
DF
Address
ME payload
CRC-24
5
3CA
24
56
24
Worked example
Input
- Address
- 40621D
- Position
- 52.2572°N, 3.91937°E
- Altitude
- 38,000 ft
Output
Even frame8D40621D58C382D690C8AC2863A7
Odd frame8D40621D58C386435CC412692AD6
Two frames — one even, one odd — for the same position. Decoded together they resolve to the original coordinate. This is the canonical pyModeS example, reproduced bit for bit.
Frequently asked questions
- What is an extended squitter?
- An extended squitter is a 112-bit Mode S message that an aircraft broadcasts on its own, without being interrogated by a ground station. It carries the ICAO address, a type-coded payload, and a CRC-24. ADS-B position, velocity, and identification messages are all extended squitters (downlink format 17).
- Why does a position require two frames?
- Compact Position Reporting (CPR) compresses a latitude and longitude into 17 bits each. One CPR message is ambiguous: it maps to multiple positions a few degrees apart. An even frame and an odd frame together eliminate the ambiguity and resolve a unique coordinate. A single frame plus a known reference position can also work.
- What is the ICAO address?
- A 24-bit hexadecimal identifier assigned to each aircraft. It occupies bits 9 through 32 of every Mode S message. For many countries the address encodes the tail number arithmetically. For others it is a database lookup. The address is what links successive messages to the same aircraft.
- How is the CRC computed?
- The builder computes the CRC-24 over the first 88 bits of the frame using the Mode S generator polynomial (0x1FFF409) and writes the result into the last 24 bits. Any decoder or CRC checker that runs the same polynomial over the full 112 bits will get a zero residual, confirming the frame is valid.
- Can I build any downlink format?
- This tool builds DF17 extended squitters only: position (even/odd pair), identification (callsign), and raw payloads. Surveillance replies (DF0, DF4, DF5) XOR the aircraft address into the CRC field. The tool does not build those formats because the result cannot be verified by CRC alone.
- How do I verify the output?
- Paste the hex into the ADS-B message decoder on this site. Every field should match what you entered. The CRC checker will show a zero residual. The builder and the decoder share no code path, so a match is a genuine cross-check.
You just built one 112-bit frame by hand.
A SkyPath print is composed from millions of them — real ADS-B position reports over a single airport, chosen and composed by hand, colored by altitude, then printed on aluminum.
See the airports