What Is Chip Decapping and When Do You Need It?
Chip decapping is the controlled removal of an integrated circuit’s package material—epoxy mold compound, ceramic lid, or metal can—to expose the silicon die underneath. Engineers use it for failure analysis, process verification, counterfeit detection, and authorized firmware recovery when software-based readout methods are blocked by fuse-bit protection. The technique ranges from simple chemical etching on commodity 8-bit MCUs to precision plasma decapsulation on advanced BGA packages with copper pillar interconnects.
Our lab processes roughly 300–400 decapping requests per quarter across MCU, CPLD, FPGA, and mixed-signal families. Below we detail exactly what the process involves, which chips we support, what it costs, and what can go wrong.
How Does the Chip Decapping Process Work?
Every decapping job follows a general sequence, but the specifics vary with package type, die size, and the goal of the exposure. Here is our standard workflow:
1. Package Identification and Planning
We photograph and X-ray the device to locate the die position, bond wires, and lead frame geometry. On multi-die modules (e.g., MCU + EEPROM stacked packages), X-ray is essential to avoid damaging the target die. Planning also determines whether chemical, mechanical, or laser decapsulation is the best approach.
2. Chemical or Mechanical Decapsulation
For plastic-encapsulated ICs—the vast majority of requests—we use fuming nitric acid (HNO₃, 90–98 % concentration) or sulfuric acid (H₂SO₄) heated to 60–80 °C, applied in controlled micro-drops to dissolve the epoxy mold compound without attacking the bond wires or aluminum/copper metallization. Ceramic packages are typically delidded mechanically. Laser decapsulation systems offer sub-100 µm precision for BGA and QFN devices where acid wicking under the die paddle is a risk.
3. Cleaning and Inspection
After the mold compound is removed, residues are flushed with acetone and isopropyl alcohol, then the die surface is inspected under an optical microscope at 50–200× magnification. We verify bond-wire integrity, check for passivation cracks, and confirm the die markings match the labeled part number—an important step in counterfeit screening.
4. Post-Decap Analysis or Readout
Depending on the project goal, the exposed die proceeds to optical imaging, SEM inspection, FIB (focused ion beam) probing, or authorized firmware extraction via microprobing or UV-erasure techniques. The die can also be re-encapsulated for continued functional testing if bond wires remain intact.
Which Chip Families Are Supported for Decapping?
We maintain acid profiles, temperature curves, and exposure-time databases for hundreds of IC families. The table below shows the most frequently requested categories and typical package types we handle.
| IC Family / Vendor | Common Packages | Decap Method | Post-Decap Goal |
|---|---|---|---|
| Atmel / Microchip AVR (ATmega, ATtiny) | DIP-28, TQFP-32, QFN-20 | Chemical (HNO₃) | Fuse reset, firmware recovery |
| Atmel 8051-core (AT89C/S series) | DIP-40, PLCC-44 | Chemical (HNO₃) | Lock-bit bypass, code readout |
| STMicroelectronics STM8 / STM32 | LQFP-48/64, QFN-32 | Chemical or laser | RDP analysis, die imaging |
| Microchip PIC / dsPIC | DIP-28, TQFP-44, QFN | Chemical (HNO₃) | CP-bit analysis, authorized unlock |
| TI MSP430 | TSSOP-28, QFN-40 | Chemical (H₂SO₄) | JTAG fuse inspection |
| STC 8051-core (STC89, STC15, STC8H) | DIP-40, SOP-28, LQFP | Chemical (HNO₃) | Encryption-byte analysis |
| Nuvoton (NUC series, N76E) | LQFP-48, QFN-33 | Chemical | Security-lock evaluation |
| Holtek HT46R / HT66F | DIP-18/28, SOP-16 | Chemical | OTP / flash readout |
| WCH CH552 / CH554 | SOP-16, TSSOP-20 | Chemical | Code-protect evaluation |
| GigaDevice GD32 | LQFP-48/64, QFN | Chemical or laser | SWD-lock analysis |
| Silicon Labs EFM8 / EFM32 | QFN-24/32 | Laser preferred | Lock-byte inspection |
| Xilinx / Intel CPLD & FPGA | BGA, TQFP-144 | Laser + mechanical | Bitstream analysis, FA |
If your part is not listed, submit a feasibility request. We evaluate new devices within 1–2 business days and maintain a success-rate log for every family we have processed.
What Does Chip Decapping Cost?
Pricing depends on package complexity, die size, the number of samples, and the post-decap objective. Below are realistic starting ranges based on our 2024–2025 job log.
| Scope | Typical Price Range (USD) | Notes |
|---|---|---|
| Single DIP/SOP device, chemical decap only | $200 – $400 | Exposed die, optical images included |
| QFP / QFN device, chemical or laser | $350 – $700 | Smaller die-to-pad clearance increases risk |
| BGA device, laser decap | $600 – $1,200 | Reballing possible if functional test needed |
| Decap + firmware readout (authorized) | $500 – $2,500+ | Varies heavily by security level |
| Batch (10+ identical devices) | 30–50 % per-unit discount | Common for failure-analysis lots |
These figures exclude shipping and any NDA setup fees. For a detailed breakdown specific to your part number, request a quote directly.
Turnaround Time for Chip Decapping Projects
Standard turnaround is 5–15 working days from sample receipt, depending on the queue and complexity. Rush service (3–5 days) is available at a 30–50 % surcharge. The main time variables are:
- Acid profiling for a new device: adds 1–3 days if we have not previously decapped that exact part number.
- Post-decap analysis scope: optical-only adds zero; SEM or FIB probing adds 3–7 days.
- Batch size: 20+ units may extend the timeline by 2–5 days for sequential processing.
- Customs clearance: international shipments typically add 2–4 days depending on origin country.
What Can Go Wrong During Decapping?
Transparency about failure modes is part of our process. Common risks include:
- Bond-wire damage: Over-etching or thermal shock can sever gold or copper bond wires. This is the most common failure on QFN packages with short wire loops. Our success rate on QFN decaps is approximately 90–93 %.
- Die-surface corrosion: Prolonged acid exposure attacks aluminum metallization. We mitigate this with timed micro-drop application and real-time microscope monitoring.
- Incomplete mold removal: Under-etching leaves residue that obscures die features. A second controlled etch pass usually resolves this.
- Die cracking: Mechanical stress during delidding of ceramic packages can fracture the silicon. We use slow-speed diamond saws and thermal pre-conditioning to minimize this risk.
When a decap attempt damages the die beyond use, we report the failure with microscope images so you can decide whether to send a replacement sample. We do not charge the full post-decap analysis fee on failed exposures.
Chip Decapping for Authorized Firmware Recovery
A significant share of our chip decapping work supports firmware readout from protected microcontrollers. When a manufacturer’s code-protection fuses block JTAG/SWD/ISP readout, physical die exposure enables techniques such as UV erasure of EPROM-based lock bits, microprobing of internal buses, or glitching voltage rails at the die level.
This work is performed strictly under authorization. We require proof of IP ownership or a signed declaration that the firmware belongs to the requesting party—typically for legacy product maintenance, second-source qualification, or disaster recovery after the original source code was lost. Every project is covered by NDA.
Example: Legacy 8051-Family Recovery
A European industrial-controls company sent us 12 units of an AT89S51-based controller from a discontinued product line. The original firmware developer was unreachable, and the client owned all IP rights. We chemically decapped three samples, confirmed the lock-bit architecture under the microscope, performed UV exposure to reset the lock bits, and successfully read out the 4 KB flash contents on two of the three units. Total turnaround: 8 working days from receipt.
Check feasibility for your project
Send the chip marking or board details and tell us what you need to recover. Add clear photos if available.
Request a feasibility reviewFrequently Asked Questions About Chip Decapping
Is chip decapping destructive to the IC?
The package is permanently destroyed, but the silicon die and bond wires can remain functional if the decap is performed carefully. On DIP and SOP packages, we achieve functional-die preservation rates above 95 %. QFN and BGA packages carry higher risk (roughly 90–93 % success) because of tighter wire-loop geometries. If you need the chip to remain operational after exposure, specify this upfront so we can adjust the acid profile.
What information do you need to quote a chip decapping job?
At minimum: the full part number (including package suffix), the number of samples you can supply, and the post-decap objective (visual inspection only, die photography, firmware recovery, failure analysis, or counterfeit detection). An X-ray image or datasheet link speeds up the evaluation. We typically return a quote within 1–2 business days.
Can you decap BGA and flip-chip packages?
Yes. BGA decapsulation uses our laser system to ablate mold compound without disturbing solder balls. Flip-chip devices require backside thinning rather than topside decap—we use mechanical lapping followed by selective chemical etching to reach the active silicon layer from the substrate side. Both processes cost more and take longer than standard topside chemical decaps.
How does chip decapping relate to IC unlock services?
Decapping is one physical step within a broader IC unlock workflow. After the die is exposed, specific techniques—UV erasure, microprobing, FIB circuit editing, or voltage glitching—are applied depending on the chip’s security architecture. Not every IC unlock requires decapping; some parts can be unlocked via software exploits alone. We assess the most efficient path during the feasibility stage.
Do you ship decapped dies back to the customer?
Yes. We can return the exposed die mounted on a carrier for your own inspection, or we can provide high-resolution optical and SEM images as deliverables. Shipping exposed dies requires anti-static gel packs and cushioned containers; we include appropriate packaging at no extra charge.
Related Services and Chip-Specific Pages
- GD32F303 unlock and firmware recovery
- STC15W series code extraction
- ATmega32 flash readout and lock-bit reset
Check feasibility for your project
Send the chip marking or board details and tell us what you need to recover. Add clear photos if available.
Request a feasibility reviewWorking on a board like this?
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.
Get a free quote