diff --git a/examples/chip-tool/commands/clusters/Commands.h b/examples/chip-tool/commands/clusters/Commands.h
index 1b58c7ec17c2ee..bd1565a183f724 100644
--- a/examples/chip-tool/commands/clusters/Commands.h
+++ b/examples/chip-tool/commands/clusters/Commands.h
@@ -11516,9 +11516,8 @@ class NetworkCommissioningAddThreadNetwork : public ModelCommand
 
         chip::Controller::NetworkCommissioningCluster cluster;
         cluster.Associate(device, endpointId);
-        return cluster.AddThreadNetwork(onSuccessCallback->Cancel(), onFailureCallback->Cancel(),
-                                        chip::ByteSpan(chip::Uint8::from_char(mOperationalDataset), strlen(mOperationalDataset)),
-                                        mBreadcrumb, mTimeoutMs);
+        return cluster.AddThreadNetwork(onSuccessCallback->Cancel(), onFailureCallback->Cancel(), mOperationalDataset, mBreadcrumb,
+                                        mTimeoutMs);
     }
 
 private:
@@ -11527,7 +11526,7 @@ class NetworkCommissioningAddThreadNetwork : public ModelCommand
             OnNetworkCommissioningClusterAddThreadNetworkResponse, this);
     chip::Callback::Callback<DefaultFailureCallback> * onFailureCallback =
         new chip::Callback::Callback<DefaultFailureCallback>(OnDefaultFailureResponse, this);
-    char * mOperationalDataset;
+    chip::ByteSpan mOperationalDataset;
     uint64_t mBreadcrumb;
     uint32_t mTimeoutMs;
 };
@@ -11558,9 +11557,8 @@ class NetworkCommissioningAddWiFiNetwork : public ModelCommand
 
         chip::Controller::NetworkCommissioningCluster cluster;
         cluster.Associate(device, endpointId);
-        return cluster.AddWiFiNetwork(
-            onSuccessCallback->Cancel(), onFailureCallback->Cancel(), chip::ByteSpan(chip::Uint8::from_char(mSsid), strlen(mSsid)),
-            chip::ByteSpan(chip::Uint8::from_char(mCredentials), strlen(mCredentials)), mBreadcrumb, mTimeoutMs);
+        return cluster.AddWiFiNetwork(onSuccessCallback->Cancel(), onFailureCallback->Cancel(), mSsid, mCredentials, mBreadcrumb,
+                                      mTimeoutMs);
     }
 
 private:
@@ -11569,8 +11567,8 @@ class NetworkCommissioningAddWiFiNetwork : public ModelCommand
             OnNetworkCommissioningClusterAddWiFiNetworkResponse, this);
     chip::Callback::Callback<DefaultFailureCallback> * onFailureCallback =
         new chip::Callback::Callback<DefaultFailureCallback>(OnDefaultFailureResponse, this);
-    char * mSsid;
-    char * mCredentials;
+    chip::ByteSpan mSsid;
+    chip::ByteSpan mCredentials;
     uint64_t mBreadcrumb;
     uint32_t mTimeoutMs;
 };
@@ -11600,8 +11598,7 @@ class NetworkCommissioningDisableNetwork : public ModelCommand
 
         chip::Controller::NetworkCommissioningCluster cluster;
         cluster.Associate(device, endpointId);
-        return cluster.DisableNetwork(onSuccessCallback->Cancel(), onFailureCallback->Cancel(),
-                                      chip::ByteSpan(chip::Uint8::from_char(mNetworkID), strlen(mNetworkID)), mBreadcrumb,
+        return cluster.DisableNetwork(onSuccessCallback->Cancel(), onFailureCallback->Cancel(), mNetworkID, mBreadcrumb,
                                       mTimeoutMs);
     }
 
@@ -11611,7 +11608,7 @@ class NetworkCommissioningDisableNetwork : public ModelCommand
             OnNetworkCommissioningClusterDisableNetworkResponse, this);
     chip::Callback::Callback<DefaultFailureCallback> * onFailureCallback =
         new chip::Callback::Callback<DefaultFailureCallback>(OnDefaultFailureResponse, this);
-    char * mNetworkID;
+    chip::ByteSpan mNetworkID;
     uint64_t mBreadcrumb;
     uint32_t mTimeoutMs;
 };
@@ -11641,9 +11638,7 @@ class NetworkCommissioningEnableNetwork : public ModelCommand
 
         chip::Controller::NetworkCommissioningCluster cluster;
         cluster.Associate(device, endpointId);
-        return cluster.EnableNetwork(onSuccessCallback->Cancel(), onFailureCallback->Cancel(),
-                                     chip::ByteSpan(chip::Uint8::from_char(mNetworkID), strlen(mNetworkID)), mBreadcrumb,
-                                     mTimeoutMs);
+        return cluster.EnableNetwork(onSuccessCallback->Cancel(), onFailureCallback->Cancel(), mNetworkID, mBreadcrumb, mTimeoutMs);
     }
 
 private:
@@ -11652,7 +11647,7 @@ class NetworkCommissioningEnableNetwork : public ModelCommand
             OnNetworkCommissioningClusterEnableNetworkResponse, this);
     chip::Callback::Callback<DefaultFailureCallback> * onFailureCallback =
         new chip::Callback::Callback<DefaultFailureCallback>(OnDefaultFailureResponse, this);
-    char * mNetworkID;
+    chip::ByteSpan mNetworkID;
     uint64_t mBreadcrumb;
     uint32_t mTimeoutMs;
 };
@@ -11716,9 +11711,7 @@ class NetworkCommissioningRemoveNetwork : public ModelCommand
 
         chip::Controller::NetworkCommissioningCluster cluster;
         cluster.Associate(device, endpointId);
-        return cluster.RemoveNetwork(onSuccessCallback->Cancel(), onFailureCallback->Cancel(),
-                                     chip::ByteSpan(chip::Uint8::from_char(mNetworkID), strlen(mNetworkID)), mBreadcrumb,
-                                     mTimeoutMs);
+        return cluster.RemoveNetwork(onSuccessCallback->Cancel(), onFailureCallback->Cancel(), mNetworkID, mBreadcrumb, mTimeoutMs);
     }
 
 private:
@@ -11727,7 +11720,7 @@ class NetworkCommissioningRemoveNetwork : public ModelCommand
             OnNetworkCommissioningClusterRemoveNetworkResponse, this);
     chip::Callback::Callback<DefaultFailureCallback> * onFailureCallback =
         new chip::Callback::Callback<DefaultFailureCallback>(OnDefaultFailureResponse, this);
-    char * mNetworkID;
+    chip::ByteSpan mNetworkID;
     uint64_t mBreadcrumb;
     uint32_t mTimeoutMs;
 };
@@ -11757,8 +11750,7 @@ class NetworkCommissioningScanNetworks : public ModelCommand
 
         chip::Controller::NetworkCommissioningCluster cluster;
         cluster.Associate(device, endpointId);
-        return cluster.ScanNetworks(onSuccessCallback->Cancel(), onFailureCallback->Cancel(),
-                                    chip::ByteSpan(chip::Uint8::from_char(mSsid), strlen(mSsid)), mBreadcrumb, mTimeoutMs);
+        return cluster.ScanNetworks(onSuccessCallback->Cancel(), onFailureCallback->Cancel(), mSsid, mBreadcrumb, mTimeoutMs);
     }
 
 private:
@@ -11767,7 +11759,7 @@ class NetworkCommissioningScanNetworks : public ModelCommand
             OnNetworkCommissioningClusterScanNetworksResponse, this);
     chip::Callback::Callback<DefaultFailureCallback> * onFailureCallback =
         new chip::Callback::Callback<DefaultFailureCallback>(OnDefaultFailureResponse, this);
-    char * mSsid;
+    chip::ByteSpan mSsid;
     uint64_t mBreadcrumb;
     uint32_t mTimeoutMs;
 };
@@ -11797,8 +11789,7 @@ class NetworkCommissioningUpdateThreadNetwork : public ModelCommand
 
         chip::Controller::NetworkCommissioningCluster cluster;
         cluster.Associate(device, endpointId);
-        return cluster.UpdateThreadNetwork(onSuccessCallback->Cancel(), onFailureCallback->Cancel(),
-                                           chip::ByteSpan(chip::Uint8::from_char(mOperationalDataset), strlen(mOperationalDataset)),
+        return cluster.UpdateThreadNetwork(onSuccessCallback->Cancel(), onFailureCallback->Cancel(), mOperationalDataset,
                                            mBreadcrumb, mTimeoutMs);
     }
 
@@ -11808,7 +11799,7 @@ class NetworkCommissioningUpdateThreadNetwork : public ModelCommand
             OnNetworkCommissioningClusterUpdateThreadNetworkResponse, this);
     chip::Callback::Callback<DefaultFailureCallback> * onFailureCallback =
         new chip::Callback::Callback<DefaultFailureCallback>(OnDefaultFailureResponse, this);
-    char * mOperationalDataset;
+    chip::ByteSpan mOperationalDataset;
     uint64_t mBreadcrumb;
     uint32_t mTimeoutMs;
 };
@@ -11839,9 +11830,8 @@ class NetworkCommissioningUpdateWiFiNetwork : public ModelCommand
 
         chip::Controller::NetworkCommissioningCluster cluster;
         cluster.Associate(device, endpointId);
-        return cluster.UpdateWiFiNetwork(
-            onSuccessCallback->Cancel(), onFailureCallback->Cancel(), chip::ByteSpan(chip::Uint8::from_char(mSsid), strlen(mSsid)),
-            chip::ByteSpan(chip::Uint8::from_char(mCredentials), strlen(mCredentials)), mBreadcrumb, mTimeoutMs);
+        return cluster.UpdateWiFiNetwork(onSuccessCallback->Cancel(), onFailureCallback->Cancel(), mSsid, mCredentials, mBreadcrumb,
+                                         mTimeoutMs);
     }
 
 private:
@@ -11850,8 +11840,8 @@ class NetworkCommissioningUpdateWiFiNetwork : public ModelCommand
             OnNetworkCommissioningClusterUpdateWiFiNetworkResponse, this);
     chip::Callback::Callback<DefaultFailureCallback> * onFailureCallback =
         new chip::Callback::Callback<DefaultFailureCallback>(OnDefaultFailureResponse, this);
-    char * mSsid;
-    char * mCredentials;
+    chip::ByteSpan mSsid;
+    chip::ByteSpan mCredentials;
     uint64_t mBreadcrumb;
     uint32_t mTimeoutMs;
 };
@@ -12207,10 +12197,8 @@ class OperationalCredentialsAddOpCert : public ModelCommand
 
         chip::Controller::OperationalCredentialsCluster cluster;
         cluster.Associate(device, endpointId);
-        return cluster.AddOpCert(
-            onSuccessCallback->Cancel(), onFailureCallback->Cancel(), chip::ByteSpan(chip::Uint8::from_char(mNoc), strlen(mNoc)),
-            chip::ByteSpan(chip::Uint8::from_char(mICACertificate), strlen(mICACertificate)),
-            chip::ByteSpan(chip::Uint8::from_char(mIPKValue), strlen(mIPKValue)), mCaseAdminNode, mAdminVendorId);
+        return cluster.AddOpCert(onSuccessCallback->Cancel(), onFailureCallback->Cancel(), mNoc, mICACertificate, mIPKValue,
+                                 mCaseAdminNode, mAdminVendorId);
     }
 
 private:
@@ -12219,9 +12207,9 @@ class OperationalCredentialsAddOpCert : public ModelCommand
             OnOperationalCredentialsClusterOpCertResponse, this);
     chip::Callback::Callback<DefaultFailureCallback> * onFailureCallback =
         new chip::Callback::Callback<DefaultFailureCallback>(OnDefaultFailureResponse, this);
-    char * mNoc;
-    char * mICACertificate;
-    char * mIPKValue;
+    chip::ByteSpan mNoc;
+    chip::ByteSpan mICACertificate;
+    chip::ByteSpan mIPKValue;
     chip::NodeId mCaseAdminNode;
     uint16_t mAdminVendorId;
 };
@@ -12249,8 +12237,7 @@ class OperationalCredentialsOpCSRRequest : public ModelCommand
 
         chip::Controller::OperationalCredentialsCluster cluster;
         cluster.Associate(device, endpointId);
-        return cluster.OpCSRRequest(onSuccessCallback->Cancel(), onFailureCallback->Cancel(),
-                                    chip::ByteSpan(chip::Uint8::from_char(mCSRNonce), strlen(mCSRNonce)));
+        return cluster.OpCSRRequest(onSuccessCallback->Cancel(), onFailureCallback->Cancel(), mCSRNonce);
     }
 
 private:
@@ -12259,7 +12246,7 @@ class OperationalCredentialsOpCSRRequest : public ModelCommand
             OnOperationalCredentialsClusterOpCSRResponse, this);
     chip::Callback::Callback<DefaultFailureCallback> * onFailureCallback =
         new chip::Callback::Callback<DefaultFailureCallback>(OnDefaultFailureResponse, this);
-    char * mCSRNonce;
+    chip::ByteSpan mCSRNonce;
 };
 
 /*
@@ -15873,8 +15860,7 @@ class WriteTestClusterOctetString : public ModelCommand
 
         chip::Controller::TestClusterCluster cluster;
         cluster.Associate(device, endpointId);
-        return cluster.WriteAttributeOctetString(onSuccessCallback->Cancel(), onFailureCallback->Cancel(),
-                                                 chip::ByteSpan(chip::Uint8::from_char(mValue), strlen(mValue)));
+        return cluster.WriteAttributeOctetString(onSuccessCallback->Cancel(), onFailureCallback->Cancel(), mValue);
     }
 
 private:
@@ -15882,7 +15868,7 @@ class WriteTestClusterOctetString : public ModelCommand
         new chip::Callback::Callback<DefaultSuccessCallback>(OnDefaultSuccessResponse, this);
     chip::Callback::Callback<DefaultFailureCallback> * onFailureCallback =
         new chip::Callback::Callback<DefaultFailureCallback>(OnDefaultFailureResponse, this);
-    char * mValue;
+    chip::ByteSpan mValue;
 };
 
 /*
@@ -16661,9 +16647,7 @@ class TrustedRootCertificatesAddTrustedRootCertificate : public ModelCommand
 
         chip::Controller::TrustedRootCertificatesCluster cluster;
         cluster.Associate(device, endpointId);
-        return cluster.AddTrustedRootCertificate(
-            onSuccessCallback->Cancel(), onFailureCallback->Cancel(),
-            chip::ByteSpan(chip::Uint8::from_char(mRootCertificate), strlen(mRootCertificate)));
+        return cluster.AddTrustedRootCertificate(onSuccessCallback->Cancel(), onFailureCallback->Cancel(), mRootCertificate);
     }
 
 private:
@@ -16671,7 +16655,7 @@ class TrustedRootCertificatesAddTrustedRootCertificate : public ModelCommand
         new chip::Callback::Callback<DefaultSuccessCallback>(OnDefaultSuccessResponse, this);
     chip::Callback::Callback<DefaultFailureCallback> * onFailureCallback =
         new chip::Callback::Callback<DefaultFailureCallback>(OnDefaultFailureResponse, this);
-    char * mRootCertificate;
+    chip::ByteSpan mRootCertificate;
 };
 
 /*
@@ -16697,9 +16681,8 @@ class TrustedRootCertificatesRemoveTrustedRootCertificate : public ModelCommand
 
         chip::Controller::TrustedRootCertificatesCluster cluster;
         cluster.Associate(device, endpointId);
-        return cluster.RemoveTrustedRootCertificate(
-            onSuccessCallback->Cancel(), onFailureCallback->Cancel(),
-            chip::ByteSpan(chip::Uint8::from_char(mTrustedRootIdentifier), strlen(mTrustedRootIdentifier)));
+        return cluster.RemoveTrustedRootCertificate(onSuccessCallback->Cancel(), onFailureCallback->Cancel(),
+                                                    mTrustedRootIdentifier);
     }
 
 private:
@@ -16707,7 +16690,7 @@ class TrustedRootCertificatesRemoveTrustedRootCertificate : public ModelCommand
         new chip::Callback::Callback<DefaultSuccessCallback>(OnDefaultSuccessResponse, this);
     chip::Callback::Callback<DefaultFailureCallback> * onFailureCallback =
         new chip::Callback::Callback<DefaultFailureCallback>(OnDefaultFailureResponse, this);
-    char * mTrustedRootIdentifier;
+    chip::ByteSpan mTrustedRootIdentifier;
 };
 
 /*
diff --git a/examples/chip-tool/commands/common/Command.cpp b/examples/chip-tool/commands/common/Command.cpp
index f7eadccd37fd16..3d889ed2648133 100644
--- a/examples/chip-tool/commands/common/Command.cpp
+++ b/examples/chip-tool/commands/common/Command.cpp
@@ -23,7 +23,12 @@
 #include <sys/socket.h>
 #include <sys/types.h>
 
+#include <lib/core/CHIPSafeCasts.h>
+#include <support/BytesToHex.h>
+#include <support/CHIPMem.h>
+#include <support/CodeUtils.h>
 #include <support/SafeInt.h>
+#include <support/ScopedBuffer.h>
 #include <support/logging/CHIPLogging.h>
 
 bool Command::InitArguments(int argc, char ** argv)
@@ -78,7 +83,7 @@ static bool ParseAddressWithInterface(const char * addressString, Command::Addre
     return true;
 }
 
-bool Command::InitArgument(size_t argIndex, const char * argValue)
+bool Command::InitArgument(size_t argIndex, char * argValue)
 {
     bool isValidArgument = false;
 
@@ -91,10 +96,63 @@ bool Command::InitArgument(size_t argIndex, const char * argValue)
         break;
     }
 
-    case ArgumentType::String: {
+    case ArgumentType::CharString: {
         const char ** value = reinterpret_cast<const char **>(arg.value);
-        *value              = const_cast<char *>(argValue);
-        isValidArgument     = (strcmp(argValue, *value) == 0);
+        *value              = argValue;
+        isValidArgument     = true;
+        break;
+    }
+
+    case ArgumentType::OctetString: {
+        auto * value = static_cast<chip::ByteSpan *>(arg.value);
+        // We support two ways to pass an octet string argument.  If it happens
+        // to be all-ASCII, you can just pass it in.  Otherwise you can pass in
+        // 0x followed by the hex-encoded bytes.
+        size_t argLen                     = strlen(argValue);
+        static constexpr char hexPrefix[] = "hex:";
+        constexpr size_t prefixLen        = ArraySize(hexPrefix) - 1; // Don't count the null
+        if (strncmp(argValue, hexPrefix, prefixLen) == 0)
+        {
+            // Hex-encoded.  Decode it into a temporary buffer first, so if we
+            // run into errors we can do correct "argument is not valid" logging
+            // that actually shows the value that was passed in.  After we
+            // determine it's valid, modify the passed-in value to hold the
+            // right bytes, so we don't need to worry about allocating storage
+            // for this somewhere else.  This works because the hex
+            // representation is always longer than the octet string it encodes,
+            // so we have enough space in argValue for the decoded version.
+            chip::Platform::ScopedMemoryBuffer<uint8_t> buffer;
+            if (!buffer.Calloc(argLen)) // Bigger than needed, but it's fine.
+            {
+                isValidArgument = false;
+                break;
+            }
+
+            size_t octetCount = chip::Encoding::HexToBytes(argValue + prefixLen, argLen - prefixLen, buffer.Get(), argLen);
+            if (octetCount == 0)
+            {
+                isValidArgument = false;
+                break;
+            }
+
+            memcpy(argValue, buffer.Get(), octetCount);
+            *value          = chip::ByteSpan(chip::Uint8::from_char(argValue), octetCount);
+            isValidArgument = true;
+        }
+        else
+        {
+            // Just ASCII.  Check for the "str:" prefix.
+            static constexpr char strPrefix[] = "str:";
+            constexpr size_t strPrefixLen     = ArraySize(strPrefix) - 1; // Don't count the null
+            if (strncmp(argValue, strPrefix, strPrefixLen) == 0)
+            {
+                // Skip the prefix
+                argValue += strPrefixLen;
+                argLen -= strPrefixLen;
+            }
+            *value          = chip::ByteSpan(chip::Uint8::from_char(argValue), argLen);
+            isValidArgument = true;
+        }
         break;
     }
 
@@ -237,7 +295,18 @@ size_t Command::AddArgument(const char * name, const char * value)
 size_t Command::AddArgument(const char * name, char ** value)
 {
     Argument arg;
-    arg.type  = ArgumentType::String;
+    arg.type  = ArgumentType::CharString;
+    arg.name  = name;
+    arg.value = reinterpret_cast<void *>(value);
+
+    mArgs.emplace_back(arg);
+    return mArgs.size();
+}
+
+size_t Command::AddArgument(const char * name, chip::ByteSpan * value)
+{
+    Argument arg;
+    arg.type  = ArgumentType::OctetString;
     arg.name  = name;
     arg.value = reinterpret_cast<void *>(value);
 
diff --git a/examples/chip-tool/commands/common/Command.h b/examples/chip-tool/commands/common/Command.h
index 8fa8e87b97a0b2..bcb09c30112267 100644
--- a/examples/chip-tool/commands/common/Command.h
+++ b/examples/chip-tool/commands/common/Command.h
@@ -20,6 +20,7 @@
 
 #include <controller/CHIPDeviceController.h>
 #include <inet/InetInterface.h>
+#include <support/Span.h>
 #include <support/logging/CHIPLogging.h>
 
 #include <atomic>
@@ -56,7 +57,8 @@ enum ArgumentType
     Number_int16,
     Number_int32,
     Number_int64,
-    String,
+    CharString,
+    OctetString,
     Attribute,
     Address
 };
@@ -100,13 +102,17 @@ class Command
     size_t AddArgument(const char * name, const char * value);
     /**
      * @brief
-     *   Add a string command argument
+     *   Add a char string command argument
      *
      * @param name  The name that will be displayed in the command help
      * @param value A pointer to a `char *` where the argv value will be stored
      * @returns The number of arguments currently added to the command
      */
     size_t AddArgument(const char * name, char ** value);
+    /**
+     * Add an octet string command argument
+     */
+    size_t AddArgument(const char * name, chip::ByteSpan * value);
     size_t AddArgument(const char * name, AddressWithInterface * out);
     size_t AddArgument(const char * name, int64_t min, uint64_t max, int8_t * out)
     {
@@ -154,7 +160,7 @@ class Command
     void WaitForResponse(uint16_t duration);
 
 private:
-    bool InitArgument(size_t argIndex, const char * argValue);
+    bool InitArgument(size_t argIndex, char * argValue);
     size_t AddArgument(const char * name, int64_t min, uint64_t max, void * out, ArgumentType type);
     size_t AddArgument(const char * name, int64_t min, uint64_t max, void * out);
 
diff --git a/examples/chip-tool/commands/pairing/PairingCommand.cpp b/examples/chip-tool/commands/pairing/PairingCommand.cpp
index 3d9f5a01b0a27e..ba12c5d0e88762 100644
--- a/examples/chip-tool/commands/pairing/PairingCommand.cpp
+++ b/examples/chip-tool/commands/pairing/PairingCommand.cpp
@@ -209,19 +209,16 @@ CHIP_ERROR PairingCommand::AddThreadNetwork()
 {
     Callback::Cancelable * successCallback = mOnAddThreadNetworkCallback->Cancel();
     Callback::Cancelable * failureCallback = mOnFailureCallback->Cancel();
-    ByteSpan operationalDataset            = ByteSpan(Uint8::from_char(mOperationalDataset), strlen(mOperationalDataset));
 
-    return mCluster.AddThreadNetwork(successCallback, failureCallback, operationalDataset, kBreadcrumb, kTimeoutMs);
+    return mCluster.AddThreadNetwork(successCallback, failureCallback, mOperationalDataset, kBreadcrumb, kTimeoutMs);
 }
 
 CHIP_ERROR PairingCommand::AddWiFiNetwork()
 {
     Callback::Cancelable * successCallback = mOnAddWiFiNetworkCallback->Cancel();
     Callback::Cancelable * failureCallback = mOnFailureCallback->Cancel();
-    ByteSpan ssid                          = ByteSpan(Uint8::from_char(mSSID), strlen(mSSID));
-    ByteSpan credentials                   = ByteSpan(Uint8::from_char(mPassword), strlen(mPassword));
 
-    return mCluster.AddWiFiNetwork(successCallback, failureCallback, ssid, credentials, kBreadcrumb, kTimeoutMs);
+    return mCluster.AddWiFiNetwork(successCallback, failureCallback, mSSID, mPassword, kBreadcrumb, kTimeoutMs);
 }
 
 CHIP_ERROR PairingCommand::EnableNetwork()
@@ -232,7 +229,7 @@ CHIP_ERROR PairingCommand::EnableNetwork()
     ByteSpan networkId;
     if (mNetworkType == PairingNetworkType::WiFi)
     {
-        networkId = ByteSpan(Uint8::from_char(mSSID), strlen(mSSID));
+        networkId = mSSID;
     }
     else
     {
diff --git a/examples/chip-tool/commands/pairing/PairingCommand.h b/examples/chip-tool/commands/pairing/PairingCommand.h
index d5e122263ab211..2d0b7abbbf1572 100644
--- a/examples/chip-tool/commands/pairing/PairingCommand.h
+++ b/examples/chip-tool/commands/pairing/PairingCommand.h
@@ -24,6 +24,7 @@
 #include "gen/CHIPClusters.h"
 
 #include <controller/ExampleOperationalCredentialsIssuer.h>
+#include <support/Span.h>
 
 enum class PairingMode
 {
@@ -134,9 +135,9 @@ class PairingCommand : public Command,
     uint64_t mFabricId;
     uint16_t mDiscriminator;
     uint32_t mSetupPINCode;
-    char * mOperationalDataset;
-    char * mSSID;
-    char * mPassword;
+    chip::ByteSpan mOperationalDataset;
+    chip::ByteSpan mSSID;
+    chip::ByteSpan mPassword;
 
     chip::Callback::Callback<NetworkCommissioningClusterAddThreadNetworkResponseCallback> * mOnAddThreadNetworkCallback;
     chip::Callback::Callback<NetworkCommissioningClusterAddWiFiNetworkResponseCallback> * mOnAddWiFiNetworkCallback;
diff --git a/examples/chip-tool/templates/commands.zapt b/examples/chip-tool/templates/commands.zapt
index a2c116735f2c88..096f716b150732 100644
--- a/examples/chip-tool/templates/commands.zapt
+++ b/examples/chip-tool/templates/commands.zapt
@@ -205,7 +205,7 @@ public:
 
         chip::Controller::{{asCamelCased parent.name false}}Cluster cluster;
         cluster.Associate(device, endpointId);
-        return cluster.{{asCamelCased name false}}(onSuccessCallback->Cancel(), onFailureCallback->Cancel(){{#chip_server_cluster_command_arguments}}, {{#if (isString type)}} chip::ByteSpan(chip::Uint8::from_char(m{{asCamelCased label false}}), strlen(m{{asCamelCased label false}})){{else}}m{{asCamelCased label false}}{{/if}}{{/chip_server_cluster_command_arguments}});
+        return cluster.{{asCamelCased name false}}(onSuccessCallback->Cancel(), onFailureCallback->Cancel(){{#chip_server_cluster_command_arguments}}, {{#if (isCharString type)}} chip::ByteSpan(chip::Uint8::from_char(m{{asCamelCased label false}}), strlen(m{{asCamelCased label false}})){{else}}m{{asCamelCased label false}}{{/if}}{{/chip_server_cluster_command_arguments}});
     }
 
 private:
@@ -216,7 +216,7 @@ private:
     {{/if}}
     chip::Callback::Callback<DefaultFailureCallback> * onFailureCallback = new chip::Callback::Callback<DefaultFailureCallback>(OnDefaultFailureResponse, this);
     {{#chip_server_cluster_command_arguments}}
-    {{#if (isString type)}}
+    {{#if (isCharString type)}}
     char * m{{asCamelCased label false}};
     {{else}}
     {{chipType}} m{{asCamelCased label false}};
@@ -321,13 +321,13 @@ public:
 
         chip::Controller::{{asCamelCased parent.name false}}Cluster cluster;
         cluster.Associate(device, endpointId);
-        return cluster.WriteAttribute{{asCamelCased name false}}(onSuccessCallback->Cancel(), onFailureCallback->Cancel(), {{#if (isString type)}} chip::ByteSpan(chip::Uint8::from_char(mValue), strlen(mValue)){{else}}mValue{{/if}});
+        return cluster.WriteAttribute{{asCamelCased name false}}(onSuccessCallback->Cancel(), onFailureCallback->Cancel(), {{#if (isCharString type)}} chip::ByteSpan(chip::Uint8::from_char(mValue), strlen(mValue)){{else}}mValue{{/if}});
     }
 
 private:
     chip::Callback::Callback<DefaultSuccessCallback> * onSuccessCallback = new chip::Callback::Callback<DefaultSuccessCallback>(OnDefaultSuccessResponse, this);
     chip::Callback::Callback<DefaultFailureCallback> * onFailureCallback = new chip::Callback::Callback<DefaultFailureCallback>(OnDefaultFailureResponse, this);
-    {{#if (isString type)}}
+    {{#if (isCharString type)}}
     char * mValue;
     {{else}}
     {{chipType}} mValue;
diff --git a/src/app/zap-templates/README.md b/src/app/zap-templates/README.md
index db73ddb027f8c3..f53b615e543ea9 100644
--- a/src/app/zap-templates/README.md
+++ b/src/app/zap-templates/README.md
@@ -61,7 +61,7 @@ To generate the application additional files, the command is:
 For example, to generate `chip-tool` additional files the command is:
 
 ```
-./scripts/tools/zap/generate.py examples/chip-tool/chip-tool.zap -t examples/chip-tool/templates/templates.json
+./scripts/tools/zap/generate.py src/controller/data_model/controller-clusters.zap -t examples/chip-tool/templates/templates.json
 ```
 
 For more information please see the documentation under `docs/` in
diff --git a/src/lib/support/BytesToHex.h b/src/lib/support/BytesToHex.h
index b4e0954a8891b6..38b6bb12484ad8 100644
--- a/src/lib/support/BytesToHex.h
+++ b/src/lib/support/BytesToHex.h
@@ -96,6 +96,23 @@ inline CHIP_ERROR BytesToLowercaseHexString(const uint8_t * src_bytes, size_t sr
     return BytesToHex(src_bytes, src_size, dest_hex_str, dest_size_max, HexFlags::kNullTerminate);
 }
 
+/**
+ * Convert a buffer of hexadecimal characters to bytes.  Supports both lowercase
+ * and uppercase (or a mix of cases) hexadecimal characters. Supported input is
+ * [0-9a-fA-F].
+ *
+ * @param srcHex a pointer to the character buffer to convert.  It is not
+ *               assumed to be null-terminated.
+ * @param srcLen the length of the character buffer to convert.
+ * @param destBytes the buffer to fill with the decoded bytes.
+ * @param destMaxLen the total size of the buffer to be filled.
+ *
+ * @return 0 on errors:
+ *           - destMaxLen not big enough.
+ *           - srcLen not even.
+ *           - Some character not in [0-9a-fA-F] is present in srcHex.
+ *         number of bytes actually decoded from the string on success.
+ */
 size_t HexToBytes(const char * srcHex, const size_t srcLen, uint8_t * destBytes, size_t destMaxLen);
 
 } // namespace Encoding