[ Flipper Zero ]

The Flipper Zero is a pocket multitool for the wireless and wired protocols
that are all around you: the garage remote, the office badge, the TV, the
temperature sensor, the USB port. It bundles a handful of radios and a couple of
wired interfaces behind a little screen and a d-pad, with a dolphin that judges
how much you use it. It is built for learning how these systems work, and for
testing the ones you own or are paid to test.

That last part is the whole game. The Flipper does not break modern encryption
or pick locks by magic; most of what it does is read, save, and replay signals
that were never secured in the first place, plus emulate cards and type USB
payloads. Used on your own gear it is a brilliant way to see how insecure the
everyday radio world actually is. Used on someone else's, it is a crime. The
legal line below is not boilerplate; read it.

This guide is the narrative. My FlipperZero_Stuff repo is the arsenal: firmware
links, Sub-GHz and IR captures, NFC and RFID tools, BadUSB payloads, external
hardware, apps, and a big pile of reference links, all curated in one place. Use
them together.

Everything the Flipper does comes down to which radio or bus is behind the menu.
The hardware, in one table:

  Sub-GHz          a CC1101 radio, roughly 300–928 MHz: read, save and
                   replay 315 / 433 / 868 / 915 MHz remotes, sensors and fobs
  125 kHz RFID     low-frequency prox cards and fobs (EM4100, HID Prox)
  13.56 MHz NFC    high-frequency cards (Mifare Classic / Ultralight,
                   NTAG, and some access credentials)
  infrared         a learning IR transceiver: capture and replay remotes,
                   with a huge community database behind the universal remote
  iButton          1-Wire Dallas keys and many intercom fobs
  GPIO             18 pins: UART, SPI, I2C, and 3.3V, for external boards
  USB / BadUSB     acts as a USB keyboard and types scripted payloads
  Bluetooth LE     remote control, app pairing, and BLE tinkering
  U2F              a real hardware second-factor token, if you want one

There is no WiFi radio inside. WiFi and more Sub-GHz range come from external
boards on the GPIO header, covered in the tour.

The firmware decides what the device can do and how far it will transmit. There
are two worlds, and you can move between them freely.

  Official    Stable, signed, supported by Flipper Devices, and the right
               place to start. Everything works, updates are painless, and
               nothing surprises you.
  Custom      More apps, more community features, quality-of-life extras,
               and the region transmit limits lifted, which hands you the job
               of staying legal. The main three:

    — Momentum is the common recommendation, the continuation of the old
      Xtreme firmware, polished and feature-rich.
    — Unleashed is stable and widely used, the practical daily driver.
    — RogueMaster piles in the most experimental extras, at the cost of
      some rough edges.

Start on official. Switch to a custom build once you actually know why you want
to, and remember that lifting the region lock does not lift the law.

Companion boards run their own firmware: Bruce and EvilCrowRF for the
ESP32 / CC1101 add-ons, flashed separately from the Flipper. All of these,
official and custom and companion, are linked in the repo.

Out of the box, a short setup gets you current and organised.

  1. Update the firmware. Install qFlipper on the desktop, or use the
     mobile app or the web updater, and take the official firmware to the
     latest release. Do this before anything else.
  2. Learn the SD card. Almost everything lives on the microSD: saved
     Sub-GHz captures, IR remotes, NFC and RFID dumps, and BadUSB scripts, each
     in its own top-level folder. Back the card up before you experiment.
  3. Add apps. The built-in App Catalog installs extra apps straight from
     the device. For the firehose, the all-the-plugins community pack drops
     hundreds of apps onto the card at once.
  4. Drive it off-device. qFlipper gives you a screen mirror and a file
     browser; the CLI over USB serial exposes the internals; the mobile apps
     handle updates and quick transfers.

From here the device is yours to explore. The rest of this guide is what each of
those radios is actually for.

Each section of the menu, what it is good for, and where it stops. Assume
throughout that the target is something you own or are authorized to test.

Sub-GHz. The headline feature. Read a remote, save it, replay it: old
fixed-code garage doors, gates, cheap remotes, and 433 MHz sensors all show up
here. The frequency analyzer finds what a remote transmits on. What it will
not do is beat a rolling code: modern cars and garage openers change the code
every press, so a replay is already stale. Transmitting is regulated, and
jamming is illegal everywhere that matters, so this guide does not cover it.

Infrared. A learning IR transceiver with a community remote database behind
it. Point it at a TV, projector, or air conditioner, learn the buttons or pull a
ready-made remote, and replay them. The most harmless fun the device offers, and
genuinely useful when the real remote is lost. My Flipper-IRDB fork and the
guide in the repo cover building a custom remote UI.

RFID (125 kHz) and NFC (13.56 MHz). Read, save, and emulate proximity cards
and fobs. Low-frequency prox (EM4100, HID Prox) is often wide open;
high-frequency Mifare Classic gives up its keys to MFKey32 and nested attacks
when the card is yours. Encrypted credentials like DESFire, and most modern
access control, do not fall over. Clone your own badge to understand the risk,
not someone else's.

iButton. The 1-Wire Dallas keys on some intercoms and access panels. Read
and emulate the ones you hold.

GPIO and external hardware. The 18-pin header is where the Flipper grows.
An ESP32 board adds the WiFi and Bluetooth the Flipper lacks, running
ESP32 Marauder or Bruce for authorized wireless testing. A CC1101 board
extends Sub-GHz range; NRF24 modules, GPS, and the official Video Game Module
all hang off the same pins.

BadUSB. Plugged into a computer, the Flipper pretends to be a keyboard and
types a scripted payload at machine speed, the classic Rubber Ducky trick. It is
powerful and it is the easiest way to get yourself in trouble: run payloads only
on machines you own or have written permission to test. The repo has example
payloads and the layout files, with that caveat attached.

Going deeper. Three of these have a full guide of their own: Sub-GHz,
BadUSB, and Flipper + ESP32 WiFi.

Enough theory. Here is the Flipper's signature trick end to end, on something
you own, in about five minutes. Pick a fixed-code Sub-GHz remote you already
have: a cheap 433 MHz RF outlet remote, a ceiling-fan remote, an old gate or
garage opener from before rolling codes. Do not use a car or a modern garage
opener; those are rolling-code and this will not work on them, which is the
whole lesson at the end.

  1. Open the reader. Sub-GHz → Read. The Flipper listens on the common
     frequencies and shows what it hears.
  2. Press the remote. Hold it a few inches away and press its button. The
     Flipper catches the frequency, the protocol, and the code, and shows them.
  3. Save it with a name you will recognise (“fan-off”). It lands on the SD
     card under the subghz folder.
  4. Put the remote down and open the saved signal → Send. The Flipper
     transmits the code back, and the outlet, fan, or gate does what the remote
     would have done.
  5. Now try a rolling-code remote. Capture it, replay it, and watch nothing
     happen. The code changed the instant you first pressed it, so your
     recording is already worthless.

That contrast is the point. The fixed-code remote had no security at all: the
same code every time, in the clear, replayable by anyone in range with a cheap
tool. The rolling-code one shrugged it off. You just audited both in five
minutes. Infrared and 125 kHz RFID follow the identical read, save, replay
rhythm, and the next section is what to do about the ones that failed.

Here is the part almost no Flipper writeup covers: the device is not the threat,
it is the messenger. Everything it does is a long-known weakness in old,
unsecured technology, wrapped in a nice case. Defending against a Flipper means
fixing the tech it embarrasses, and the fastest way to find that tech is to
audit your own with one.

  — RF remotes and gates. If a fixed-code remote replays, the fix is
    rolling code (KeeLoq and friends), not blaming the tool. Replace
    pre-rolling-code gates and openers; the static code is the hole.
  — RFID and NFC access. If the Flipper clones your badge, your access
    system is a decade behind. 125 kHz prox (EM4100, HID Prox) and Mifare
    Classic are read-and-emulate trivial. Move to encrypted credentials:
    DESFire EV2/EV3, HID SEOS, iCLASS SE.
  — BadUSB and your machines. A keyboard that types by itself only wins
    against an unlocked, trusting computer. Lock the screen when you step away,
    and on managed fleets enforce USB device-control policy so a strange
    keyboard cannot just start typing.
  — Infrared. Mostly a nuisance (turning TVs off). Nothing to defend
    beyond knowing it exists.
  — The common thread is physical access. Every one of these needs the
    device close to yours. Physical security and modern credentials close far
    more doors than trying to ban a tool that is one of hundreds like it.

The healthy way to hold a Flipper is as an audit tool. Clone your own badge,
replay your own remote, run a BadUSB script at your own locked laptop. Whatever
works is your to-do list. Whatever shrugs you off is already doing its job.

The failures you are most likely to hit, and the fix for each.

  — Bad flash or bricked. An update that dies mid-write leaves the Flipper
    stuck. Hold LEFT + BACK to force a reboot; if it will not return, enter
    DFU mode and reinstall firmware from qFlipper. It is very hard to truly
    brick one.
  — SD card not read. Most “app missing” and storage errors are the card.
    Reseat it; if it persists, back it up and reformat to exFAT or FAT32 from
    qFlipper, then restore. Cheap or fake cards are a common culprit.
  — Transmit does nothing. A Sub-GHz or IR send with no effect usually means
    a frequency your firmware region blocks, or a rolling-code target that
    cannot be replayed. Check the region and the target, not the antenna.
  — NFC read fails. Some cards want a slow, steady hold flat against the
    back of the Flipper. Encrypted cards like DESFire will not read fully by
    design; that is not a fault.
  — BadUSB mistypes. Wrong characters mean the wrong keyboard layout. Pick
    the layout that matches the target machine before running the payload.
  — Apps crash on launch. An app built for a different firmware or version
    can crash. Match the app to your firmware and update both.

When something is genuinely stuck, the repo links the official recovery guide
and the community forums, which have seen every failure mode already.

This is the part people skip and regret. The Flipper is a radio and a keyboard,
and the law cares a great deal about how you use both.

  — Owned or authorized only. Read, replay, emulate, and inject against
    your own devices, or ones you have explicit written permission to test.
    Everything else is unauthorized access, and the tool does not change that.
  — Transmitting is regulated. Sub-GHz, IR, and the external radios all
    transmit. Custom firmware unlocks frequencies your region may forbid;
    staying inside your local rules is on you.
  — Jamming is illegal. Deliberately drowning out a signal breaks the law
    in the US (FCC rules) and almost everywhere else. It is not covered here and
    it is not clever.
  — Cards and credentials. Cloning a badge, fob, or card you do not own is
    fraud, even when it is technically easy. Do it to your own to learn where
    the weakness is, then go fix it.

None of this is legal advice; it is the short version of staying out of trouble.
When in doubt, the answer is do you own it, or do you have it in writing.

FlipperZero_Stuff is the companion to this guide: one curated place instead of a
hundred scattered browser tabs. What is in it:

  — Firmware, official and custom (Momentum, Unleashed, RogueMaster), plus
    the companion-board firmware (Bruce, EvilCrowRF).
  — Sub-GHz, IR, files, and dumps: community capture collections, IR remote
    databases, and reference dumps.
  — NFC and RFID tooling: MFKey32, nested attacks, dictionary expansion,
    and fuzzers.
  — BadUSB payloads and keyboard layouts, with the authorized-use caveat, and
    a payload IDE.
  — External hardware plugins: ESP32 Marauder, WiFi and NRF24 tools, GPS, the
    Video Game Module, and more.
  — Apps and tools (all-the-plugins, spectrum analyzers, converters) and a
    deep set of docs, forums, and dev links.

If you only bookmark one thing from this page, bookmark that.

Is the Flipper Zero legal to own and use?
In most places, yes, to own and to use on your own devices. Using it against
systems or property you do not own or lack written permission to test is not,
and transmitting on regulated bands or jamming is illegal. Owning the tool is
not permission to attack something with it. Some regions restrict import or
sale, so check locally.

Official or custom firmware?
Start official: stable, signed, fully supported. Move to custom (Momentum,
Unleashed, RogueMaster) once you know why you want the extra apps and features.
Custom lifts region transmit limits, which makes staying legal your job.
Momentum is the usual pick, the continuation of Xtreme.

Can it clone any card or key?
No. It handles many 125 kHz prox cards and simple 13.56 MHz cards, and recovers
keys on Mifare Classic cards you own with MFKey32. Encrypted credentials like
DESFire, secure access systems, and rolling-code remotes do not trivially clone
or replay. It is a learning tool, not a skeleton key.

Can it replay my car key or garage remote?
Old fixed-code remotes you own, often yes. Rolling-code systems (modern cars,
modern garage openers) change the code every press, so a captured code is
dead on arrival. That is by design.

Does it do WiFi?
Not on its own; there is no WiFi radio inside. An external ESP32 board on the
GPIO header, running ESP32 Marauder or Bruce, adds WiFi and Bluetooth testing,
for networks you are authorized to test. The same header takes CC1101, NRF24,
and GPS add-ons.

How do I protect against a Flipper Zero?
Fix the weak tech it exposes; the device only works on systems that were
already insecure. Replace fixed-code RF remotes and gates with rolling-code
ones, and move access control off 125 kHz prox and Mifare Classic to encrypted
credentials like DESFire or SEOS. Lock your screen and enforce USB
device-control against BadUSB. The common requirement is physical proximity, so
the best test is to audit your own gear with one.