Flipper Zero

What the Flipper actually is

The quickest way to spot someone who has read about the Flipper rather than used one: they call it a WiFi hacking device. It has no WiFi radio at all. Stripped of the marketing and the TikTok footage, the Flipper Zero is a battery-powered STM32WB55-based embedded computer with four discrete radio peripherals soldered to a single PCB and a 1.4" monochrome display attached. Not an SDR. Not a Proxmark. Not a Rubber Ducky. It is a deliberately curated set of commodity radio front-ends, packaged so that one device can read, replay, emulate or fuzz the four physical-layer ecosystems a junior red-teamer actually runs into: sub-GHz remote controls, 125 kHz LF RFID, 13.56 MHz NFC and consumer infrared. On top of that sits a USB-C interface exposing BadUSB / HID injection, and an 18-pin GPIO header that turns the thing into a generic UART/SPI/I²C analyser at 3.3 V.

The device is opinionated, and the opinion costs you something. Where the Proxmark3 RDV4 demands a tethered laptop, a command line and some grasp of demodulation, the Flipper hides all of it behind a five-way stick and an SD-card library of saved keys, sub-GHz captures, IR remotes and BadUSB payloads. You trade depth for accessibility. That trade is why the Flipper owns pentest-hardware mindshare, and it is also why the first time a card refuses to clone you get a terse error rather than the raw trace that would tell you why. Purists still reach for the Proxmark on serious RFID work for exactly that reason.

Hardware architecture, board level

At the centre sits an STMicroelectronics STM32WB55RG, a dual-core SoC pairing a 64 MHz Cortex-M4 application core with a Cortex-M0+ that runs the BLE 5.0 / 802.15.4 (Zigbee, Thread, OpenThread) radio stack in isolation. That split is more than a spec line. The user-facing firmware and the vendor BLE stack execute on physically separate processors with a defined mailbox between them, which is the structural reason a bad BLE experiment in a community fork has not turned into code execution on the application core. It is a boundary worth respecting when you write your own radio code: bugs on the M0+ side are far harder to debug precisely because you cannot see across it. RAM is 256 KB SRAM, flash 1 MB internal, plus a hot-swappable microSD card for libraries and payloads.

The sub-GHz radio is a TI CC1101, a workhorse single-chip OOK/FSK/GFSK/MSK transceiver covering 300–348, 387–464 and 779–928 MHz. Firmware-tuned, 64-byte FIFO, topping out near 600 kbps. Note the gaps in that coverage: anything between roughly 464 and 779 MHz is simply not there, so a device on an unusual band reads as silence rather than as an error, and beginners routinely conclude the remote is "encrypted" when the radio was never listening. The NFC front-end is the ST25R3916, a multi-mode reader handling ISO 14443A/B, ISO 15693 and FeliCa; it is the part doing the actual work in MIFARE Classic key recovery and DESFire enumeration. The 125 kHz LF stage drives an analogue front-end and a T5577 for emulation, so the Flipper both reads EM4100 / HID Prox cards and writes them back onto a reusable card in its own slot.

Build quality is more serious than the toy-like styling suggests. The injection-moulded ABS shell takes daily pocket carry without case fatigue, and the screen sits recessed far enough that keys do not scratch it. The microSD slot lives inside the battery compartment — irritating when you want to swap a card, and the reason nobody has ever ejected one mid-capture. Charging is USB-C at 1 A, and the 2000 mAh cell gives roughly 30 hours of mixed use or weeks of standby. The practical caveat is sub-GHz transmit: sustained TX drains the cell far faster than the datasheet figure implies, so budget a battery bank for any long field session.

Firmware ecosystem — pick your pain

The defining property of the Flipper is not the hardware. Every individual radio in it has a better dedicated competitor. What has no competitor is the firmware scene: Flipper Devices publishes the stock firmware as open source, and the result is one of the healthiest fork ecosystems in modern embedded kit. The five builds below account for nearly everything you will meet in the wild. Pick one and stay on it — flashing between forks rewrites the internal storage layout, and moving from RogueMaster back to stock is the usual way people discover their saved sub-GHz captures and NFC keys are gone.

The split between forks comes down to two things: regional transmit limits and feature creep. Stock firmware refuses to transmit on bands that are not licensed in your region unless you flash a region file, and Unleashed removes that geofence and little else. Be clear about what that means — the geofence is the only thing standing between you and an offence in most jurisdictions, and removing it does not make the transmission legal, it just stops the device arguing. Xtreme and Momentum add real engineering value: NFC Magic Gen1/Gen2 helpers, ESP32 Devboard integration, BLE advertisement spam (which recent iOS releases now rate-limit, so demos that landed in 2024 fall flat today), DuckyScript v3 BadUSB and a working plugin manager. RogueMaster is the kitchen-sink build — every feature, every animation, and crashes often enough that you would not want it on the device you carry to a client site.

Supported attack vectors

The spread of physical-layer attack surfaces is the whole pitch. None of it is novel and every item below has a better dedicated tool, but no dedicated tool covers all of them, and none of them fit in a pocket at $169 with a battery attached.

• Sub-GHz remote replay: capture and replay fixed-code remotes — garage doors, estate gates, cheap aftermarket car fobs. Rolling-code systems (KeeLoq and successors) do not fall to naive replay; the Flipper will happily record one and the replay will simply do nothing, which is not an error message and is where most "it's broken" reports come from.
• 125 kHz LF RFID cloning: HID Prox, EM4100, AWID and relatives, cloned onto a T5577 card or held in the on-board emulator. Still the highest-yield access-control attack going, because the 2005-era badge estate in most buildings was never replaced.
• 13.56 MHz NFC research: MIFARE Classic 1K/4K nested attack with a dictionary, MIFARE Ultralight reads, NTAG2xx URL injection, Amiibo cloning. DESFire EV1/EV2/EV3 gives you a UID and nothing else — no key recovery, and a UID-only "clone" fails against any reader configured properly.
• Infrared cloning & fuzzing: capture commercial remotes, run universal brute-force payloads. Genuinely useful in AV and meeting-room audits, entertaining everywhere else, and almost never the finding that carries a report.
• iButton: DS1990A read and emulate. A dead category in most of the world and very much alive in residential lift and storeroom systems across parts of Europe and the former CIS.
• BadUSB / HID injection: DuckyScript v3 over USB-C with Mac, Windows and Linux keymaps. Slower than a Rubber Ducky Mk2, and the payload is timing-fragile — a host that is slow to enumerate swallows the first few keystrokes, so any payload worth trusting starts with a deliberate delay.
• GPIO / hardware bus analysis: UART console hunting at 3.3 V on routers and IoT gear, SPI flash dumping if you are patient, I²C sensor probing. It is 3.3 V only — put it on a 5 V bus and you damage the Flipper, not the target.
• BLE / 802.15.4: thin. Advertisement spam, Zigbee sniffing through custom firmware, no real BLE attack suite. Buy an nRF52840 dongle if BLE is the actual job.

Honest framing: the Flipper is capable across all of these and great at none. On a real engagement you carry the Flipper, a Proxmark, a HackRF and a laptop. The Flipper is what stays in your pocket between testing windows, and the one you can pull out in a corridor without looking like you are setting up.

Community, modules & third-party add-ons

The 18-pin GPIO header is the reason a Flipper is still interesting in month seven rather than sitting in a drawer. The official WiFi Devboard puts an ESP32-S2 on the header and brings wardriving, Marauder-style deauthentication labs and ESPHome flashing — note that this is a bolted-on second radio with its own firmware, not a Flipper capability, and it updates on its own schedule. The NRF24 Dev Board turns the device into a 2.4 GHz wireless-keyboard sniffer of the Mousejack lineage. Third-party modules cover LoRa, SDR slices, sub-GHz amplifiers and external NFC antennas for longer-range MIFARE work; the amplifiers in particular are where an educational device quietly becomes a regulated transmitter, so know your local rules before soldering one on. Momentum and Xtreme both ship plugin managers that compile, sideload and update community plugins from the device UI — convenient, and a supply chain of unsigned code running on hardware you carry into client buildings.

Legality, ethics & the confiscation reality

Owning and operating a Flipper is legal in almost every jurisdiction. What is regulated is the activity. In the US, transmitting on sub-GHz bands you hold no licence for is an FCC violation whatever radio you used to do it, and the device's provenance is irrelevant to that. Canada moved to block imports in 2024 on the claim that the device featured in car-theft toolchains — a claim the rolling-code reality does not really support, but the import position is the import position. Brazil's Anatel has seized shipments at customs. Several US state bills have proposed treating the device as burglary tooling in itself; none had passed as of 2026, and that is worth re-checking before you travel rather than trusting this page.

On an engagement, treat the Flipper the way you treat lockpicks. Carry a signed scope letter naming testing windows and target addresses, carry an itemised hardware inventory, and never let the device out of your sight in a client space — an unattended Flipper on a client desk is an incident someone else gets to write up. The orange-and-white shell is recognisable to any guard who has spent time online in the last three years. That recognisability is an asset when you are teaching and a straightforward liability when you are trying to be unremarkable in a lobby.

Deployment scenarios

How the Flipper compares

The Proxmark wins on RFID depth — DESFire EV3, iClass SE, MIFARE DUOX, the awkward LF cloning jobs — because a reconfigurable FPGA front-end can do things fixed silicon cannot, and it will still be able to do them for card formats that do not exist yet. The HackRF wins on generality: any waveform, 1 MHz to 6 GHz. The Flipper wins the one contest that decides what actually gets used in a corridor — it is in your pocket and it is already on. Which of those matters depends entirely on whether your bottleneck is capability or opportunity.

Pros & cons

Verdict