What HackerBoxes is — and is not
HackerBoxes is a monthly subscription run since 2015 by a small Chicago team. Each box is themed around one anchor part — an ESP32 development board, an RTL-SDR dongle, a PN532 NFC module — with three to six accessory components chosen to make specific projects possible, and a printed insert whose QR codes point at online lab pages. You can skip a month without cancelling, buy back-issues from the catalogue while stock lasts, and pay roughly $45 per box plus shipping.
Set the expectation properly before spending anything: this is not a pentest kit. It is a maker subscription that frequently drifts into security-adjacent territory — ESP32 wardriving, SDR signal scanning, RFID experimentation, retro-cryptography puzzles. Roughly four or five months in twelve land somewhere useful to a security learner. The rest are a relay board and a sensor pack you could have sourced for $9, and the honest way to read the $45 is as a curation and cadence fee rather than a component cost. If external deadlines are what make you finish projects, that fee buys something real. If they are not, it does not.
Hardware quality & component selection
The anchor part is where the money goes, and it is consistently the real thing. ESP32 boards have been Espressif's own DevKit-C or equivalent S3 N16R8 modules rather than the clone boards that enumerate fine and then fail halfway through a flash. SDR boxes have carried genuine RTL-SDR Blog v3 and v4 dongles, not unbranded imitations with a drifting oscillator. NFC modules have been Adafruit PN532 breakouts. That matters more than it sounds: a beginner debugging a fake dongle concludes they cannot do SDR, not that the hardware is lying to them.
Accessories are looser. SDR antennas are usable but nothing exotic; IoT breakouts are typically Adafruit or SparkFun grade; passives are generic and fine. Some boxes include custom HackerBoxes PCBs — shields and breakouts that exist nowhere else, which is genuinely fun and worth nothing on resale, so do not count them as inventory. The same goes for the drawer at large: components accumulate faster than projects, and the pile is only an asset if you are the sort of person who reaches into it.
A representative sample of the last five boxes
| Box | Theme | Anchor part | Accessories | Pentest value |
|---|---|---|---|---|
| HB0124 | ESP32 BLE Mesh | ESP32-S3 DevKit | BLE beacon shields, OLED, mini battery, sensor breakouts | Solid — BLE recon, advert spoofing, ESPHome flashing labs |
| HB0125 | SDR Starter | RTL-SDR Blog v4 dongle | Antenna kit, SMA pigtails, signal-analysis lab sheet | High — frequency hunting, ADS-B, sub-GHz survey |
| HB0126 | RFID Lab | PN532 NFC module + LF reader | T5577 cards, MIFARE cards, antenna tuner | High — pairs perfectly with a Flipper Zero or Proxmark |
| HB0127 | IoT Sensor Net | ESP32-C3 + LoRa SX1278 module | TTGO LoRa board, environment sensors, breadboard | Medium — useful for LoRaWAN labs, less for offensive work |
| HB0128 | Retro Crypto | STM32 dev board + WS2812 ring | OLED, hand-soldered enclosure, AES tutorial PCB | Low/educational — embedded crypto teaching, not offensive |
The pattern holds across the catalogue: SDR, ESP32 and RFID boxes carry immediate security learning value, while retro-crypto and pure-IoT themes are educational and offensively neutral. Skip the misaligned months and you land near six boxes a year at $270 — comparable to a $300 self-curated parts list, with the planning done for you. That is the whole value proposition, and it collapses the moment you stop opening them, which happens to more subscribers than the marketing suggests.
Build documentation & learning curve
Every box carries a printed insert summarising the theme and listing components, with a QR code to an online lab sheet. Quality varies sharply. The ESP32 and SDR sheets are the good ones — toolchain installation through ESP-IDF, PlatformIO, SDR# or Gqrx, enough theory to know why the steps work, and code on GitHub that builds. The weak ones are thinly rewrapped Hackster tutorials. There is a durability problem underneath all of them: lab sheets live online, toolchains move, and a two-year-old back-issue can send you at a version of ESP-IDF that no longer matches its instructions. Nothing errors — the build just fails somewhere unhelpful.
For a genuine beginner the curve is gentle but real. You will solder, flash microcontroller firmware from a host machine, and read enough of an SDK to modify example code. If that list is daunting, buy one back-issue and find out at $45 rather than at $540 a year. An intermediate maker will learn nothing from the lab sheets and should treat the subscription as a parts-discovery service — which is a fine reason to subscribe, but a different one from the one on the tin.
Community & aftermarket
There is a Discord and a small forum, and the Discord is the one that is alive. Modest volume, replies in hours rather than days, friendly. It will not replace r/AskElectronics or the Adafruit forum for general electronics questions, and it is the only place on earth that can help you with a HackerBoxes-specific PCB, which is exactly the point. The aftermarket is healthy in a way that cuts both ways: boxes appear on eBay six to twelve months later at 50–70% of retail, so an unopened backlog is not a total loss, and the same figure tells you how many subscribers never opened theirs. The catalogue sells back-issues at the original price while inventory holds, which is the cheapest way to test the format.
Legality, ethics & field use
These are commodity electronics: no regulated radios, no reader-writer hardware in customs-flagged categories, no rolling-code defeat tooling. Shipments do not attract the attention a Flipper does. What the components can become is another matter — a CC1101 module and an antenna is a sub-GHz transmitter, and the fact that it arrived as loose parts is not a defence if you transmit on a band you hold no licence for. Treat a box the way you would treat an Arduino starter kit: legal to own, dual-use strictly by intent, and the intent is yours. The SDR boxes deserve one specific caution — receiving is broadly lawful in most jurisdictions, acting on what you decode frequently is not, and that boundary is easier to cross by accident than people expect.
Deployment scenarios
Scenario 1 — Structured learning
Subscribe for a year, skip the weak themes, build the SDR, ESP32 and RFID labs properly. Six months in you have soldered half a dozen boards, flashed three microcontrollers, captured a 433 MHz remote and read a MIFARE card. The right answer for "I want to learn hardware and have no idea where to start" — provided you actually open the boxes the week they arrive.
Scenario 2 — Gift / curriculum
A three-month gift subscription for a curious teenager or a colleague moving into hardware. The cadence keeps momentum and the printed insert means you are not writing a curriculum yourself. Send a soldering iron with it — the boxes assume one and a beginner without decent tools gives up on the joints, not the concepts.
Scenario 3 — Component stockpile
If you prototype IoT regularly, the boxes keep a drawer of ESP32 boards, sensors and breakouts stocked with no ordering effort. Cost per component is competitive with retail and the quality floor is well above the cheapest marketplaces. You do not get to choose what arrives, so this works as a supplement to deliberate purchasing and never as a replacement for it.
Scenario 4 — Awareness training
For internal security enablement, queue the SDR and RFID boxes and run a two-hour workshop where engineers clone a card or capture a 433 MHz fob themselves. Doing it once outlasts two days of slides. Use your own building's badges with written permission from whoever owns physical security, and agree beforehand what happens to the cloned cards afterwards.
How HackerBoxes compares with the alternatives
| Aspect | HackerBoxes | Adafruit AdaBox | Crowd Supply | DIY (parts list) |
|---|---|---|---|---|
| Cost | $45/month (+ shipping) | $60/quarter | Variable per project — $25–$2,000 | $15–60 per kit (parts only) |
| Curation | Themed, pentest-leaning ~40% of months | Maker / creative, no pentest focus | Whatever you fund | You curate |
| Build sheets | PDF + online instructions | Polished Learn Adafruit pages | Project-specific docs | GitHub READMEs + YouTube |
| Anchor part value | Usually $25–40 (legitimate single-purchase cost) | Adafruit retail value | Manufacturer pricing | Cost-only |
| Community | Forum + Discord — modest | Adafruit forum — large | Per project | StackExchange, r/AskElectronics |
| Pentest relevance | Theme-dependent — best months are gold | Very low | Project-dependent (Proxmark, USB Armory) | Whatever you target |
| Lock-in | Subscription (skip-month available) | Quarterly subscription | One-time crowdfund | None |
Pure DIY is cheapest and teaches most, because choosing the parts is itself the lesson. It also produces more abandoned half-projects than any other route on this table. A curated subscription is a way of paying someone to make the decisions you keep postponing. AdaBox is more polished and almost entirely maker-focused. Crowd Supply ships far deeper individual projects with no cadence at all. HackerBoxes occupies the gap: themed cadence, security-adjacent topics, and a price low enough to commit to without resenting the misses. Whether that gap is worth $540 a year depends on one question nobody else can answer for you — do externally imposed deadlines make you finish things?
Pros & cons
Subscribe if…
- You are a beginner and an external deadline is what makes you finish things.
- You enjoy the surprise and can treat a dud month as part of the price.
- You want ESP32, SDR and RFID modules accumulating without maintaining a parts list.
- You run an internal team curriculum and need a recurring reason to gather.
- You will skip deliberately and plan around six useful boxes in twelve.
Skip if…
- You want depth in one specific topic — buying the parts yourself is cheaper and faster.
- You are an experienced engineer with a drawer already full of exactly these modules.
- Your budget is pentest-only and every dollar needs to land on a Proxmark, HackRF or Flipper.
- You dislike subscription billing — skipping a month works, but you have to remember to do it.
- You are outside North America, where shipping and duty erode the value fast.
Verdict
HackerBoxes is a good subscription rather than a great one, and framing it that way is the review. It works for the audience it was built for — curious beginners, people buying a technical gift, trainers who need a reason to gather the team around a bench — and it sits usefully alongside the deeper hardware reviewed elsewhere here. Skip deliberately, plan for six useful boxes out of twelve, pair the SDR, RFID and ESP32 months with a Flipper or a Proxmark, and $270 a year buys real hands-on skill. The failure mode is not bad boxes; it is unopened ones. If three arrive unopened, cancel — the subscription has stopped being a curriculum and become a direct debit.
