Flipper Zero – the Swiss Army knife for pentesters 

Flipper Zero is a multifunctional portable cybersecurity tool for pentesters, ethical hackers, and hardware enthusiasts. It is designed to interact with various access control systems, radio protocols, RFID, near-field communication (NFC), and infrared signals – all enclosed in a case reminiscent of a Tamagotchi. The association with that electronic toy is no coincidence, since, like those digital pets, this device has a cute creature at its heart. Here, it’s a cybernetic dolphin reminiscent of Jones from Johnny Mnemonic, with whom users interact through a graphical interface, “raising” it by cracking all sorts of hardware. That’s where the similarities end, though, because behind the playful design hides a true Swiss Army knife of pentesting tools, including RFID, RF, infrared, HID emulation, GPIO, hardware debugging, 1-Wire, Bluetooth, Wi-Fi, and more.

Necessity Is the Mother of Invention 

The idea behind the Flipper Zero was to combine all the necessary hardware tools for interacting with access control systems and operating in the field. The project was inspired by excellent open-source initiatives such as Proxmark, HydraNFC, Rubber Ducky, and Pwnagotchi. True to its open-source roots, Flipper Zero differs from typical DIY boards – it was designed with everyday usability in mind. It comes with a sturdy case, convenient buttons, and an ergonomic shape, so users don’t have to wrestle with dirty PCBs or scratched pins.

The concept for the product was born from the need for a durable penetration-testing tool during work on 4G networks in remote locations. The project was first announced in August 2020, and to fund it, co-creator Alexander Kulagin launched a crowdfunding campaign. The original Kickstarter goal was set at $60,000, but within a short time, the project raised an impressive $4.8 million from 40,000 backers.

In a Nutshell 

Flipper Zero is a fully autonomous device with built-in 5V and 3.3V power pins. Instead of a TFT/IPS/OLED screen, the creators opted for an old-school, orange-backlit monochrome LCD with a resolution of 128×64 px. It is perfectly visible in sunlight and, when the backlight is off, consumes an ultra-low current of just 400 nA. No computer or smartphone is required to operate it – the device can be controlled via a 5-way D-pad and a separate back button. Shared scripts and functions are available from the menu.

For greater control, Flipper can be connected via USB, allowing it to emulate human input devices (HID), such as keyboards or Ethernet adapters, and enabling BadUSB or Rubber Ducky–style attacks. Users can easily upload and deploy scripts directly from the device to automate tasks, penetration tests, and more. Some operations, such as firmware or user data updates, require a computer or smartphone with developer software.

At the top of the device are GPIO pinouts and breakouts for connecting external modules and controlling attached hardware directly via Flipper. It can also be used as a USB bridge to UART/SPI/I2C/etc for debugging, flashing, and fuzzing.

Fig. Wi-Fi support is available via a Wi-Fi Development module.

Inside the Dolphin 

A dual-core STM32WB55 ARM microcontroller powers our virtual dolphin with 256 KB of RAM and 1 MB of flash memory. The first core – a 64 MHz Cortex-M4 – runs the main firmware. The second – a 32 MHz Cortex-M0 – runs STMicroelectronics’ Bluetooth Low Energy (BLE) firmware.

For Sub-GHz radio (roughly 300–928 MHz, region dependent), Flipper uses a Texas Instruments CC1101 transceiver. It supports ASK, OOK, FSK, GFSK, and variants of modulation. You can capture, analyze, store, and replay signals from a wide array of remote-control systems (garage doors, barrier gates, IoT sensors), provided the protocol is non-encrypted or uses fixed codes.

Flipper can also read and emulate various RFID cards, record and transmit infrared signals, emulate USB HID devices, execute programmable payloads, and serve as a USB-to-UART/SPI/I2C adapter. Unlike software-defined radios, the CC1101 cannot capture raw radio signals – users must preconfigure modulation parameters before receiving RF, otherwise the signal will not be decoded correctly.

Fig.  Flipper Zero can be connected to any piece of hardware using GPIO. 

Key features & components 

What can the device actually do? Quite a lot. Flipper Zero enables capture, analysis, and transmission of RF signals. It operates in the sub-1 GHz band, the frequency range used by a broad class of wireless devices and access control systems such as garage door remotes, barrier gates, IoT sensors, and passive keyless entry systems. Flipper has an integrated 433 MHz antenna (used, among other things, for communication with other Flippers) and features a fully controllable RF platform based on the TI CC1101 chip described earlier.

This chip is a general-purpose transmitter with a practical range up to tens of meters (subject to environment and legal TX power limits), designed for ultra-low-power wireless applications. Flipper Zero ships with a library of common remote control algorithms for capturing, decoding, analyzing, and replaying signals. It supports a variety of digital modulations such as 2-FSK, 4-FSK, GFSK, and MSK, as well as OOK and flexible ASK shaping.

RFID

Flipper Zero can read, write, and emulate RFID tags at both high frequency (13.56 MHz) and low frequency (125 kHz). Low-frequency proximity cards are widely used in legacy access control systems around the globe. These card types often store only an N-byte identifier and lack any authentication mechanism, which makes them easy to read and clone to a new card or export for analysis. On the underside of the Flipper, there is a 125 kHz antenna enabling reading of tags such as EM-4100 and HID Prox; IDs can be stored in memory for later emulation. Cards can also be emulated by manually entering identifiers. Flipper owners can exchange card identifiers remotely.

NFC

The device also includes an NFC module (13.56 MHz), enabling interaction with NFC-capable devices — reading, writing, and emulating HF tags. Combined with the 125 kHz module, Flipper becomes a versatile RFID tool supporting both LF and HF ranges. The NFC module supports major standards and can be connected to a computer as a fully LibNFC-compatible device.

Wi-Fi and Bluetooth

Flipper Zero includes Bluetooth Low Energy (BLE) for direct interaction with mobile applications, and Wi-Fi support is available via a Wi-Fi Development module. Full BLE support allows Flipper to act both as a host and as a peripheral, enabling simultaneous connections to third-party devices and a smartphone. As with other wireless features, the community provides open-source libraries to add Flipper support to user applications.

Infrared Transmitter 

Flipper Zero offers a powerful, fully programmable infrared (IR) transmitter/receiver for capturing and replaying IR signals to control consumer electronics like TVs, air conditioners, stereos, and more. The device ships with a library of common command sequences for many devices; captured signals can be saved and added to the database. This IR database is continuously expanded by the community, who contribute new remote codes.

microSD 

Regarding storage, Flipper does not include large onboard file storage but provides a push-push microSD slot that keeps the card fully seated and protected. Captured assets such as remote codes, signal databases, dictionaries, images, logs, and user plugins can be stored on the SD card. The device supports any microSD card formatted as FAT32.

iButton / 1-Wire

On the corner of the device, there are contact pads that act both as a reader and a probe for connecting to iButton sockets (supporting Dallas DS1990A and CYFRAL protocols) and for reading contact keys. This older technology is still widely used globally. It employs the 1-Wire protocol, which lacks authentication. Flipper can read these keys, store IDs, write them to blank keys, and emulate the key itself.

Firmware 

Flipper Zero’s firmware is built on the FreeRTOS operating system, with a custom software abstraction layer over the hardware. It is written mostly in the C programming language, with occasional use of C++ in third-party modules. The system leverages multitasking combined with an event-driven architecture to organize interactions between applications and services running in a single address space and communicating via queues and events. The firmware can run from both volatile RAM and read-only memory (ROM). Running from RAM is used to deliver over-the-air (OTA) firmware updates. User data and firmware updates are stored on the microSD card.

Architecturally, the firmware is organised into a small set of well-defined layers and modules:

• FuriCore – provides an API for interaction with the scheduler and multitasking. FuriCore abstracts and extends FreeRTOS scheduling capabilities and adds additional system facilities.
• FuriHal – supplies an API to interact with the hardware.
• services and applications – the main device functionality. Sub-GHz, Infrared, RFID, NFC, etc., are applications that interact with the user. GUI (graphical user interface), CLI (command-line interface), Notification, Storage, etc., are additional APIs for building apps.
• a set of libraries and drivers – covering communication protocols, device drivers, filesystem drivers, and developer tools.
• user and system data – stored in onboard flash using the LittleFS library. Interaction with the SD card filesystem is implemented using the FatFs library.

The build system is based on SCons with additional Python tooling. The project uses a custom open toolchain based on the GNU Compiler Collection for compilation.

Since late 2024, the official firmware emphasises modularity and dynamic extensibility: application code can be loaded and unloaded dynamically, drivers and parsers are split into smaller, composable modules, and event-driven subsystems replace previous polling-centric implementations where appropriate — all changes that reduce latency, lower memory pressure, and simplify community contributions.

Grinding a Dolphin

You can expand your digital dolphin not only by feeding it hacked hardware but also by using third-party firmware via the project’s update tools — a capability the Flipper creators openly encourage.

There are several alternate firmware options, but two are particularly notable — DarkFlipper/Unleashed and RogueMaster. These projects are free, remove regional restrictions on sub-GHz transmitter/receiver frequencies, add new IR remotes, and introduce many additional tools and features that become useful in practice. Both communities are very active and frequently release updates. DarkFlipper publishes all updates directly to its GitHub repository, while RogueMaster now uses a Patreon model whereby subscribers get earlier updates and the public channel receives them later. Switching between firmware versions is straightforward, so users often alternate between them.

Firmware 1.0 

In September 2024, Flipper Zero received a major official release, Firmware 1.0, which introduced several user-facing and architectural improvements. The most important items are:

• Dynamic third-party apps: a mechanism for dynamic app loading was added so users can install hundreds of community apps from an Apps Catalog without embedding everything into a single monolithic binary.
• New NFC subsystem: the NFC stack was rewritten from scratch to an event-driven design that is FreeRTOS-friendly, significantly improving card read speed, introducing a plugin system for user-supplied parsers (Flipper App Libraries), and supporting new card types such as ICODE SLIX and FeliCa Lite-S. Parsers are now dynamically loadable to avoid RAM pressure.
• JavaScript runtime: support for developing Flipper apps in JavaScript was introduced, lowering the barrier for community developers to write and share apps.
• Sub-GHz improvements: the Sub-GHz app expanded protocol support (dozens of protocols supported), added support for external CC1101 modules to use higher-sensitivity antennas, introduced the compact BinRAW recording format (more efficient for repetitive signals), and added the capability to listen to analog walkie-talkie audio via the piezo speaker.
• General system improvements: battery standby life was optimised (reported standby durations increased substantially), Bluetooth transfer speeds — especially to Android devices — were improved (up to ~2× in practical scenarios), and firmware update throughput via Bluetooth was accelerated (~40% faster uploads).
• Tooling and UX: firmware and ecosystem tooling (mobile qFlipper / desktop qFlipper workflows) were smoothed to make OTA and USB updates easier for end users.

To get all the new features, update the device using the Flipper Mobile App over Bluetooth or qFlipper on PC (official downloads and instructions are available from the Flipper project’s downloads page).

Partially Open Source 

The Flipper Zero electronic schematic and firmware are published under open-source terms using the GNU General Public License. At the same time, the device does not qualify as open-source hardware because the printed circuit board (PCB) designs are not open. This limitation prevents enthusiasts from freely producing their own hardware copies without foundational electronics know-how.

Time for an Update

In the pentester community, advanced spying and device-hacking tools are not typically known for being user-friendly or visually appealing. Flipper Zero, which takes the form of a cute virtual pet, changes that. At the manufacturer’s official store, the device retails for about € 229 (it started from $ 169 USD). Naturally, concerns arise that someone could use the device to break into an office or home. If your security can be bypassed with a tool that costs a little over two hundred dollars, perhaps it is time to modernize those protections.

Technical Specification 

• Display: 128×64 1.4″ monochrome LCD (backlit)
• Controls: 5-way directional pad + back button
• Battery: LiPo 2000 mAh (up to ~7 days standby depending on usage)

CPU:

• STM32WB55RG
• ARM Cortex-M4 32-bit 64 MHz (Application Processor)
• ARM Cortex-M0+ 32 MHz (Network Processor)

Haptics & Audio:

• Buzzer: 100–2500 Hz
• Vibration: motor speed 13,500 rpm, force ~30 N (specs as provided by vendor)

Memory & Storage:

• RAM / Flash: ~256 KB RAM, 1 MB flash (device variants and exact numbers may differ)
• Storage: microSD (up to 64 GB supported)

Connectivity & Ports:

• USB 2.0 Type-C

Dimensions & Weight:

• Dimensions: ~100 × 40 × 25 mm
• Weight: ~102 g

Module Specifications (summary):

iButton (1-Wire): Dallas DS1990A, CYFRAL.

RF: TI CC1101 chipset; Frequencies: 315 MHz, 433 MHz, 868 MHz, 915 MHz; TX Power: ~0 dBm (regulatory limits apply); range dependent on environment.

RFID: HF (13.56 MHz) — ISO-14443A/B, NXP MIFARE Classic/Ultralight/DESFire, FeliCa, NFC Forum protocols; LF (125 kHz) — EM400x, EM410x, EM420x, HID Prox, Indala, T5577.

GPIO: 3.3 V CMOS level, 5 V tolerant, up to ~20 mA per digital pin.

Infrared: RX/TX wavelength ~800–950 nm; TX power variable by module.

Bluetooth: BLE 5.0; TX power ~0 dBm max; RX sensitivity ~-96 dBm; data rate up to 2 Mbps.

Learn more

To learn about other pentesting tools, visit our physical pentesting blog post.