"Your ESP32 is an undocumented SDR — here's what it can and can't do"
Your ESP32 is an undocumented SDR — here's what it can and can't do
Every ESP32 dev board already has a 2.4 GHz radio. This week, two people discovered — independently — that a hidden hardware path on those same chips can tap the raw I/Q stream before it reaches the fixed WiFi modem. In other words: the chip most makers own in bulk is also a receive-only software-defined radio, and nobody at Espressif had documented it. Hackaday covered the find on 3 October, and the write-ups, the firmware and the demo tooling are already public.
Who found it, and how
The discovery came from two directions at once. The team behind the ESPARGOS antenna array published ESP-SDR, raw I/Q capture with Espressif's chips, along with open firmware on GitHub and a browser-based spectrum viewer and flasher you can drive over Web Serial. A few days earlier, Reddit user h0m3us3r posted raw I/Q streaming out of an ESP32-S3 at 80 MSa/s with firmware source — their sustained-rate result needed an FPGA to handle the transfer, which tells you where the chip's own limits sit. Hackaday's angle was the obvious one: the RTL-SDR itself exists because a digiTV chip had an undocumented mode, and history has just repeated.
What it can do
- Receive-only spectrum monitoring on 2.4 GHz (and 5 GHz on the ESP32-C5), streamed to external SDR software.
- Browser-based waterfall and spectrum display with the ESPARGOS flasher and web tool — no driver installs.
- Chip coverage is broad: the original ESP32, S2, S3, C3, C5, C6, C61 and S31 all have the mode, per the ESP-SDR project page. Any board with a WiFi radio works, which includes the ESP32-S3 in our ESP32-S3 DevKitC starter kit (A$45.45) and the ESP32+CC1101 boards in the Marauder devboard.
What it can't do — honest limits
This is not a general-purpose SDR and it won't replace the RTL-SDR for most of what hobbyists do. The mode is receive-only, the sample paths are constrained (hence the FPGA in the fast version), and the frequency reach stops at the chip's own WiFi bands. HF, aircraft band, satellites and the 433 MHz IoT space are all outside it. For those you still want a dedicated dongle: the RTL-SDR V4 kit (A$55) covers 500 kHz to 1.7 GHz, or the bare R820T2 dongle (A$39) if you already own antennas. We put three starter projects for that side of the desk in From ESP32 to SDR: three starter projects with an RTL-SDR v4.
The realistic framing: the ESP32-SDR is a free second receiver for the band your IoT devices, WiFi and Bluetooth gear actually live on — good for spectrum sanity checks, interference hunting on 2.4 GHz, and learning SDR concepts at zero marginal cost. Everything else is still dongle territory.
Parts list if you want to try it
- Any radio-equipped ESP32 board — the ESP32-S3 starter kit is the sensible first pick.
- The ESPARGOS ESP-SDR firmware and their browser flasher — flashing takes minutes.
- Optional: an RTL-SDR V4 kit for everything below 2.4 GHz, and a screen-equipped deck like the StealthDeck Lite if you want a portable display rig.
Skill level
Medium. The flasher and web viewer are genuinely easy, but reading a 2.4 GHz waterfall and knowing what you're looking at is the same learning curve as any SDR. Budget an afternoon.
Lawful use
Receiving your local 2.4/5 GHz spectrum passively is lawful in Australia — the same receive-only territory as our WiFi testing law in Australia explainer. Don't transmit on the ESP32-SDR path, don't attempt to decode or interfere with other people's traffic beyond what the law permits, and keep intercept work inside your own devices and networks. This post is general information, not legal advice.
Affiliate disclosure: products linked above are sold in our own store.
Sources: Hackaday · ESPARGOS ESP-SDR · ESP-SDR firmware repo · h0m3us3r on Reddit. All links verified live 2026-10-05.