Building a DIY Apple Find My Network Tracker with ESP32 and OpenHaystack

Apple's Find My network is one of the largest crowd-sourced Bluetooth location networks on the planet, and it isn't limited to AirTags. The OpenHaystack project, published by security researchers Fabian Bräunlein and Alexander Heinrich in 2021, reverse-engineered the protocol well enough that any Bluetooth Low Energy radio can act as an "offline finder" accessory. An ESP32 costs a fraction of an AirTag, has no subscription, and can be built directly into a project enclosure instead of being a separate puck you have to tape to something. This guide walks through building your own Find My tracker with an ESP32, understanding how the network actually works, and the legal line you do not want to cross.

How the Find My network actually works

An AirTag does not have GPS and does not talk to the internet directly. Instead, it broadcasts a rotating Bluetooth Low Energy advertisement containing part of a public key. Any nearby iPhone, iPad, or Mac running the Find My app in the background hears that advertisement, grabs its own GPS location, encrypts a location report with the tag's public key, and uploads it anonymously to Apple's servers. Only the owner's device, holding the matching private key, can decrypt those reports. The tag itself never needs network access, a SIM card, or GPS hardware — it just needs to advertise, and the public's phones do the rest.

OpenHaystack re-implements the advertising side of that protocol on cheap microcontrollers and re-implements the decryption side as a small client app, so you can run both halves yourself without Apple hardware doing the broadcasting.

What you need

• An ESP32 dev board (any variant with BLE works; a small ESP32-C3 or ESP32-S3 board is a good fit if you want to hide the tracker inside something)
• Arduino IDE or PlatformIO with ESP32 board support installed
• The OpenHaystack firmware sketch and the OpenHaystack key-generation tooling (the project is open source and widely mirrored; search "OpenHaystack ESP32 firmware" to find the current repository)
• A way to decrypt location reports — the original OpenHaystack app is a macOS app that installs an Apple Mail plugin to pull reports from iCloud; community alternatives exist for decrypting reports from Linux/Windows using the same cryptographic approach, if you don't have access to a Mac
• A small LiPo cell and charge circuit if you want this to be portable rather than mains-powered

Generating your key pair and flashing

1. Run the OpenHaystack key generator to produce an Elliptic Curve (P-224) key pair. This gives you a private key you keep secret and a public key that gets baked into the firmware's advertisement.
2. Paste the generated advertisement key bytes into the firmware sketch where indicated.
3. Flash the sketch to the ESP32 over USB exactly as you would any other Arduino sketch.
4. Verify the board is advertising by scanning for BLE devices near it with a generic BLE scanner app on your phone — you're looking for a manufacturer-specific advertisement with Apple's company ID (0x004C) and the "offline finding" sub-type, not a named device, since the whole point is that it doesn't announce itself.
5. Import the public key into your decryption tool (the OpenHaystack macOS app, or a compatible community script) so it knows which reports belong to this tracker.

Once it's advertising, any iPhone that passes within Bluetooth range (roughly 10–50 meters depending on obstructions) and has Find My running in the background will anonymously relay a location report. In a dense urban area or anywhere with regular foot traffic, you'll usually get your first fix within minutes. In a rural area with little nearby iPhone traffic, it can take hours or longer.

How it compares to commercial trackers

TrackerNetwork usedSubscriptionApprox. costBattery life Apple AirTagFind MyNoneLow~1 year (CR2032) DIY ESP32 + OpenHaystackFind MyNoneLower (bulk ESP32 boards)Hours to days on a small LiPo; much longer with deep sleep tuning TileTile network (smaller than Find My)Optional premium tierLow-Medium~1 year Apple-certified 3rd party (Chipolo ONE Spot, etc.)Find MyNoneMedium~1 year

The ESP32 approach trades battery life for flexibility: an AirTag's dedicated chip sips power for a year on a coin cell, while an always-advertising ESP32 will drain a small LiPo in well under a day unless you add deep sleep cycles between advertisement bursts. For a backpack or toolbox tracker you check on a few times a week, tuning the advertising interval and using ESP32 light/deep sleep between bursts is worth the extra firmware work.

Limitations worth knowing before you build one

• Apple has added anti-stalking detection to iOS that can surface an "Item Detected Near You" or "Unknown Accessory Detected" alert if an unfamiliar Find My accessory travels with an iPhone user for an extended period, separate from its owner. A DIY tracker with no anti-stalking opt-out will trigger the same detection logic as a rogue AirTag, which is by design — see the Flipper Zero guide to detecting rogue Bluetooth trackers on this site for the other side of this story.
• Apple's official decryption app is macOS-only; community reimplementations exist but aren't officially supported and can break if Apple changes server-side behavior.
• Location accuracy depends entirely on how many Find My-enabled devices pass nearby. In a dead zone, your tracker is invisible.
• This is a hobbyist reverse-engineered protocol, not an Apple-sanctioned product. Expect occasional breakage.

Safety and legal considerations

Building a Find My-compatible tracker to locate your own bike, backpack, tool case, or vehicle is a legitimate and fun electronics project. Using one to covertly track a person, their car, or their belongings without their knowledge or consent is a different matter entirely: many jurisdictions have specific anti-stalking and electronic tracking statutes that criminalize exactly this, independent of whether the hardware was store-bought or homemade. The anti-stalking detection Apple built into iOS exists precisely because AirTags were being misused this way. If there's any chance the tracker could end up on a person or their property without their knowledge, don't build it, or at minimum get clear consent first. Treat this project the same way you'd treat any other RF or tracking tool on this site: fine for your own property, not for surveilling other people.

Beyond the legal line, this is a genuinely approachable way to understand how a major crowd-sourced location network operates end to end — key generation, BLE advertising, and asymmetric encryption, all in a weekend project you can build with parts already in most electronics drawers.