← How-Tos
flipper-zero May 7, 2026 ◑ 3 views ◯ 9 min read

Flipper Zero Complete Getting Started Guide: Firmware, Apps, and First Projects

by @jam3yy

What Is the Flipper Zero?

The Flipper Zero is a portable multi-tool for pentesters, hackers, and hardware enthusiasts. It combines a Sub-1GHz transceiver, 125kHz RFID reader/writer, NFC module, infrared transceiver, Bluetooth Low Energy, USB device emulation, GPIO pins, and a BadUSB engine — all in a tamagotchi-style form factor. This guide covers everything from unboxing your first Flipper to running custom firmware and building real-world projects.

Initial Setup and First Boot

  1. Charge the device: Connect via USB-C for at least 30 minutes before first use. The 2000mAh battery provides 7-14 days of typical use.
  2. Power on: Hold the center OK button for 3 seconds. You'll see the dolphin mascot splash screen.
  3. Navigate the UI: Use the directional pad to move between apps. The Back button (left arrow) returns to the previous screen. Long-press Back from the desktop to open the quick settings (backlight, volume, vibration).
  4. Install qFlipper on your computer: Download from flipperzero.one/update. This desktop app is essential for firmware updates, file management, and remote control.
  5. Update firmware immediately: Connect via USB-C, open qFlipper, and click "Install" to get the latest official firmware. Updates often include new apps, bug fixes, and protocol support.
  6. Install the mobile app: The Flipper Mobile App (iOS/Android) enables wireless file transfer, remote control, and app store access over Bluetooth.

Understanding the Hardware

ComponentSpecsUse Cases Sub-1GHz Radio300-348 MHz, 387-464 MHz, 770-928 MHzGarage doors, remote outlets, weather sensors, car remotes RFID 125kHzEM4100, HID Prox, IndalaAccess card cloning, badge testing NFC 13.56MHzISO 14443-A/B, ISO 15693, Mifare Classic/Ultralight/ DESFireTransit cards, hotel keys, NFC tags InfraredTX/RX, 38kHz carrierUniversal TV/projector remote, IR replay attacks Bluetooth LEBLE 5.1App connectivity, BLE spam, beacon emulation USBType-C, USB 2.0 Full SpeedBadUSB attacks, USB serial, storage, charging GPIO18-pin expansion header, 3.3V logicExternal modules, UART, SPI, I2C, debugging Display128x64 monochrome LCDUI, animations (dolphin!), signal visualizations StorageSD card slot (up to 256GB tested)SubGHz captures, BadUSB scripts, databases

Stock Apps Deep Dive

Sub-GHz (Radio Frequency)

The Sub-GHz app lets you receive, save, and replay radio signals in the 300-928 MHz range. Here's how to use it:

  1. Open Sub-GHz → Read to start scanning. The frequency analyzer shows activity across all supported bands.
  2. When you press a remote (garage opener, outlet remote, etc.), the signal appears as a peak. Press OK to capture it.
  3. Save the capture with a descriptive name. You can replay it later by selecting it and pressing the center button.
  4. Frequency hopping: For remotes that change frequency (some car remotes), enable hopping mode to scan across multiple frequencies rapidly.
  5. Raw capture: For protocols Flipper doesn't recognize, use Read Raw to capture the raw signal waveform. This can be replayed verbatim but won't be decoded.

125kHz RFID

Read and emulate 125kHz access cards:

  1. Open NFC → 125kHz RFID → Read to scan a card.
  2. Once read, you can save it, emulate it immediately, or write it to a T5577 rewritable card.
  3. T5577 cards: These blank cards ($0.50-1 each) can be programmed with any 125kHz ID. Essential for legitimate pentesting work.
  4. HID Prox support: Flipper can read and emulate HID Prox cards commonly used in corporate access systems. The emulation sends the card ID continuously when held near a reader.

NFC

NFC capabilities extend beyond simple card reading:

Infrared

Turn your Flipper into a universal remote:

  1. Open Infrared → Universal Remotes → select your device type (TV, AC, projector, etc.).
  2. Point your Flipper at the device and cycle through brands until it responds (power on/off test).
  3. Save the working configuration. The built-in database covers 50,000+ device models.
  4. Learning mode: For devices not in the database, use Learn New Remote to capture signals from your existing remote via the IR receiver on the Flipper's front.
  5. IR blaster projects: Use the IR TX pin on the GPIO header to add a powerful external IR LED for extended range (up to 50m with a good transistor-driven LED).

BadUSB

Emulate a USB keyboard to run Ducky Script payloads:

Custom Firmware: Momentum (formerly Xtreme)

The stock firmware is great, but custom firmware unlocks significantly more capability:

Why Use Custom Firmware?

Installing Momentum Firmware

  1. Download the latest release from the Momentum GitHub repository.
  2. Open qFlipper → Advanced Controls → Install from file.
  3. Select the downloaded .tgz firmware file and flash it.
  4. The Flipper will reboot into the new firmware. Your existing saved files are preserved.
  5. Explore the Momentum Settings app for animation packs, desktop customization, and protocol unlocks.

Note: Custom firmware voids no warranty (Flipper Devices explicitly allows it) but you're responsible for complying with local radio regulations when removing frequency locks.

The App Store and Essential Apps

With Momentum or the official mobile app, install these must-have apps:

AppCategoryWhat It Does WiFi MarauderGPIOControl an ESP32-S2 Marauder board for WiFi attacks, deauth, probe sniffing, and beacon spam ESP32 WiFi ScannerGPIOScan WiFi networks with an ESP32 dev board connected via GPIO Flipper IRDB ManagerInfraredBrowse and download from the massive IR device database without a PC Sub-GHz PlaylistSub-GHzReplay multiple saved signals in sequence for testing multiple doors at once Barcode GeneratorToolsGenerate and display various barcode formats on screen Multi-FuzzerNFC/RFIDFuzz NFC and RFID readers with random or sequential IDs Mouse JigglerUSBPrevent screen lock by simulating tiny mouse movements via USB HC-SR04 DistanceGPIORead ultrasonic distance sensors connected to GPIO Weather StationSub-GHzDecode data from wireless weather sensors NFC RelaysNFCAdvanced NFC card manipulation and relay attacks

GPIO Projects and Hardware Hacking

The 18-pin GPIO header on the top of the Flipper opens up hardware interfacing:

Pinout (key pins)

Project: WiFi Marauder Companion

  1. Get an ESP32-S2 Mini or DevKit ($4-6).
  2. Flash the Marauder firmware via Arduino IDE or esptool.
  3. Connect: Flipper GPIO 13 (TX) → ESP32 RX, GPIO 14 (RX) → ESP32 TX, GND → GND, 3.3V → 3.3V.
  4. Install the WiFi Marauder app on your Flipper.
  5. Open the app and use your Flipper's UI to scan WiFi networks, run deauth attacks, sniff probes, and spam beacons — all controlled from the Flipper screen with the ESP32 doing the radio work.

Project: UART Debugging Console

Connect the Flipper to any device's UART header (routers, IP cameras, IoT devices) to act as a serial terminal:

  1. Connect Flipper GPIO 13 (TX) → target RX, GPIO 14 (RX) → target TX, GND → GND.
  2. Open the GPIO app on the Flipper, enable UART.
  3. Use a UART terminal app from the app store (or the built-in UART bridge over USB).
  4. Baud rate, parity, and stop bits are configurable. Common rates: 9600, 115200.

Practical Use Cases and Projects

1. Universal Home Remote

Consolidate every IR remote in your house onto the Flipper. Program each device (TV, soundbar, AC, LED strips) into a folder in the IR app. Create a "Movie Night" sequence using the Sub-GHz playlist feature to dim lights (smart outlet), turn on TV, and set AC to quiet mode — all from one device.

2. Physical Security Assessment

For authorized security testing: clone access badges, test RFID reader vulnerabilities with the fuzzer, replay Sub-GHz gate/garage remotes to test rolling code implementations, and use BadUSB to test workstation lock screen policies.

3. Car Key Testing

Capture and analyze your own car's key fob signals ( Sub-GHz at 315 or 433 MHz for most vehicles). Test the range of your fob, verify if your car uses rolling code properly, and store a backup unlock signal for emergencies (note: modern cars use rolling code, so replays won't work more than once — this is a good thing!).

4. NFC Automation Tags

Program NTAG215 tags with WiFi credentials (guest network), contact cards, or URLs. Place them around your workshop for visitors. The Flipper can write these tags in seconds and verify the contents.

Legal and Ethical Boundaries

The Flipper Zero is a powerful tool that sits at the intersection of legitimate security research and illegal activity. Follow these rules:

Essential Accessories

AccessoryPricePurpose Silicone case$8-12Drop protection; the Flipper's plastic shell cracks easily ESP32-S2 Mini$4-6WiFi Marauder companion; essential for wireless pentesting T5577 rewritable cards (10-pack)$5-8Clone 125kHz access cards for authorized testing NTAG215 stickers (10-pack)$6-10Programmable NFC tags for automation WiFi Dev Board for Flipper (official)$29Official ESP32-S2 board that mounts on the GPIO header Sub-GHz antenna upgrade$10-15Better range for radio signal capture/replay Prototyping board$5-8Breadboard for GPIO project development USB-C cable (short, 15cm)$3-5Pocket-sized cable for BadUSB and charging

Troubleshooting

ProblemSolution Sub-GHz not receiving signalsCheck antenna connection; verify frequency band is unlocked (custom firmware); ensure you're on the correct frequency for your region NFC read failsMove the card to the back of the Flipper (antenna location); ensure the card type is supported; Mifare Classic may need dictionary attack for encrypted sectors BadUSB not typingUse a data-capable USB-C cable (not charge-only); ensure the target computer recognizes HID devices; check Ducky Script syntax Custom firmware won't installEnter DFU mode: hold BACK + LEFT on boot; reflash via qFlipper; try a different firmware release Bluetooth won't pairEnsure you're using the Flipper Mobile App, not generic Bluetooth pairing; restart both devices SD card not detectedUse FAT32 format; maximum 256GB tested; reseat the card; try a different brand (SanDisk and Samsung work reliably)

Community Resources