Garage doors, car remotes, weather stations, tire-pressure sensors — a whole layer of everyday wireless traffic lives below 1 GHz. WiFi and Bluetooth never touch it.
The first time we pointed a stock Flipper Zero at a garage remote, it picked up the signal immediately. No shield, no extra hardware.
What does Sub-GHz mean on a Flipper Zero?
Sub-GHz just means radio frequencies below 1 GHz — the range most remotes and simple sensors use. A stock Flipper Zero already has a radio built in for it.
No add-on is needed to read, save, and re-send basic signals in that range.
So what’s the built-in radio missing? Two things, and they come up constantly.
What can’t the built-in radio do?
It doesn’t decode LoRa — a different, long-range radio format that needs its own chip.
And it doesn’t touch rolling codes: most modern car remotes and newer garage openers change their code on every press. Replaying yesterday’s signal does nothing. That’s how the official firmware is designed, not something any add-on changes.
Does that make the built-in radio useless for those cases? No. For everything else in its range — fixed-code remotes, sensors, weather stations — it already gets the job done. Source: Flipper Devices, Sub-GHz documentation.
What does our Sub-GHz and LoRa add-on bring?
We built the Flipper Add-On: SubGhz for the two gaps above. It stacks onto a Flipper Zero as a shield.
It adds a second radio tuned to the same bands as the built-in one. It also adds a dedicated long-range chip — that’s what actually brings LoRa (a long-range, low-power wireless format) to a Flipper Zero.
We run the LoRa half through our own LoRa Relay App, right on the Flipper’s official firmware. No custom fork needed.
Do you actually need it? Only if your project touches LoRa, or wants a second dedicated Sub-GHz radio. For everyday remotes and sensors, the stock radio’s already doing the job.
Who is this add-on for?
We see two kinds of people reach for it: security researchers testing Sub-GHz systems like keyless entry, on hardware they’re authorized to assess. The other is IoT or LoRa developers who need to sniff or relay traffic without a full gateway.
It ships as a bare board, nothing else in the box. It needs a Flipper Zero, sold separately, to run.
Authorized use only
Reading, saving, and re-sending Sub-GHz or LoRa signals is for hardware you own, or hardware you’re explicitly authorized to test.
One demonstrated use for this add-on: checking whether your own car’s keyless entry resists a relay attack, with the owner’s permission. What you’re allowed to transmit also changes by country, so check your local radio rules first.
Curious what a WiFi and Bluetooth toolkit looks like next to this one? See what an ESP32 Marauder can do. Meow meow.
