Several ESP32 WiFi microcontrollers contain an undocumented feature that lets firmware bypass the fixed WiFi and Bluetooth stack to capture raw IQ baseband samples directly. The discovery, made independently by at least three separate projects between August and September 2026, effectively turns commodity chips costing a few dollars each into software-defined radios covering 2.2–2.7 GHz, with the ESP32-C5 extending to 4.8–6.0 GHz. Sample rates reach up to 80 MS/s with 13–54 MHz of analog bandwidth depending on the specific chip variant. The ESPARGOS team — known for their ESP32 phased-array antenna project — made the discovery while working on direction-of-arrival estimation for WiFi signals. Their existing hardware can now perform phase-coherent IQ capture, meaning ESPARGOS is no longer limited to WiFi and Bluetooth; it can do direction finding on any arbitrary signal in the 2.4 GHz band. The team notes that phase-coherent transmissions would also be possible but they are deliberately not implementing them due to misuse potential. The practical constraint is output bandwidth. For most ESP32 variants, only snapshots of IQ data can be exported to a PC, limiting the device to spectrum analysis rather than continuous demodulation or decoding. The exception is the ESP32-S31, which can stream continuously at up to 16 MS/s over its Gigabit Ethernet interface. A SoapySDR driver for GNU Radio and gqrx is reportedly coming soon. For anyone who wants to try immediately, ESP-WebSDR lets you flash the firmware to most ESP32 dev boards directly from a browser and view a live spectrum and waterfall. Independently, Reddit user /u/h0m3us3r uploaded a project to GitHub on September 26 showing an ESP32-S3 working as an SDR with an FPGA used as a USB3 front end. Unlike ESPARGOS, this approach streams raw IQ data to a PC continuously via the FPGA, making full demodulation and decoding on PC theoretically possible. The current prototype uses the FPGA to clock the ESP32, which results in poor phase noise — but if clocking issues are resolved, an ESP32 plus FPGA could function as a general-purpose SDR comparable to the RTL-SDR, covering 2.2–2.8 GHz with up to 80 MHz of bandwidth. A third project, C5VRX, first uploaded to GitHub on August 13, takes a different approach with similar roots. C5VRX uses an ESP32-C5 as a 5.8 GHz real-time FPV video receiver, sampling FPV signals via an undocumented IQ data stream and demodulating them onboard, outputting analog composite video through a simple resistor DAC. The project is still a work in progress and does not yet work reliably at range. Despite using a somewhat different mechanism, the underlying discovery — that ESP32 chips expose raw IQ data through undocumented paths — is the same. The simultaneous independent discovery matters structurally. When three unrelated teams find the same hidden capability within weeks, it signals that the knowledge is becoming ambient in the RF-hacking community rather than held by a single group. Espressif, the chip manufacturer, has not publicly documented these features, which raises questions about whether the capability was deliberately hidden, simply unfinished, or considered too niche to document. The community is now building the tooling that Espressif did not. What makes this generative rather than merely interesting is the cost asymmetry. An RTL-SDR dongle costs $25–35 and covers a different frequency range. An ESP32 dev board costs $4–10 and is already deployed in millions of IoT devices worldwide. If the SDR capability proves robust, the installed base of potential SDR-capable hardware just expanded by orders of magnitude — not through new manufacturing, but through firmware that unlocks latent silicon.
