What is the difference between fixed and rolling code?

A fixed-code remote sends the same value every time, so a recorded transmission can be replayed indefinitely. A rolling-code remote advances a synchronised counter with each press, so a captured code is already stale when replayed.

Why is 433 MHz so common?

It is an unlicensed ISM band in most of the world, with good range at low power and cheap, mature transmitter chips. 315 MHz fills the same role in North America and 868 MHz in Europe.

Is analysing these signals legal?

Receiving on ISM bands is generally permitted, and analysing devices you own is normal security research. Transmitting to operate equipment you do not own is not — treat replay attacks as strictly an authorised-testing activity.

Sub-GHz / 433MHz Decoder

Decode 433 MHz and other sub-GHz remote-control signal captures.

on the roadmapHardware, Radio & Telecomfree · no sign-up

This bench is being wired up

The subghz-decoder decoder is on the roadmap. The heavier binary and cryptographic parsers ship after the core text and token decoders — all of which are already live and working.

Browse the live decoders

Input is processed on your device. Nothing you paste is sent anywhere.

What is the Sub-GHz / 433MHz Decoder?

A sub-GHz decoder converts a captured pulse-timing sequence from a 433 MHz (or 315/868 MHz) remote control into the protocol and code it transmits, identifying whether it uses a fixed or rolling code.

Cheap remotes — garage doors, gate openers, weather stations, wireless doorbells, plug sockets — transmit on unlicensed sub-GHz bands using simple on-off keying. The data is in the timing: a short pulse followed by a long gap is one symbol, the reverse is the other, and a long silence marks the frame boundary. A capture is therefore a list of microsecond durations.

Protocols like PT2262, EV1527 and Princeton send a fixed code every time, which means anyone who records one transmission can replay it forever. That is the entire weakness behind older garage-door and gate remotes, and why security-conscious devices moved to rolling codes such as KeeLoq, where a counter advances with every press and a replayed capture is rejected.

Decoding a capture tells you which camp a device is in — the single most useful thing to know when assessing a wireless installation you own.

Sub-GHz / 433MHz Decoder at a glance

Bands: 315 MHz (NA) · 433.92 MHz · 868 MHz (EU)
Modulation: On-off keying / ASK, sometimes FSK
Fixed-code chips: PT2262, EV1527, Princeton — replayable
Rolling code: KeeLoq and similar — counter-based, replay-resistant

How to use the Sub-GHz / 433MHz Decoder

1Paste the captured pulse timings in microseconds, or the raw bit sequence.
2Read the identified protocol, bit length and decoded code value.
3Check whether the protocol is fixed-code — a repeated identical capture confirms it.

When you would reach for it

Assessing whether your own gate or garage remote uses a replayable fixed code.
Building a home-automation bridge for a legacy 433 MHz sensor.
Learning how on-off keyed RF protocols encode bits in pulse timings.

Sub-GHz / 433MHz Decoder — frequently asked questions

Last reviewed 25 July 2026 · questions or corrections: contact@decoder.tools