decoder.tools

Sub-GHz / 433MHz Decoder

Decode 433 MHz and other sub-GHz remote-control signal captures.

Hardware, Radio & TelecomFree
INPUT

Or drop a file here: Flipper Zero .sub file

OUTPUT

The result appears here as you type.

Decoding runs in your browser. What you paste is not sent to a server.

A sub-GHz decoder converts a captured pulse-timing sequence from a 433 MHz (or 315/868 MHz) remote control into the protocol and code it transmits, identifying whether it uses a fixed or rolling code.

Example

Input
Filetype: Flipper SubGhz Key File
Version: 1
Frequency: 433920000
Preset: FuriHalSubGhzPresetOok650Async
Protocol: Princeton
Bit: 24
Key: 00 00 00 00 00 95 D5 D4
TE: 400
Output
Key: 95D5D4 (24 bits)
Bits: 100101011101010111010100
Base pulse (TE): 400 µs
Encoder ID / address: 10010101110101011101 (0x95d5d)
Button bits: 0100
Frequency: 433.920 MHz
Modulation: OOK / ASK, 650 kHz bandwidth
Protocol: Princeton

What is the Sub-GHz / 433MHz Decoder?

Cheap remotes — garage doors, gate openers, weather stations, wireless doorbells, plug sockets — transmit on unlicensed sub-GHz bands using simple on-off keying. The data is in the timing: a short pulse followed by a long gap is one symbol, the reverse is the other, and a long silence marks the frame boundary. A capture is therefore a list of microsecond durations.

Protocols like PT2262, EV1527 and Princeton send a fixed code every time, which means anyone who records one transmission can replay it forever. That is the entire weakness behind older garage-door and gate remotes, and why security-conscious devices moved to rolling codes such as KeeLoq, where a counter advances with every press and a replayed capture is rejected.

Decoding a capture tells you which camp a device is in — the single most useful thing to know when assessing a wireless installation you own.

How to use the Sub-GHz / 433MHz Decoder

  1. Paste the captured pulse timings in microseconds, or the raw bit sequence.
  2. Read the identified protocol, bit length and decoded code value.
  3. Check whether the protocol is fixed-code — a repeated identical capture confirms it.

When to use it

  • Assessing whether your own gate or garage remote uses a replayable fixed code.
  • Building a home-automation bridge for a legacy 433 MHz sensor.
  • Learning how on-off keyed RF protocols encode bits in pulse timings.

Sub-GHz / 433MHz Decoder at a glance

Bands315 MHz (NA) · 433.92 MHz · 868 MHz (EU)
ModulationOn-off keying / ASK, sometimes FSK
Fixed-code chipsPT2262, EV1527, Princeton — replayable
Rolling codeKeeLoq and similar — counter-based, replay-resistant

Frequently asked questions

What is the difference between fixed and rolling code?

A fixed-code remote sends the same value every time, so a recorded transmission can be replayed indefinitely. A rolling-code remote advances a synchronised counter with each press, so a captured code is already stale when replayed.

Why is 433 MHz so common?

It is an unlicensed ISM band in most of the world, with good range at low power and cheap, mature transmitter chips. 315 MHz fills the same role in North America and 868 MHz in Europe.

Is analysing these signals legal?

Receiving on ISM bands is generally permitted, and analysing devices you own is normal security research. Transmitting to operate equipment you do not own is not — treat replay attacks as strictly an authorised-testing activity.

Last reviewed · found a mistake? contact@decoder.tools · view as markdown