AirLeak Pro
Two radios, one job each. An ESP32-S3 captures Bluetooth LE while a dedicated ESP32-C5 Wi-Fi engine sweeps both 2.4 and 5 GHz — at the same time, full duty. Logged to microSD, and mapped in the app with the optional GPS. Nothing phones home.
Engineered to never take turns
- 0 MCUs
- ESP32-S3 + ESP32-C5
- 0 radios
- BLE + Wi-Fi, in parallel
- 0 GHz
- top Wi-Fi band, natively
- 0 MHz
- per core, dual-core S3
- 0 MB flash
- on the S3 brain
- 0+0 MB PSRAM
- S3 + C5 combined
A serious amount of capability
Every capability below is in the shipping firmware — configured and viewed from the ZeroTrace app. It observes and records; it never interferes with the networks it sees.
Dual-band Wi-Fi capture
2.4 + 5 GHz at once
The dedicated C5 Wi-Fi radio sweeps both bands, so you see access points single-band tools miss.
Adaptive channel hopping
Prioritises the busiest channels each sweep and rotates through quieter and DFS channels for full coverage.
Security decoding
Tags each network's exact security — Open, WEP, WPA/WPA2/WPA3 personal or enterprise, OWE — plus WPS and PMF.
Hidden network detection
Access points with a blank or cloaked SSID are flagged as hidden, never silently dropped.
Change-tracked AP table
Up to 4096 APs are deduplicated and re-reported the instant their signal or security changes.
BLE device intelligence
Tracker & beacon protocols
Decodes Apple Find My / AirTag, Samsung & Google trackers, Tile / Chipolo / Pebblebee, Eddystone, AltBeacon, Xiaomi and RuuviTag.
Apple Continuity
Reads AirDrop, Handoff and Nearby activity, AirPods battery and charge state, device model and iOS version from the air.
34-class identification
Classifies each device — iPhone, MacBook, AirTag, Pixel, Windows PC, Flipper Zero, headphones and more — with a confidence score.
Vendor & service lookup
Resolves the manufacturer from a 9,000+ entry company database and names the BLE services each device advertises.
Randomization & distance
Tells static from randomized MACs and estimates distance from signal — a fixed tracker vs a passing phone.
Privacy-leak & threat detection
PII leakage score
Each device gets a 0–100 exposure score from real signals — AirDrop set to Everyone, leaked identifier hashes, active call/audio.
AirDrop & unlock exposure
Flags devices with AirDrop open to Everyone and surfaces Apple Nearby-Info signals such as an unlocked-phone state.
Separated-tracker alerts
Detects Find My and SmartTag devices in owner-separated mode — a strong sign of a tracker that may not be yours.
Follow-me detection
Watches for the same non-random device reappearing across hours — the classic signature of being tracked.
On-device threat LED
The RGB LED turns yellow on a detection and flashes red on a high-severity threat, with thresholds you set in the app.
GPS, logging & wardriving
On-device SD logging
From boot, every BLE and Wi-Fi observation streams to microSD as WiGLE CSV — with or without a phone connected.
Optional GPS positioning
With the solder-on GPS fitted, the app reads a live fix — latitude, longitude, satellites, fix quality — for location-stamped wardriving.
Live wardrive map
The app plots your route on a dark map and drops device markers at their strongest-signal location, saving each session.
History, replay & export
Review past drives with route thumbnails and a replay animation, then export a combined BLE+Wi-Fi WiGLE CSV or upload to WiGLE.
Automatic file rotation
Capture files rotate at 8 MB and are numbered in sequence, so a power cycle never overwrites earlier logs.
Power, storage & diagnostics
Battery monitoring
Reports cell voltage, state of charge and external-power status — with a one-tap full-charge calibration from the app.
Health dashboard
Live CPU load, free memory, safe-mode state and brownout counters in the app, plus a one-tap LED self-test.
SD card manager
Browse the card's folders, check free space, download logs, delete files and format to FAT32 from your phone.
On-flash forensics
Boot records, memory events and crash forensics are kept on-flash and can be read or cleared from the app.
Stress-counter reset
Clear brownout and rail-sag tallies on both chips for a clean slate before a new session.
Capture modes & control
Capture modes
Switch between Monitor for steady scanning, Wardrive for max-rate logging, and Setup for idle configuration.
Radio selection
Choose which radios capture — Wi-Fi only, BLE only, or both — independent of the active mode.
Fox-hunt proximity
Lock onto one device or AP and turn its live signal into a proximity gauge — bars, distance and a sparkline — to walk it down.
Device configuration
Set the device name, capture sensitivity, threat thresholds, LED colour and brightness, and default export format.
Live device dossier
Open any device for a full breakdown — signal, vendor, protocols, address type, AirPods battery and decoded advertising flags.
A live wardrive, simulated
What AirLeak Pro streams in Wardrive mode — new and changed access points and BLE devices, GPS-stamped, written to microSD as WiGLE CSV. Illustrative data, not a live radio.
Wi-Fi and Bluetooth, at the same time
The C5 Wi-Fi engine hops every 2.4 and 5 GHz channel while the S3 captures Bluetooth LE — two radios at full duty, no shared-radio time-slicing.
Two radios, one job each. The C5 sweeps every Wi-Fi channel — 2.4 and 5 GHz — while the S3 captures Bluetooth LE at the same time. Full duty, no shared-radio time-slicing, no coexistence penalty.
Wi-Fi ∥ BLE · simultaneousZoom into every part
Pick a component to zoom the board and see exactly what it is and why it's there.
Tap any numbered point on the board — or pick a part from the list — to zoom in and see what it does.
Set the mode from the app
Three capture states — Wardrive, Monitor and Setup — each lights the status LED its own color. A separate Wi-Fi / BLE / All control picks which radios run.
LED · rgb(0,150,255)
Wardrive
Scan flat-out for wardriving. The live views pause; the device logs every access point and BLE device you pass to microSD, and the app maps and GPS-tags the drive with the optional GPS fitted.
One radio per chip — BLE and Wi-Fi at once
One chip can't run Wi-Fi and Bluetooth flat-out at the same time. AirLeak Pro gives each its own radio, so neither has to take turns.
ESP32-S3 — the brain
Runs the Bluetooth LE radio, and owns the microSD, status LED, battery system and the optional GPS. It aggregates the BLE + Wi-Fi captures and writes the log.
ESP32-C5 — the Wi-Fi engine
A dual-band Wi-Fi chip that does nothing but scan — both 2.4 and 5 GHz — and hand its results to the S3 over a private internal link. The S3’s BLE radio never touches Wi-Fi.
ZTL link · 921600 baud · binary-framed · GPS-stamped on arrival
Both radios run at full duty, simultaneously — no shared-radio time-slicing, no 2.4 GHz coexistence penalty. To you it behaves as one device.
A step up from the standard AirLeak
All the Bluetooth-LE smarts of the standard AirLeak, plus a second dedicated radio for dual-band Wi-Fi, on-board logging, positioning and battery.
The full sheet
Processing
- Main processor
- ESP32-S3 · dual-core to 240 MHz
- Main memory
- 16 MB flash · 8 MB PSRAM
- Radio co-processor
- ESP32-C5 · to 240 MHz
- Co-processor memory
- 8 MB flash · 8 MB PSRAM
- Inter-chip link
- Private internal UART (C5 streams scans to the S3)
Wireless
- Wi-Fi 2.4 GHz
- Yes — ESP32-C5 radio
- Wi-Fi 5 GHz
- Yes — ESP32-C5 radio (the Pro feature)
- Bluetooth
- Bluetooth LE — ESP32-S3 radio
Positioning & time
- GPS receiver
- GPS — optional, solder-on / header
- Interface
- NMEA over UART @ 9600 baud · 1 PPS
- Location stamping
- App reads the live fix to map + GPS-tag exported drives
- On-device log
- Captures log to microSD with or without a phone connected
Storage
- Card
- microSD (TF) with card-detect
- Interface
- SPI
- Format
- FAT32 · up to 32 GB recommended
- Log format
- WiGLE CSV
Power
- Battery
- 1× 18650 Li-ion (1S) in an on-board holder
- Management
- On-board charging + 4-way cell protection (BMS)
- Charging
- USB-C, 5 V
- System rail
- Regulated 3.3 V via buck-boost (full-discharge stable)
Connectivity & debug
- USB-C
- Charging and data — reaches one MCU at a time (SW1)
- Debug
- Per-processor POGO pads (console + reset/boot)
- Console
- 115200 8N1
A case is in the making
Every AirLeak Pro ships with a case and antennas. The case is being finalised now — this section will be updated with the real render as soon as possible.
Case render in progress · board picturedThe €129.85 price includes a case and antennas — every unit ships ready for the field. The case is in the making; we’ll update this with the final render as soon as possible.
- In the box — the device, a case and antennas. Nothing else.
- Case in the making — shipped with the unit, render coming soon.
- Antennas included — fitted and ready to scan.
- Bring your own 18650 cell and microSD card.
What you'll need
The board is the product; pair it with three commodity parts you likely already own.
One 18650 cell
Flat- or button-top Li-ion, 3.7 V. Unprotected is fine — the board protects it.
A microSD card
FAT32-formatted, up to 32 GB recommended, for logging surveys.
A USB-C cable
A solid 5 V / 2 A source charges fastest and runs the radios cleanly.
Professionally engineered. AirLeak Pro was designed, reviewed and bench-tested in cooperation with a practicing hardware engineer from the semiconductor industry — validated to a professional standard, not a hobby build.
Built for authorized assessment
AirLeak Pro is a measurement and logging tool for wireless security work, site surveys and research. Only survey environments you’re authorized to assess, and follow the radio-spectrum and privacy laws where you operate.
It observes and records — it never interferes. The live feed shown above is illustrative.
AirLeak Pro
One price, ready to run. Buying unlocks when the countdown hits zero.
The ZeroTrace AirLeak Pro — device, case and antennas, nothing else. The case is in the making and will be updated as soon as possible. Bring your own 18650 cell and microSD card.
Checkout opens 10 minutes after the drop — when the timer hits zero.
In the box
- AirLeak Pro deviceV1.1 · dual-MCU — assembled, tested & flashed
- CaseIn the making — ships with the unit, updated as soon as possible
- AntennasFitted and ready to scan
On the board
Not included
No 18650 battery and no microSD card — both are widely available; bring your own (see “what you’ll need”).