Primer · start here
The whole idea, in one sitting.
Before you touch a single menu on the Flipper, it helps to hold the big picture in your head. Radio sounds like magic, but it runs on about six plain ideas. Read this once and the rest of the course will feel like filling in detail you already have a shape for.
Six ideas that explain almost everything
Every remote, fob, garage opener, weather sensor and tyre-pressure monitor in your home is doing the same handful of things. Here they are up front. The rest of this page walks through each one slowly.
1 A signal is a wiggle in the air
Radio is an electric field wiggling up and down. How fast it wiggles per second is its frequency, measured in hertz.
2 Devices agree on a channel
A remote and its receiver meet at one frequency, like two people agreeing to talk on a set radio station.
3 Modulation carries the data
The wiggle itself carries no message. You have to change it — its strength or its pitch — to spell out ones and zeros.
4 A protocol is the grammar
Once you have ones and zeros, both sides need to agree what the pattern means: who's talking, and what they're asking for.
5 Fixed code vs rolling code
Some devices send the same message every time. Others change it on every press. This one distinction decides almost everything you can do.
6 Listening isn't transmitting
Receiving a signal is quiet and low-risk. Sending one is regulated, can disturb other people, and is where the rules matter.
1 · A radio signal is a wiggle in the air
Picture the surface of a pond after you drop a stone: ripples spreading out. A radio signal is the same idea, except the thing rippling is an invisible electric and magnetic field, and the ripples travel at the speed of light. Your Flipper's antenna is like a tiny cork bobbing on that pond. When ripples pass, the cork bobs; the Flipper measures the bobbing and turns it back into information.
The single most important number about any wiggle is how many times it goes up and down each second. That's the frequency, and we measure it in hertz (Hz) — one hertz is one up-and-down per second. Radio wiggles are fast, so we count in millions: one megahertz (MHz) is a million cycles per second. When someone says a remote works at 433.92 MHz, they mean its field is wiggling about 434 million times every second.
There's a twin number worth knowing: wavelength. Because the wave travels at a fixed speed, a faster wiggle covers less distance per cycle. The relationship is simple — wavelength = speed of light / frequency, usually written λ = c / f. A 433.92 MHz signal has a wavelength of about 69 cm. That's why antennas are the size they are: a good antenna is a neat fraction of the wavelength, often a quarter, so roughly 17 cm for 433 MHz. Play with the numbers below and watch the antenna length change as you sweep the frequency.
2 · Devices agree on a channel (a frequency)
A wiggle on its own is just noise. For two devices to talk, they have to meet at the same frequency — the same channel — the way two friends agree to tune to the same radio station before they can hear the same song. Your car key and your car agree in advance. Your weather station and its outdoor sensor agree in advance. You never chose the channel; the manufacturer did, and stamped it into both halves at the factory.
Manufacturers can't just pick any frequency they like. Most of the spectrum is reserved for things like TV, aircraft, and mobile networks. Little gadgets get to use a set of shared, licence-free lanes called the ISM bands — short for Industrial, Scientific and Medical. Anyone can use them without a personal licence, as long as they stay low-power and play nicely. That's why cheap remotes cluster onto just a few frequencies worldwide.
These four are the ones you'll meet again and again:
| Frequency | Where | You'll see it on |
|---|---|---|
| 315 MHz | North America | Car fobs, TPMS, older garage remotes |
| 433.92 MHz | Worldwide ISM | Gates, garages, weather sensors, doorbells |
| 868.35 MHz | Europe | Newer gates, alarms, smart-home sensors |
| 915 MHz | North America ISM | US sensors, some garage systems |
The Flipper's radio can tune a wide stretch that happens to cover all four of these and much in between — roughly 300 to 928 MHz, in three chunks. When you don't know a device's channel, the Flipper's Frequency Analyzer sweeps that range and tells you where the energy is. You'll learn to do exactly that in Module 1.
3 · Modulation: how the data rides the wave
Here's the twist that trips up most beginners. A pure wiggle at a steady frequency carries no information at all — it's a dial tone, a held note. To send a message you have to change the wave in a pattern the other side can read. That deliberate changing is called modulation. Think of it as two ways to signal a friend across a dark field with a torch.
Blink it on and off AM / OOK
You flick the torch on and off. Bright means one, dark means zero. In radio this is amplitude modulation (AM) — you change the strength of the wave. The simplest form, where the transmitter is either fully on or fully off, is called on-off keying (OOK), and it's what nearly every cheap remote uses.
Wobble its colour FM / FSK
You keep the torch on but wobble it between two shades — say, slightly redder for one and slightly bluer for zero. In radio this is frequency modulation (FM): you nudge the pitch of the wave up and down. The two-tone digital version is frequency-shift keying (FSK), common on newer and 868 MHz devices.
This matters on the device because the Flipper has to be told which style to listen for. If a remote is speaking in blinks (AM) and you're listening for wobbles (FM), you'll hear nothing — not because the signal is missing, but because you're reading the wrong kind of change. On the Flipper these listening styles are called presets. The stock ones are named AM270, AM650, FM238 and FM476. The letters tell you the modulation family. The AM numbers describe approximate bandwidth; the FM names refer to deviation. They are not all bandwidth values. You'll rarely need to know more than "try AM650 first, it fits most remotes." Module 2 lets you flip between them and watch a signal appear and vanish.
4 · A protocol is the grammar of the message
Once modulation gets you a stream of ones and zeros, you still have a pile of bits with no meaning. A protocol is the agreed grammar that turns those bits into a sentence. Almost every simple remote's message has the same three parts, in order:
- preamble
- A little run of pulses that says "wake up, a message is starting" — it lets the receiver lock on.
- serial / ID
- A number that identifies this specific remote, so your neighbour's identical opener can't drive your gate.
- command
- Which button was pressed — open, close, stop, light — often just a few bits.
Different companies arrange those parts differently — how long a pulse is, how many bits the serial number gets, how the command is encoded. Each arrangement has a name. The Flipper recognises dozens of these families out of the box: Princeton CAME Nice FLO Holtek Chamberlain Linear Hormann and more. When the Flipper's Read screen shows you a protocol name, a key value and a bit count, it's telling you it recognised the grammar and successfully read the sentence.
A concrete example: a Princeton remote sends a 24-bit message with a timing unit (the Flipper calls it TE) of a few hundred microseconds. That 24-bit key is the remote's identity plus button. When you save a capture, the Flipper writes it to a small text file — a .sub file — recording the frequency, the preset, the protocol name and the key. You'll dissect one line by line in Module 3, and the full field list lives in the reference.
5 · Fixed code vs rolling code — the big fork
If you remember only one distinction from this whole page, make it this one. It decides what's possible, what's pointless, and what's the security feature doing its job.
Fixed code same every time
The remote sends the exact same message on every press. Simple, cheap, and common on older garage doors, basic gates and many cheap remotes. Because the message never changes, a recording of it will work again later — which is why you can capture your own garage remote to a .sub file and replay it to your own door.
Rolling code changes every press
The remote and receiver share a secret and a counter. Every press produces a new, one-time message, and the receiver refuses to accept a number it has already seen. Standards like KeeLoq, Nice FloR-S and Security+ 2.0 work this way. On the Flipper's Read screen a rolling remote shows a counter (Cnt) that ticks up with each press.
The consequence is the single most common beginner surprise: a captured rolling-code message might open your gate once, and then never again — because the moment it's used, the receiver moves its counter past it and treats it as stale. That's not a bug and it's not you doing something wrong. It's exactly what rolling code is for: to make yesterday's recording worthless. Understanding why replay fails is a real skill; trying to defeat it on property that isn't yours is not something this course teaches. There's a whole case study on the classic "my Nice gate copies once, then barely works" mystery in the case studies, and a live simulator in Module 5.
6 · Listening is not transmitting
Sub-GHz reception observes a signal without deliberately transmitting a Sub-GHz command. It can still collect protected information. RFID/NFC reading is different again: the reader actively powers and communicates with the tag. Authorization, privacy and radio conditions all matter.
Transmitting — putting your own wiggle into the air — is a different thing entirely. It's regulated everywhere, because your signal shares the band with everyone else's. Send at the wrong time, the wrong power, or the wrong band and you can jam a neighbour's gate, interfere with a device you can't even see, or break the law. The course only ever has you transmit to devices you own, in a space you control, and never to defeat security on anything that isn't yours.
How to use this course
Signal Path is built to be done in order, with the device in your hand. Each module is short, plain-spoken, and ends with a hands-on lab and a quick quiz. Here's the rhythm:
- Read the module — one goal, the concepts behind it, and a "you've got it when" test so you know you actually learned it.
- Do the lab — always on remotes and fobs you own. RF only clicks when you're holding the real thing.
- Play the simulator — every module has an interactive that lets you poke at the idea safely, and they're all collected in the playground.
- Take the quiz — six to eight questions that lock the concept in. Your progress and badges are saved in this browser only.
When a term is new, it's explained the first time you meet it, and the full list lives in the glossary (with flashcards). Dense lookup tables — frequencies, presets, file fields — are in the reference, which you'll come back to often.
Start doing
Module 0 · Meet your radio lab
Navigate the Flipper, confirm Momentum is installed, and watch live radio energy for the first time. It's the gentlest possible on-ramp.
Open Module 0 →Or just play
The playground
Nine simulators — modulation, spectrum, rolling codes, pulse decoding, a Flipper screen you can drive — with nothing to install and nothing to break.
Open the playgroundCheck yourself
A few quick questions on the big picture. Miss one and the explanation will set it straight.