LilyGo T‑Embed CC1101: The Next Pentesting Device Revolution
An ESP32-S3 board with a sub-GHz radio, NFC, infrared and a screen, for around $55. What is actually on it, what the radio can and cannot do, and the regional licensing question that none of the product listings mention.
Not tested. Wangdoo has not handled a T-Embed CC1101. This article is based on LilyGo’s published documentation and hardware repository, the CC1101 and PN532 component specifications, and third-party coverage.
Scope. This is a hardware explainer. It describes what the board contains and the regulatory framework it operates inside. It does not contain operating instructions for capturing, replaying or interfering with radio signals, cloning access credentials, or any other technique that would require someone else’s permission to use lawfully.
Status: Accurate as of 4 September 2026.
The T-Embed CC1101 is a development board that has ended up with two quite separate audiences.
To one group it is an ESP32-S3 board with an unusually complete radio section — a sub-GHz transceiver, NFC, infrared, Wi-Fi and Bluetooth on one small PCB with a screen and a rotary encoder, which makes it a convenient base for home automation and sensor work. To the other it is an inexpensive alternative to a Flipper Zero, bought specifically to run third-party firmware.
The hardware is the same either way, and it is worth understanding on its own terms before deciding which of those things you are buying.
At its centre is an ESP32-S3 dual-core LX7 with 16 MB of flash and 8 MB of PSRAM. Around it sit a Texas Instruments CC1101 sub-GHz transceiver, a PN532 NFC controller, an infrared transmitter and receiver, a 1.9-inch colour display, a rotary encoder, microphone, speaker, SD card slot and battery management.
The CC1101 covers 300–348 MHz, 387–464 MHz and 779–928 MHz. Which of those you can legally transmit in depends entirely on where you are standing.
Video: a hardware walkthrough of the T-Embed CC1101 — what is inside the enclosure and how the stock firmware presents it. Wangdoo is not affiliated with the publisher. Many videos about this board demonstrate techniques that are unlawful without authorisation in most countries; this article does not cover them.
What is on the board
| Component | Detail |
|---|---|
| Processor | ESP32-S3 dual-core Xtensa LX7, 16 MB flash, 8 MB PSRAM |
| Sub-GHz radio | TI CC1101; 300–348 MHz, 387–464 MHz, 779–928 MHz. Band selected by hardware switches SW0 and SW1 |
| NFC | PN532 at 13.56 MHz only |
| Wireless | Wi-Fi 802.11 b/g/n 2.4 GHz, Bluetooth LE 5.0 |
| Display | 1.9-inch ST7789V IPS TFT, 320 × 170, SPI |
| Infrared | Transmitter and receiver |
| Input and output | Rotary encoder, reset and boot buttons, microphone, speaker, 8 addressable WS2812 RGB LEDs, microSD slot |
| Antenna gain | 2.4 GHz external antenna 1.5 dBi; sub-1 GHz antenna −0.57 dBi |
| Power | BQ25896 charger and BQ27220 fuel gauge; LilyGo advises charge current should not exceed 600 mA |
| Plus variant | Adds an nRF24L01 2.4 GHz transceiver. Otherwise identical |
The integration is the point. Individually none of these parts is remarkable — the CC1101 has been a standard sub-GHz transceiver for well over a decade, and the PN532 turns up in countless NFC projects. Putting them on one board with a screen, an encoder and a battery gauge is what makes it useful, because it removes the breadboard stage.
The sub-GHz radio, and the switch
The CC1101’s frequency coverage is often quoted as though the board sweeps continuously from 300 to 928 MHz. It does not work quite like that.
LilyGo’s hardware documentation shows the band being selected by two physical switches, SW0 and SW1, wired to GPIO 48 and 47. The three documented combinations select roughly 315 MHz, 434 MHz, or 868/915 MHz. That switch is steering the signal through different matching components, which is why it exists as hardware rather than a line of code.
This matters more than it sounds, because of a general truth about sub-GHz boards that the marketing tends to skate over. A transceiver chip may support a wide tuning range, but the crystal, capacitors and filter coils around it are chosen for one band. A board advertised as covering 315, 433, 868 and 915 MHz is not equally good at all four, and in most designs is optimised for one.
LilyGo’s own figures hint at the compromise. The sub-1 GHz antenna is specified at −0.57 dBi — a negative gain, meaning it radiates less well than a theoretical isotropic reference. That is a normal result for a small internal antenna asked to work across a wide span, and it is the honest explanation for the 50-metre range figure. This is a short-range device.
Which band you can legally use
Here is the part that almost no product listing mentions, and the reason a reader in Dublin, Denver or Osaka needs different information from the same page.
Sub-GHz licence-free allocations are set nationally and they do not agree with each other. The four bands in common use — roughly 315, 433, 868 and 915 MHz — are legal in different places, and a band that is unlicensed in one country can be reserved for something else entirely in another.
| Band | Where it is generally licence-free | Notes |
|---|---|---|
| 315 MHz | United States and the Americas; Japan | Licence-exempt in ITU Region 2. In Japan it is a specified low-power allocation under ARIB STD-T93, restricted to telemetry, telecontrol and data transmission rather than general use. No equivalent allocation in Europe |
| 433.05–434.79 MHz | ITU Region 1, which includes Europe, Africa and the Middle East | In the US and many other countries this range sits inside the 70 cm amateur and government allocation. Some manufacturers disable 433 MHz transmission in software for North American markets |
| 863–870 MHz | Europe | The main European short-range band. Typically limited to 25 mW radiated power with duty-cycle restrictions of 1% or 0.1% by sub-band |
| 902–928 MHz | United States, Canada, Australia, New Zealand | Higher permitted power. Overlaps mobile network allocations in Europe, so not available there |
| 920–923.5 MHz | Japan | Japan’s main sub-GHz short-range band, under ARIB STD-T108, at 250 mW or less. Sits inside the board’s 779–928 MHz range but is a narrower window than the US band |
These allocations also move. Japan’s Ministry of Internal Affairs and Communications received a council report in late 2024 on technical requirements for operating tyre-pressure monitoring and keyless entry systems in the 433 MHz band, with the stated aim of aligning with the international standard frequency for those applications. Anyone relying on a table like the one above should check their own national regulator rather than treat it as fixed.
The practical consequence is that flipping the switch to a band your country has assigned to someone else, and then transmitting, is not a grey area. Receiving is a different matter and treated differently across jurisdictions, but transmitting outside your national allocation is straightforwardly an offence in most places.
Duty cycle is the limit people forget. European allocations at 868 MHz do not simply cap power. They also cap how much of the time a device may transmit — commonly 1% or 0.1% depending on the sub-band, which works out at 36 seconds or 3.6 seconds per hour.
A firmware feature that transmits continuously will breach that limit long before it breaches a power limit, even if the output is modest.
What the NFC side does and does not do
The PN532 is the component most likely to disappoint someone who bought the board for a specific job, and LilyGo’s documentation is clear about why.
It operates at 13.56 MHz and nothing else. LilyGo states plainly that it does not support 125 kHz low-frequency cards, does not support CPU cards, and does not support encrypted cards.
That rules out a large share of what people want to use it for. Many building access fobs, older hotel cards and a great many door-entry systems run at 125 kHz, and the board cannot see them at all. Encrypted cards — which covers most modern transit and payment credentials — are outside its scope by design. Third-party firmware has at times noted that certain card-reading features require a different PN532 module and do not work on this board.
The firmware situation
The board ships with LilyGo’s own factory firmware and supports Arduino IDE and ESP-IDF development, with LVGL available for the display. Plenty of people use it exactly that way. There is a Meshtastic community around it, and at least one person has written a two-player game for it.
It is also one of the primary targets for third-party firmware written for security testing — Bruce and CapibaraZero being the two most often named, along with a launcher that lets several coexist on one device. These projects publish their own documentation describing radio scanning and capture, replay, Wi-Fi and Bluetooth testing tools, NFC reading and emulation, infrared capture, and USB keystroke injection.
Those capabilities are what the board is most often bought for, and describing them is not the same as recommending their use. The legal position is unambiguous and worth stating in plain terms.
Two things that are illegal essentially everywhere, regardless of intent or of what a firmware menu offers:
Deliberate radio jamming. Interfering with licensed or licence-free radio services is an offence across the EU, the UK, the US and most other jurisdictions, and the penalties are not trivial.
Attacking networks or access systems you do not own and have not been authorised in writing to test. Security research on your own equipment, or under a documented scope agreement, is a different activity from doing the same thing to a neighbour’s doorbell.
Who it suits
As a development board it is a reasonable proposition. Sub-GHz radio work usually means a bare module, a breadboard and a serial console; having a transceiver, a screen and an encoder in one enclosure removes most of that friction, and the ESP32-S3 with 8 MB of PSRAM has room for a real interface rather than a debug log.
For legitimate radio experimentation the constraints are the ones any short-range device has. Modest antenna performance, a 50-metre working range, and national rules that determine which band you may use and for how long. None of that is a flaw in the board. It is what sub-GHz is.
For anyone buying it as a Flipper Zero substitute, the honest summary is that the hardware is capable and cheaper, the NFC is more limited than many expect, and the responsibility for staying inside the law sits entirely with the operator rather than with the firmware.
Frequently asked questions
What is the LilyGo T-Embed CC1101?
An ESP32-S3 development board combining a CC1101 sub-GHz transceiver, a PN532 NFC controller, infrared transmit and receive, Wi-Fi and Bluetooth LE, a 1.9-inch IPS display, rotary encoder, microphone, speaker and SD card slot. It typically sells for around $55.
What frequencies does the CC1101 cover?
LilyGo documents 300–348 MHz, 387–464 MHz and 779–928 MHz, with the band selected by two hardware switches that choose approximately 315 MHz, 434 MHz, or 868/915 MHz. Stated range is up to 50 metres.
Which band can I legally transmit on?
It depends on your country. Broadly, 433 MHz is licence-free across ITU Region 1 including Europe, 863–870 MHz is the main European short-range band, 315 MHz and 902–928 MHz are the North American conventions, and Japan uses 315 MHz for restricted applications plus 920–923.5 MHz more generally. Transmitting outside your national allocation is an offence in most jurisdictions, and allocations change, so check your national regulator before transmitting.
Can it read my building access card?
Probably not. The PN532 works at 13.56 MHz only. LilyGo states it does not support 125 kHz low-frequency cards, CPU cards or encrypted cards, which excludes many access fobs and most modern transit and payment credentials.
What is the difference between the CC1101 and the CC1101 Plus?
The Plus adds an nRF24L01 2.4 GHz transceiver module. The rest of the board is the same.
Is it a Flipper Zero?
No, though third-party firmware gives it a comparable feature list at lower cost. The hardware differs — notably the NFC section, which is limited to 13.56 MHz — and the board is sold as a development board rather than a finished consumer product.
Why is the antenna gain negative?
A gain of −0.57 dBi means the sub-1 GHz antenna radiates slightly less efficiently than a theoretical isotropic reference. That is typical for a small internal antenna covering a wide frequency span, and it is consistent with the modest 50-metre range figure.
Sources
- LilyGo — T-Embed CC1101 hardware repository and product wiki. Source for the component list, the CC1101 frequency ranges, the SW0/SW1 band-selection switches and their GPIO assignments, antenna gain figures, the 50-metre range statement, battery management parts and charge-current guidance, and the PN532 card-type limitations. github.com
- LilyGo — T-Embed CC1101 Plus product page. Source for the nRF24L01 addition and the confirmation that the boards are otherwise identical.
- LinuxGizmos — coverage of the T-Embed CC1101 and the later Plus revision. Independent confirmation of the specification.
- ITU-R — material on international, regional and national regulation of short-range devices, including the 433.05–434.79 MHz Region 1 allocation and national variation within it.
- ARIB — STD-T93 (315 MHz band telemetry, telecontrol and data transmission) and STD-T108 (920 MHz band, 250 mW). Source for the Japanese allocations and their application restrictions.
- Japan Ministry of Internal Affairs and Communications — press release on the Information and Communications Council’s partial report regarding 433 MHz technical requirements for tyre-pressure monitoring and remote keyless entry, November 2024.
- Analog Devices and EE Times — technical overviews of sub-1 GHz short-range device allocations, covering the 433 MHz, 868 MHz and 902–928 MHz bands and their regional availability.
- Component documentation — general guidance on sub-GHz breakout boards noting that crystal, capacitor and filter selection tunes a board to one band even where the transceiver supports a wider range.
Clayton Samuel (Mr Wangdoo), QFA — Founder & editor, Wangdoo.com. Qualified Financial Adviser with a background in electronics, web development, and cloud infrastructure.