HaleHound CYD Review: $15 Pwnagotchi Alternative Tested [2026]

HaleHound CYD is an open-source, multi-protocol offensive security firmware created by JesseCHale that runs on the ESP32 Cheap Yellow Display — a $7–$15 touchscreen dev board. It delivers 40+ attack modules across WiFi, Bluetooth, SubGHz, and NFC, and can be flashed in under 2 minutes via the browser-based web flasher at flash.halehound.com. If you've searched for "Hellhound CYD" or "Hellhound firmware" — same thing, just a common misspelling.

Key takeaways:

• HaleHound CYD v3.7.2 delivers 40+ offensive security modules across 5 protocols (WiFi, Bluetooth, SubGHz, 2.4GHz, NFC) on hardware that costs as little as $7.
• A complete HaleHound build with all 4 external modules (CC1101, NRF24L01, PN532, GPS) costs roughly $45–$65 total — still cheaper than a basic Pwnagotchi setup.
• Unlike Pwnagotchi's passive AI-driven approach, HaleHound is an active offensive toolkit that transmits at maximum power with no reinforcement learning.
• The browser-based web flasher eliminates Arduino IDE compilation entirely — plug in, click flash, done in under 2 minutes.
• HaleHound is only legal when used on networks and devices you own or have explicit written authorization to test.

A $15 board with 40 attack modules doesn't make you a pentester — understanding what each module does, does.

What Is HaleHound CYD?

HaleHound CYD is a multi-protocol offensive security toolkit firmware, currently at version 3.7.2, designed specifically for the ESP32 Cheap Yellow Display (CYD) family of boards. JesseCHale created it and actively maintains it. As of 2025, it's pulled in 1,400+ GitHub stars and 108 forks — serious traction for a niche hardware hacking project.

The firmware turns a cheap ESP32 touchscreen board into a portable security research device. With just the base CYD board, you get WiFi and Bluetooth attack modules out of the box. Bolt on a CC1101 for SubGHz, an NRF24L01+PA+LNA for 2.4GHz, a PN532 for NFC/RFID, and a GPS module for wardriving, and you unlock the full 40+ module arsenal.

What makes HaleHound worth paying attention to in the broader AI security space isn't just the price tag. It's the combination of touchscreen UI, browser-based flashing, and multi-protocol support crammed onto a single $7 board. Older ESP32 security tools made you flash via serial through Arduino IDE, figure out board-specific pin configurations, and develop a working relationship with ESP-IDF. HaleHound v3.7.2 removed most of that pain with its web flasher. Most guides and tutorials you'll find online predate this change, which is why they make the setup sound harder than it actually is now.

The project supports 4 CYD board variants: the original ESP32-2432S028 (2.8"), QDtech E32R35T (3.5"), QDtech E32R28T (2.8"), and NM-RF-Hat (2.8"). The UI auto-scales between 240×320 and 320×480 resolutions depending on which board you're running.

→ Related: Reset Windows Admin Password with Linux USB: The Developer's Guide to Offline Recovery [2026]

What Is the Cheap Yellow Display and How Much Does It Cost?

The Cheap Yellow Display (CYD) is a nickname the maker community gave to the ESP32-2432S028R — a compact dev board built around the ESP32-WROOM-32 dual-core processor clocked at 240MHz. Rui Santos and Sara Santos of Random Nerd Tutorials did a thorough teardown showing what you get: 520KB SRAM, 4MB Flash, a 2.8-inch ILI9341 TFT display at 240×320 resolution, a resistive XPT2046 touchscreen, a microSD card slot, and an RGB LED. All of that in a 50×86mm form factor drawing roughly 115mA at 5V.

You can grab one on AliExpress for $7–$10 or Amazon for $12–$15 depending on the seller and how impatient you are about shipping. At least 4 GPIO pins (GPIO 35, 22, 21, 27) are exposed for wiring external modules, which is exactly what HaleHound taps into for its SubGHz, 2.4GHz, NFC, and GPS peripherals.

If you're coming from the local LLM hardware world — where dropping $300+ on a GPU is Tuesday — the CYD's price point feels almost silly. Based on the benchmark data I maintain at kunalganglani.com/llm-benchmarks, even the cheapest useful local LLM setup runs 20x more than a full HaleHound build. That cost gap is the whole pitch: real tooling at pocket-change prices.

The board supports Arduino IDE, MicroPython, and ESP-IDF for programming, but HaleHound's web flasher means you never need to touch any of that if you're just running the firmware.

HaleHound CYD vs Pwnagotchi: Side-by-Side Comparison

This is the comparison everyone searches for, and nothing out there covers it properly. Pwnagotchi — created by Simone Margaritelli (evilsocket) — is an A2C reinforcement learning–powered WiFi audit tool running on a Raspberry Pi Zero W. It passively sniffs WiFi environments and learns over time to maximize the capture of crackable WPA handshakes and PMKIDs. HaleHound takes the opposite approach: active, multi-protocol offensive operations transmitting at maximum power.

They're solving fundamentally different problems.

Pwnagotchi's killer feature is its autonomous learning loop. Clip it to your bag and it gets smarter about WiFi capture over time. HaleHound's killer feature is breadth: 40+ modules across 5 protocols with a touchscreen interface that lets you jump between WiFi deauth, Bluetooth scanning, SubGHz replay, and NFC cloning without reflashing anything.

If your goal is dedicated WiFi handshake farming for offline cracking with hashcat, Pwnagotchi is still the more focused tool. If you want a portable multi-protocol pentesting Swiss Army knife for lab and CTF work, HaleHound gives you dramatically more per dollar.

Understanding physical-layer attack surfaces matters for the same reasons I write about prompt injection and AI agent security — HaleHound just operates at the radio layer instead of the application layer.

What Attack Modules Does HaleHound CYD Include?

Per JesseCHale's GitHub README, HaleHound v3.7.2 packs 40+ attack modules across 5 protocol families. Here's the full breakdown:

WiFi Modules (built-in, no extra hardware):

• Deauthentication attacks (targeted and broadcast)
• Beacon spam (flood an area with fake SSIDs)
• Probe request sniffing
• Evil portal / captive portal attacks
• WPA handshake capture (via active deauth)
• WiFi scanning and network enumeration
• Karma attacks (rogue AP that answers any probe request)

Bluetooth Modules (built-in via ESP32's BLE radio):

• BLE device scanning and enumeration
• BLE spam (advertising flood)
• Bluetooth device tracking
• Apple/Android device notification spam

SubGHz Modules (requires CC1101, 300–928 MHz):

• Signal capture and replay
• Garage door / gate signal analysis
• Rolling code detection
• Frequency scanning across the 300–928 MHz band
• Raw signal transmission

2.4GHz Modules (requires NRF24L01+PA+LNA):

• MouseJack attacks (wireless keyboard/mouse injection)
• 2.4GHz device scanning
• Wireless HID exploitation

NFC/RFID Modules (requires PN532 V3 in SPI mode):

• NFC card reading and cloning
• RFID tag emulation
• Mifare key detection

GPS / Wardriving (requires GT-U7 or NEO-6M):

• WiFi wardriving with GPS coordinate logging
• Network mapping with location data

The WiFi and Bluetooth modules work immediately on a bare CYD board. Zero extra hardware. That's your $7 entry point. Each additional module unlocks a new protocol family.

What Hardware Do You Need? Full Bill of Materials with Prices

The GitHub README doesn't give you this. Here's every component, what it unlocks, and real prices across AliExpress and Amazon as of 2025:

Tier 1: Base Board (WiFi + Bluetooth only)

Tier 2: Add SubGHz (garage doors, signal replay)

Tier 3: Add 2.4GHz (MouseJack, wireless HID)

Tier 4: Add NFC/RFID

Tier 5: Full Build with GPS Wardriving

Here's the thing nobody tells first-time builders: if you use Ebyte PA (power amplifier) variants of the CC1101 or NRF24L01 modules, they need an independent 3.3V power supply. The CYD's onboard regulator can't push enough current. This is the #1 cause of hardware failures. A small AMS1117-3.3 regulator board ($1–$2) fixes it, but the README mentions this requirement without explaining why, and most people miss it entirely.

For context on that full-build price ($26–$71): a Pwnagotchi needs a Raspberry Pi Zero 2 W ($15), a microSD card ($8), a Waveshare e-ink display ($15–$25), a LiPo battery and charge board ($10–$15), and a case ($5–$10). A basic Pwnagotchi runs $50–$65, and a polished one easily crosses $100. HaleHound's full build matches Pwnagotchi's base cost while covering 5 protocols instead of 1.

How to Flash HaleHound Firmware Using the Web Flasher

The HaleHound web flasher at flash.halehound.com is one of the cleanest firmware install experiences in the ESP32 ecosystem. Here's the process:

1. Install USB drivers. The CYD uses either a CH340 or CP210x USB-to-serial chip depending on the board manufacturer. Download the correct driver for your OS. Windows usually needs the CH340 driver. On macOS, both are included in recent versions.
2. Use a data USB cable. I'm putting this in bold because it trips up more people than everything else combined. Charge-only USB cables — the ones that came with your cheap power bank — don't have data pins. If your board doesn't show up as a COM/serial port after plugging in, the cable is the problem. Not the board, not the drivers. The cable. Grab a known-good USB-A to Micro-USB data cable.
3. Open Chrome or Edge on desktop. The web flasher uses the Web Serial API, which only works in Chromium-based browsers. Firefox won't work. Safari won't work. Your phone's browser won't work.
4. Navigate to [flash.halehound.com](https://flash.halehound.com). HTTPS-only (required for Web Serial).
5. Select your board variant. Choose from the supported targets: esp32-2432s028 (2.8" CYD), esp32-e32r35t (3.5" QDtech), esp32-e32r28t (2.8" QDtech), or nm-rf-hat. If you bought the standard $7–$15 CYD from AliExpress or Amazon, you almost certainly want esp32-2432s028.
6. Click "Connect & Flash." Your browser will prompt you to select the serial port. Pick the one that appeared when you plugged in the board (usually labeled CH340 or CP210x).
7. Wait about 90 seconds. The flasher erases the existing firmware and writes HaleHound v3.7.2. Don't unplug during this.
8. Board reboots automatically. HaleHound splash screen appears on the touchscreen. Done.

Two minutes, start to finish. Compare that to the old workflow: clone the repo, install Arduino IDE, configure board definitions, chase down library dependencies, fix the three compilation errors you'll inevitably hit, and then flash via serial. The web flasher alone makes HaleHound more accessible than older ESP32 security firmwares like Marauder, which still typically requires IDE compilation for full feature access.

If you're used to browser-based dev tooling, this will feel familiar. If you're used to fighting with serial terminals, it'll feel like cheating.

How to Wire External Modules to the CYD

The CYD exposes a limited number of GPIO pins through its breakout headers. HaleHound's wiring scheme uses GPIO 35, 22, 21, and 27 as primary data lines, with SPI bus sharing across modules.

Wiring for each module follows the pin assignments in the HaleHound README:

CC1101 (SubGHz): Connects via SPI — SCK to GPIO 18, MISO to GPIO 19, MOSI to GPIO 23, CS to GPIO 5, GDO0 to GPIO 27. This handles all 300–928 MHz operations. Use the standard (non-PA) CC1101 variant for your first build. The PA versions draw more current than the CYD can supply and will hit brownout resets unless you add an external 3.3V regulator.

NRF24L01+PA+LNA (2.4GHz): Also SPI, sharing the bus with the CC1101. CE to GPIO 22, CSN to GPIO 21. Get the +PA+LNA variant for range — the basic NRF24L01 without the external antenna has embarrassingly short range. Same caveat about the Ebyte PA version needing its own 3.3V supply.

PN532 V3 (NFC/RFID): Must be set to SPI mode via the DIP switches on the module. Same SPI bus. The PN532 is the most annoying module to wire. Double-check those DIP switch positions before you power on or you'll spend 30 minutes debugging what turns out to be a switch in the wrong position.

GT-U7 or NEO-6M (GPS): Connects via UART — TX to GPIO 35, RX not needed (the GPS only sends position data to the CYD). Simplest module to wire by far.

All modules share VCC (3.3V) and GND from the CYD's breakout pins. SPI bus sharing works because each module has its own chip-select (CS/CSN) pin — the firmware talks to one module at a time and selects which one via the touchscreen menu.

Supported Board Variants: Which CYD Build Should You Buy?

HaleHound supports 4 board variants. If this is your first build, stop overthinking it: buy the standard 2.8-inch ESP32-2432S028.

Here's why:

• Cheapest option ($7–$9 on AliExpress)
• Most community documentation and troubleshooting threads
• The web flasher defaults to this board
• Nearly every wiring guide and YouTube tutorial references this variant

The 3.5-inch QDtech E32R35T was added more recently (the esp32-e32r35t build target). Bigger 320×480 display, which is genuinely nicer for reading scan results and navigating menus. But it runs $12–$18, has fewer HaleHound-specific resources, and the larger board is less pocketable. Good as a second board once you know what you're doing.

The QDtech E32R28T and NM-RF-Hat are niche. Unless you already have one sitting in a drawer, don't go looking for them.

Does HaleHound work on a 3.5-inch CYD display? Yes — the UI auto-scales between 240×320 (2.8") and 320×480 (3.5") resolutions. Just select the right build target in the web flasher.

HaleHound Discord: Community, Support, and Updates

The HaleHound Discord is the main support channel. It's linked from the GitHub README, and it's where JesseCHale and community members debug wiring issues, share build photos, and hash out feature requests.

Activity level is moderate — not a ghost town, not a 24/7 help desk. Common wiring questions usually get answered within hours. Firmware bugs might take a day or two. For a project maintained by a single developer, that's better than most.

The Discord is also where upcoming release info surfaces first. The v3.7.0 to v3.7.2 jump happened quickly, and community feedback directly drove bug fixes and new module additions.

If you're building your first HaleHound, join the Discord before you start wiring. The pinned messages often have updated wiring diagrams that differ from the README (which can lag behind firmware changes). The community has also documented several gotchas that the official docs don't cover — like that Ebyte PA power issue I mentioned earlier.

Is HaleHound CYD Legal to Use?

Most HaleHound content skips this section. That's irresponsible.

HaleHound CYD is a tool. Like Wireshark, Metasploit, or a lockpick set, legality depends entirely on how and where you use it. The firmware itself is legal to possess, install, and run.

What crosses the line:

• Deauthentication attacks on networks you don't own. In the US, this violates the Computer Fraud and Abuse Act (CFAA). In Canada, it falls under unauthorized use of computer systems (Criminal Code s. 342.1). In the EU, the Computer Misuse Directive applies. Deauthing your neighbor's WiFi because you think it's funny can result in federal charges. Not hypothetically. Actually.
• SubGHz signal replay on other people's property. Replaying garage door or gate signals you don't own is unauthorized access. In the US, it also runs into FCC regulations on intentional radio interference.
• NFC/RFID cloning without authorization. Cloning an office keycard you're not supposed to duplicate is a crime in most jurisdictions. Doesn't matter if you were "just testing."
• MouseJack attacks on peripherals you don't own. Injecting keystrokes into someone else's wireless keyboard is unauthorized computer access. Full stop.

What "authorized testing only" actually means: you need explicit written permission from the owner of every network, device, and system you test. Your own home network? Fine. Your employer's network during an authorized pentest with a signed scope document? Fine. The coffee shop's WiFi? No. Not even if you "only" scanned it.

This is the same ethical line that applies to LLM security research and AI agent attack surface testing. Understanding attacks is essential for defense. But there's a hard boundary between research and crime, and that boundary is authorization.

For CTF competitions, dedicated lab networks, and home lab environments, HaleHound is perfectly legal and a great learning tool. Keep it pointed at your own infrastructure.

HaleHound CYD vs ESP32 Marauder and Other Alternatives

HaleHound isn't the only ESP32 security firmware out there. ESP32 Marauder (by justcallmekoko) and Ghost_ESP are the two you'll see compared most often.

ESP32 Marauder was the original ESP32 WiFi offensive toolkit. It's been around since roughly 2020, has a bigger community (4,000+ GitHub stars), and focuses on WiFi and Bluetooth attacks. Marauder runs on various ESP32 boards including the CYD, but it's really designed for dedicated Marauder hardware with built-in SD card logging and battery management.

Where it differs from HaleHound:

• Marauder is WiFi/Bluetooth only. HaleHound adds SubGHz, 2.4GHz, and NFC.
• Flashing Marauder usually means Arduino IDE or PlatformIO compilation.
• HaleHound's touchscreen UI is more polished on CYD hardware specifically.
• Marauder goes deeper on WiFi — more granular packet manipulation options.
• Both cover deauth, beacon spam, probe sniffing, and handshake capture.

Ghost_ESP is newer, targeting ESP32 boards with a minimalist approach. Smaller feature set, cleaner codebase. Worth keeping an eye on, but it doesn't match HaleHound's module count yet.

HaleHound's differentiator is straightforward: it's the only ESP32 firmware that consolidates WiFi, Bluetooth, SubGHz, 2.4GHz, and NFC into a single touchscreen interface on a $7 board. If you want the broadest protocol coverage on the cheapest hardware, HaleHound wins. If you want the deepest WiFi tooling with the largest community behind it, Marauder is still the one to beat.

And this stuff matters beyond CTFs. WiFi deauth and rogue AP attacks aren't theoretical — they're real threats to edge-deployed AI agents and production AI systems running on embedded hardware. Understanding the physical layer is part of understanding the full attack surface of agentic AI.

Does HaleHound Capture WPA Handshakes Like Pwnagotchi?

Yes, but the approach is completely different.

Pwnagotchi captures WiFi key material passively, using A2C reinforcement learning to figure out the best moment to send deauth frames and trigger handshake exchanges. It saves everything as PCAP files — full WPA handshakes, half handshakes, PMKIDs — in a format that feeds directly into hashcat for offline cracking. The AI component means it literally improves at this over time.

HaleHound captures handshakes through brute-force deauthentication. Pick a target network, the firmware blasts deauth frames at maximum power, connected clients get kicked off and reconnect — generating a handshake that HaleHound grabs. No reinforcement learning. No passive optimization. It's a sledgehammer where Pwnagotchi is a scalpel.

For the security researcher who wants to clip a device to their bag and let it quietly audit WiFi over days or weeks, Pwnagotchi's passive approach is more appropriate and far less disruptive to legitimate network traffic. For the CTF player or lab tester who needs a handshake from a specific target network right now, HaleHound's active approach is faster.

Capture quality differs too. Pwnagotchi's bettercap integration produces clean, well-structured PCAPs that hashcat handles without complaining. HaleHound's capture is more basic — it works, but you may need to clean up the output depending on your cracking workflow.

Final Verdict: Is a $15 HaleHound CYD Worth It?

For $7–$15 in hardware and 2 minutes of flashing, HaleHound CYD is one of the best learning investments in practical security research you can make in 2026. Nothing else at this price covers 5 protocol families with a touchscreen UI and browser-based setup.

But I want to be direct about what it is and what it isn't.

HaleHound CYD is worth it if you:

• Want to learn wireless security fundamentals hands-on in a home lab
• Participate in CTFs that include wireless challenges
• Need a portable multi-protocol tool for authorized pentesting
• Are curious about SubGHz, MouseJack, or NFC attacks and want a cheap way to experiment
• Want a project that teaches embedded hardware wiring alongside security concepts

HaleHound CYD is NOT worth it if you:

• Need professional-grade WiFi auditing (get a proper WiFi adapter and Kali Linux)
• Want passive, set-and-forget WiFi capture (that's Pwnagotchi's job)
• Expect zero hardware tinkering (the external modules need soldering or careful dupont wiring)
• Think owning hacking tools makes you a hacker (it doesn't)

The full build at $45–$65 undercuts almost every alternative with comparable protocol coverage. A Flipper Zero — the closest commercial competitor — costs $169 retail. HaleHound gives you roughly 70% of the Flipper's wireless capabilities at 25–40% of the price, with open-source firmware you can modify and a community that's actively shipping updates.

Having built microservices at Swiggy where workflow services needed explicit compensation paths rather than blind retries, I've developed an appreciation for tools that are honest about their boundaries. HaleHound doesn't pretend to replace professional penetration testing hardware. It's a learning platform, a lab tool, and a CTF companion. At its price point, it's the best one available.

Version 3.7.2 ships via a 2-minute web flasher. The board costs less than a burrito. It covers protocols that most security professionals never touch outside of expensive corporate training. That's not hype — that's just a good deal.

If you're building your first one, start with the base 2.8" board and WiFi modules only. Learn the firmware. Understand what each attack actually does and why it works. Then add the CC1101 for SubGHz as your second step. Save NFC and GPS for last — they're the least useful for building your WiFi security fundamentals.

The "$15 Pwnagotchi alternative" label sells HaleHound short. It's not trying to replace Pwnagotchi. It's a different tool solving a different problem. And in 2026, it's the cheapest multi-protocol security education platform you can build.

Frequently Asked Questions

What is HaleHound CYD and who made it?

HaleHound CYD is an open-source multi-protocol offensive security firmware for the ESP32 Cheap Yellow Display, created and maintained by JesseCHale. It includes 40+ attack modules covering WiFi, Bluetooth, SubGHz, 2.4GHz, and NFC protocols. The project has 1,400+ GitHub stars and is actively developed, with version 3.7.2 being the latest release.

How do I flash HaleHound firmware onto my ESP32 CYD?

Visit flash.halehound.com in Chrome or Edge, plug in your CYD board using a USB data cable (not charge-only), select your board variant, and click Connect & Flash. The process takes under 2 minutes with no software installation required. You'll need either CH340 or CP210x USB drivers installed on your computer.

What is the total cost of a HaleHound CYD build with all modules?

A base CYD board costs $7–$15. Adding all four external modules (CC1101, NRF24L01+PA+LNA, PN532, and GPS) brings the total to approximately $26–$37 via AliExpress or $55–$71 via Amazon. Even the full build is cheaper than a basic Pwnagotchi setup or a Flipper Zero.

Is HaleHound CYD legal to use?

The firmware itself is legal to possess and install. However, using its attack modules against networks, devices, or systems you don't own or have explicit written authorization to test is illegal in most jurisdictions. Use it only on your own equipment or during authorized penetration testing engagements.

What is the difference between HaleHound and ESP32 Marauder?

ESP32 Marauder focuses primarily on WiFi and Bluetooth attacks with deeper WiFi-specific features and a larger community (4,000+ GitHub stars). HaleHound covers 5 protocol families — adding SubGHz, 2.4GHz/MouseJack, and NFC/RFID — on a single CYD board. HaleHound also has a more polished web flasher and touchscreen-first UI.

Does HaleHound work on a 3.5-inch CYD display?

Yes. HaleHound supports the 3.5-inch QDtech E32R35T board variant. The UI auto-scales between 240×320 and 320×480 resolutions. Select the correct build target (esp32-e32r35t) in the web flasher. The 3.5" board costs slightly more but offers a more readable display for scan results and menu navigation.

Photo by Vishnu Mohanan on Unsplash.