AetherKey fuses a USB Rubber Ducky, a Wi-Fi attack suite, NFC/RFID tooling, a sub-GHz radio and an IR blaster into one 102 mm handheld — with a D-pad, A/B buttons, an OLED, your phone as its second screen, and any browser as its control panel.
Same hardware, same radios, same companion ecosystem. The Regular edition is the turnkey tool; the Pro edition is the same device with every door unlocked for builders.
Ready to run
Every stock capability, factory-fitted and locked to signed official firmware. Hand it to a junior consultant and sleep well.
Unlocked · For builders
The Regular's everything, plus the keys to the kingdom: open firmware, AetherSDK, community modules, and hardware expansion pads.
The ducky that can't see the network. The dolphin that can't type. The pineapple that needs a laptop. Every great field tool covers one domain and pretends the others don't exist. AetherKey is one object, one battery, one control language — and every protocol you actually need on an engagement. Boot it in half a second, automate a workstation over USB, own the air over Wi-Fi and BLE, talk to badges, remotes and IR devices, and drive it all from the OLED in your hand, your phone in your pocket, or any browser on earth.
Each capability is a firmware module on the ESP32-S3 — and on the Pro edition, every one of them can be swapped, extended or replaced with your own code.
DuckyScript-compatible with Aether extensions: OS fingerprinting, conditional stacks, Wi-Fi exfil, humanised typing jitter. Composite HID + mass-storage, run-on-plug in under 900 ms.
Scan, evil portals with credential templates, beacon spam, handshake & PMKID capture to PCAPNG, deauth detection. Station, soft-AP and monitor modes from the OLED or your phone.
BLE scanning with service enumeration, advertisement spoofing, GATT server that powers the web panel — the same transport that controls the device tests it.
PN532 at 13.56 MHz: read, write and emulate ISO14443A/B — MIFARE Classic & Ultralight, FeliCa. Dictionary attacks with on-device key lists. LF 125 kHz via Pro expansion.
CC1101 covers 300–928 MHz: capture a remote's frame, inspect modulation and sync words, edit and retransmit. Region-locked power tables and a rolling-code replay guard.
Two 940 nm emitters, 8 m range, TSOP4838 capture. 650+ device library (TVs, projectors, HVAC, AV racks) plus a raw timing editor for the exotic stuff.
Tether to a laptop as a bettercap attack radio, or run standalone rogue-AP engagements with captive portal and encrypted logging — no host computer required.
Android companion with payload studio and live consoles; zero-install web panel over Web Bluetooth or Wi-Fi captive portal — iOS, Linux, anything with a browser.
AetherSDK, the module registry and populated expansion pads make the Pro a genuine dev platform: your code, your hardware, your device. The Regular stays locked and safe.
The Android companion and the browser web panel expose the same feature set — payload studio, live Marauder console, NFC and IR tools, telemetry and OTA — over an encrypted BLE link or the device's own access point.
What each option actually does. ● = supported, — = not available.
| Capability | AetherKey Regular | AetherKey Pro | Flipper Zero | Rubber Ducky |
|---|---|---|---|---|
| HID payloads · run-on-plug | ● | ● | partial | ● |
| Wi-Fi suite (portals, beacon spam, handshakes) | ● | ● | add-on | — |
| NFC read / write / emulate | ● | ● | ● | — |
| Sub-GHz capture & replay | ● | ● | ● | — |
| Infrared library + capture | ● | ● | ● | — |
| Browser control (zero install) | ● | ● | — | — |
| Modular firmware · user modules | — | ● | — | — |
| Hardware expansion (I²C / GPIO) | — | ● | — | — |
| MITM workflow (bettercap host) | ● | ● | — | — |
| One device · one battery | ● | ● | ● | ● |
AetherKey is a security testing and research tool, like a lockpick set for the digital world. Using it against systems you own or are explicitly authorised to test is legal in most jurisdictions; using it against other people's systems is a crime, and the device's hash-chained engagement log makes your authorisation posture auditable. Region-locked radio tables keep transmissions within local regulations. We refuse to implement pure-interference features (jamming) at all.
The hardware is identical — same radios, same battery, same shell. The difference is permission: Regular runs only factory-signed firmware, has no user module loading, and its expansion pads are unpopulated. Pro ships with the pads populated, the bootloader unlocked by owner action, AetherSDK included, and access to the community module registry. Pro is for people who want to write their own code; Regular is for teams that want a predictable, always-known-good device.
Android gets the full companion app (BLE). Everything else — iPhone, iPad, Windows, macOS, Linux, ChromeOS — gets the web panel, which works over Web Bluetooth (Chrome/Edge/Android) or over Wi-Fi by joining the access point the device hosts. No installs, no accounts, fully offline.
Yes — the payload engine is DuckyScript-compatible, so the existing community corpus runs unmodified. AetherKey adds extensions (OS fingerprinting, conditional stacks, Wi-Fi exfil, BLE logging, humanised jitter) that classic duckys can't execute.
It captures PMKID and EAPOL handshakes to PCAPNG on the microSD. Cracking runs offline on a real GPU/computer — the companion app exports captures straight to your cracking workflow. This mirrors the Marauder project's proven approach.
Roughly 12 hours of active mixed use (payload runs plus periodic scanning), about 72 hours standby on the 1900 mAh cell, with a hardware RF kill switch that removes transmitter power entirely. Full recharge over USB-C in ~2.5 hours.
Legibility and power. 128×64 monochrome reads perfectly in direct sunlight, draws almost nothing, and gives the UI a crisp datasheet aesthetic. The colour second screen is your phone.
The firmware source, module API, schematics and board files are available to Pro owners under a source-available licence (non-commercial redistribution). You can rebuild the entire firmware from scratch, and AetherSDK gives you the same module interface the factory firmware uses. Stock tooling on both editions receives OTA updates from the signed channel.
