🐷BBoink
ESP32 · WiFi handshake & PMKID capture

BBOINK: The pocket
handshake hunter.

BBoink channel-hops, deauths eligible APs, and captures WPA 4-way handshakes and PMKIDs — then gets them cracked in the cloud and shows you the password + a join QR. Drive it on the device with buttons + a menu, or entirely from your phone over Bluetooth. One firmware, five boards.

⚡ Flash firmware Download firmware BBoink web portal
wpa-secOnlineHashCrack PwnCrackno access point BLE phone portal2.4 + 5 GHz

Transmits deauth frames to force handshakes. Use only on networks you own or are explicitly authorized to test.

CAPTURE sd----100%
SCANNING
ch:01 nets:0 pkts:213 mgmt:18
work: 4 cool: 0 idle: 4
cap: 2 ign: 0 pmf: 2 weak: 5 open: 2
handshakes: 0   pmkid: 0
last: -
deauth: 0   tx: 0 / 0
target: -
clients: 0
back: stop & exit
Live capture
On the device

It shows exactly what it's doing.

No app to install for day-to-day use — the board's colour screen is the interface. These mockups are rebuilt from the firmware's own drawing code, event colours and all.

CAPTURE sd----96%
DEAUTHING
ch:06 nets:19 pkts:24102 mgmt:8140
work: 4 cool: 0 idle: 4
cap: 2 ign: 0 pmf: 2 weak: 5 open: 2
handshakes: 1   pmkid: 0
last: NETGEAR-2G
deauth: 512   tx: 2048 / 2100
target: NETGEAR-2G  -47dBm
clients: 3
back: stop & exit
Capture
BBoink sd----82%
CAPTURE
CAPTURE TARGETED
BLE BRIDGE
WPASEC SYNC
OHC SYNC
PWNCRACK SYNC
CAPTURES
STATS
OPTIONS
v
turn: move   click: open
Menu
CAPTURES sd----82%
>> ADD IGNORE (scan)
C  W   HOME-5G_2.4
CM WPK NETGEAR-2G
C      Ziggo1F4A2
C  P K FRITZ!Box7590
M      Telenet-Guest
C/M cap/man  W/O/P up  K crk
Captures list
OHC UPLOAD SDHOME-5G88%
hashes 12
new 3  skip 9
OK
back: return
Cloud crack sync
NETWORK sd----80%
HOME-5G_2.4
a4:2b:8c:11:9f:03
captured
seen: 2026-08-31 14:22
up wpa:y ohc:n pwn:y
PW: hunter2isweak
> SHOW WIFI QR 
  DELETE (forget)
turn: pick  click: do  back: return
Cracked network results
BLE BRIDGE
phone connected
files 3   cracked 1
open on phone:
https://whitewhidow.github.io/bboink/bridge/
relay:
https://bboink.onrender.com
exit to capture
BLE bridge (optional)
One firmware · five boards

Runs on hardware you can buy today.

Off-the-shelf ESP32 dev boards with a screen. Pick your control style: buttons + on-device menu, or Bluetooth-only from your phone.

LilyGo T-Embed CC1101
buttons + BLE

LilyGo T-Embed CC1101

ESP32-S3 · 16 MB · encoder + button
Buy →
LilyGo T-Display C5
buttons + BLE

LilyGo T-Display C5

ESP32-C5 · dual-band 2.4/5 GHz · 2 buttons
Buy →
Waveshare ESP32-C5-LCD-1.47
BLE only

Waveshare ESP32-C5-LCD

ESP32-C5 · dual-band · 1 button
Buy →
Cardputer ADVM5Stack
BLE only

M5Stack Cardputer ADV

ESP32-S3 · 8 MB · 1 button + LCD + microSD
Buy →
T-Dongle S3LilyGo
BLE only

LilyGo T-Dongle S3

ESP32-S3 · 16 MB · 1 button + 160×80 LCD
Buy →
What it does

A capture rig, not a toy.

01 · FLASH

Browser USB flasher →

Install or update from Chrome/Edge over USB — pick a board and version, click Install. No esptool, no drivers.
02 · CAPTURE

Channel-hopping engine

Sweeps 2.4 and 5 GHz, deauths eligible APs to force reconnects, and grabs EAPOL 4-way handshakes and PMKIDs — with live per-event stats.

03 · CRACK

Cloud cracking

Captures reach wpa-sec, OnlineHashCrack and PwnCrack — directly over the board's own WiFi, or through one small relay you host that fans them out and merges the results.

04 · RESULT

Password + join QR

Cracked passwords are written back to the device and shown on the capture, with a scannable WIFI: join QR.

05 · KEEP

Registry & excludes

Every network is remembered by SSID even after you delete the capture — so it stays listed, and never-attack excludes stick across radios and reboots.

06 · CONTROL

BLE phone portal

A web page over Bluetooth configures and syncs the board — no access point, no board WiFi uplink. It's the entire UI on the single-button boards (Waveshare, Cardputer ADV, T-Dongle S3).

How it works

Capture → crack → password back.

Grab handshakes on the device, get them to the crackers, and the recovered passwords land right back on the board. There are two ways to reach the crackers.

Device

Capture

handshakes + PMKIDs

──▶
Upload

Direct · or relay

board WiFi, or your phone via a relay

──▶
Cloud

Crackers

wpa-sec · OHC · PwnCrack

Direct — a button board uploads straight over its own WiFi; nothing else to set up. Relay (optional) — a small host you deploy once lets the board hit a single endpoint that fans out to all three services and merges results, and lets your phone sync the board over Bluetooth (the only way on the single-button Waveshare / Cardputer ADV / T-Dongle S3). Cracked passwords flow back either way.

Cracking options

Cloud services — or crack it yourself.

All free. A key from any one cloud service is enough to start — or skip the cloud and crack the hashes yourself, offline.

WPA-SEC

wpa-sec →

Stanev's community distributed WPA cracker. Free; BBoink uploads the .pcap and reads back the cracked passwords.
OHC

OnlineHashCrack →

GPU cracking service with a free tier and an API — BBoink submits WPA 22000 hashes.
PWNCRACK

PwnCrack →

Free handshake cracking service — BBoink uploads hc22000 and reads back the cracked passwords.
LOCAL

Crack it yourself →

No account, fully offline — download the hashes from the BLE portal and run hashcat -m 22000 on your own machine.

Flash a board in two minutes.

Plug in over USB, open the flasher in Chrome or Edge, pick your board, click Install.

⚡ Open the web flasher Read the docs