Specter is a Flipper Zero app that detects powered NFC readers by listening for the radio frequency field they emit at 13.56 MHz, according to its developer, Kailash Parshad. The tool reads the hardware external-field detector on the device’s onboard ST25R3916 chip—the same circuit that lets the device emulate cards—hundreds of times per second while keeping its own transmitter dark.
How Specter Measures Radio Fields Using Flipper Hardware
The application determines proximity through duty cycle measurement. Over a short observation window, the app calculates what fraction of the time a carrier signal is present, smooths the output, and displays it as a percentage value called FIELD %.
When a reader rests directly against the device case, the meter pegs. When a slow-polling reader sits across a room, the app registers a slight nudge on the scale. Operators can adjust a sensitivity control to raise or lower the noise floor, allowing them to hunt for faint distant fields or isolate strong readers positioned nearby. Physical contact triggers a magenta LED flash and a vibration pulse, enabling pocket-based sweeps where the proximity strip progresses through FAINT, NEAR, CLOSE, and STRONG states.
Frequency Limitations and Blind Spots
The 13.56 MHz operating band creates clear operational boundaries. Specter detects the NFC frequencies utilized by contactless payment skimmers, most current access readers, transit gates, and hotel locks. However, older 125 kHz access control infrastructure—such as legacy HID Prox and EM4100 door panels—remains entirely undetectable because the Flipper’s low-frequency hardware path lacks an equivalent field-detect bit.
Did you know? Specter seizes control of the Flipper Zero NFC radio for the entire duration of a sweep. Users must close any other active NFC applications on the device before launching a scan.
Furthermore, detection is not absolute. Certain payment skimmers remain dormant until a physical card approaches to wake them up, while others operate behind physical shielding. “Absence of a reading isn’t a guarantee of absence,” creator Kailash Parshad said regarding the limitations of passive field sensing.
Installation and Future Development Roadmap
Users can install the tool by utilizing qFlipper to drag the application file directly into the apps/NFC directory on the device SD card. Advanced users can also build the application from source code using ufbt and a USB connection. The software is distributed free of charge on GitHub.
The project roadmap outlines several upcoming features for future updates. Planned additions include a timestamped detection logbook written directly to the SD card, a screen-off buzzer-only sweep mode, and experimental coil-based low-frequency sensing capabilities.
Pro Tip: Always verify that competing NFC background apps are fully terminated before initiating a sweep to prevent radio resource conflicts on your device.
Frequently Asked Questions
What frequencies does Specter detect?
Specter detects powered NFC readers operating at the 13.56 MHz frequency band.
Does Specter detect older 125 kHz door locks?
No. Older 125 kHz systems like legacy HID Prox and EM4100 panels remain outside its detection range because the Flipper Zero low-frequency path lacks a field-detect bit.
Where can users download the application?
The tool is available for free download on GitHub and can be installed via qFlipper or built from source using ufbt.
Is an empty reading proof that no skimmer is present?
No. According to creator Kailash Parshad, some skimmers remain dormant until activated by a card, while others use physical shielding.
Related reading