An industrial-grade RF penetration platform built on a Raspberry Pi Zero 2 W with an ESP32 attack co-processor. Wi-Fi karma, deauth, evil twin, captive portal, Sub-GHz capture/replay, NFC, IR, all driven wirelessly from your phone — wherever you are in the world.
SOURCE SEALED · LAUNCHING ON KICKSTARTER · JUNE 26, 2026
Two radios. One mind. Pi handles brains, ESP32 handles attacks.
Wi-Fi attacks, captive portals, and Sub-GHz replay are illegal against systems you don't own or have explicit written permission to test. The Jail is built for security research, your own gear, and authorized engagements. Don't be a dick.
Live, in-flight, and on the roadmap.
Real Wi-Fi scan output from a working rig (no simulator).
Setup is sealed under embargo until launch.
Pi setup wizard, ESP32 web-flasher, install scripts, hardware blueprint, and the companion app are all sealed until our Kickstarter goes live. Backers get the full kit on launch day.
Want early-access? DM us — limited founders' tier available before Kickstarter goes live.
What's done, what's next, what's dreaming.
Quick answers.
Flipper Zero is great for short-range RF / NFC / IR tinkering, but it's hardware-locked, has a tiny screen, and you can't drive it from across the planet. The Jail is a Pi Zero 2 W + ESP32 in a custom enclosure that runs your favorite Flipper-style attacks AND adds: real packet injection (deauth/beacon flood), captive portal credential capture, full Wi-Fi station, network reconnaissance, and remote control over a cloud relay or BLE — all from a phone app.
The Pi Zero 2 W has one Wi-Fi radio, and that radio can only do ONE of these at a time: be a station (connected to your home Wi-Fi), be an AP (Karma/Evil Twin), or be in monitor mode (sniffing). Running attacks on the Pi's radio kicks the Pi off your Wi-Fi and breaks the relay. The ESP32 is a dedicated second radio that handles all attacks while the Pi stays online to manage the bridge.
Required: Raspberry Pi Zero 2 W (with 40-pin headers), micro-SD card (8 GB+), 5 V/2.5 A power supply, Freenove ESP32-WROOM (or any ESP32 dev board), Micro-USB OTG adapter, USB cable. Optional: TSOP4838 IR receiver, 940 nm IR LED, CC1101 module (Sub-GHz), PN532 module (NFC), Pi Camera.
Owning the device and running it against your own gear is legal everywhere I know of. Running deauth, evil twins, or captive portals against networks/devices you don't own is a serious crime in most jurisdictions (CFAA in the US, similar laws elsewhere). Use The Jail only on equipment you own or have explicit written authorization to test.
The cloud relay is a tiny FastAPI server with a WebSocket endpoint. You can self-host it on any $5/month VPS (Hetzner / DigitalOcean / OVH), or use the public preview backend during early development. The Pi-side and ESP32-side code is yours forever — once you self-host the backend, there's no ongoing cost.
No, and that's by design. The captive portal serves its own HTTP page (not a clone of an HTTPS site). Any modern browser will refuse to send credentials to an HTTP form pretending to be google.com. The portal works because phones auto-pop a "Sign in to Wi-Fi" sheet over HTTP when they detect a captive network — and victims voluntarily type into that sheet.