We advertise 100 kHz as the lower edge of HackRF Pro’s operating frequency range, but that isn’t a hard limit. While working on the design, I realized that it should work fairly well to pick up longwave time signals such as WWVB, broadcast at 60 kHz from Colorado, USA.

WWVB provides a stable frequency reference and time code. If you have a radio-controlled clock in North America, it probably uses the signal from WWVB to maintain the correct time. WWVB can also be used to discipline a laboratory frequency standard, eliminating the need for a local atomic clock in many cases.

Why use WWVB?

Nearly every electronic device contains some sort of oscillator or clock. HackRF Pro, for example, contains a temperature-compensated crystal oscillator (TCXO) which is better than the crystal oscillator (XO) used in HackRF One. Having a better internal clock means that radio frequencies received or transmitted by the device are more accurate. If I receive a radio signal at 1 GHz with HackRF One, I can’t be sure if the signal over the air is at exactly 1 GHz. The received frequency as detected by HackRF One might be 10 or 20 kHz off. With HackRF Pro the frequency uncertainty is an order of magnitude smaller, thanks to the built-in TCXO. I would be confident that any inaccuracy at 1 GHz is no more than about 1 or 2 kHz, even without performing any calibration.

I need to use an even better clock in my lab to be certain that the oscillators in our products perform as expected. I could use a HackRF Pro to measure the frequency error of a HackRF One, but how do I know I can trust the HackRF Pro? I would need a more trustworthy frequency reference such as an atomic clock. A good alternative to an expensive atomic clock would be an oven-controlled crystal oscillator (OCXO) that has been recently calibrated or that is disciplined by a remote atomic clock.

One such remote frequency reference is WWVB which has several orders of magnitude less frequency uncertainty than the TCXO in HackRF Pro. WWVB also provides a digital time code indicating the time of day.

Why not a GPSDO?

Folks like me who need a lab frequency standard typically turn to a GPS disciplined oscillator (GPSDO). I could purchase an off-the-shelf GPSDO that disciplines an internal OCXO with a signal received from GPS (or other GNSS) satellites. Such a device would cost a few hundred dollars, much less than the thousands of dollars required to buy a small atomic clock.

Before GPSDOs became available, some test equipment manufacturers sold WWVB disciplined oscillators, but these products are no longer made. They had already become unpopular before the broadcast format of WWVB was changed in 2012 with the introduction of phase modulation that broke compatibility with commercial oscillators. There is no reason that a new WWVB disciplined oscillator could not be made. In fact, many hobbyists have made their own or have modified older oscillators to make them compatible with the new phase modulation.

I like the idea of having my own WWVB disciplined oscillator, partly because a GPS receiver needs an active antenna placed somewhere with a view of the sky whereas a WWVB receiver can be located indoors. I like that a WWVB receiver can have a relatively simple design and does not need to constantly track multiple moving satellites. I like that WWVB is stable and will not be adversely affected by Kessler syndrome.

I like that a WWVB receiver implementation with HackRF Pro can be used to directly measure the frequency error of the HackRF Pro itself by simply measuring how far off from 60 kHz WWVB appears to be. I don’t even need to build a whole WWVB disciplined oscillator to do this. (In theory I could do the same thing with GPS, but it would require significantly more complex software.)

Most of all, I think that receiving WWVB is a fun project!

An active antenna for 60 kHz

Radio antennas are generally sized in proportion to wavelength, and the wavelength at 60 kHz is very long, about 5000 m. A vertically polarized quarter-wave monopole antenna for 60 kHz would be the tallest structure in the world! To avoid such an impractical construction, the WWVB transmit antenna has a more complex design. Although small compared to the wavelength, the broadcast antenna is comprised of hundreds of meters of cable and multiple towers.

WWVB receivers use small loop antennas which detect changes in the magnetic field. Several amateur radio operators have constructed air core loop antennas for WWVB with diameters of one to two meters while radio-controlled clocks use much smaller ferrite core (“loopstick”) antennas. I thought it would be fun to build a small active loopstick antenna that is compatible with HackRF Pro.

For my initial experiment, I pieced together a few RF amplifier and filter test PCBs and connected them to a loopstick antenna pulled from an AM radio kit. I used a VNA to tune the antenna for 60 kHz with a parallel capacitor. With two amplifier ICs (which I had previously tested for the URTI project) and a low-pass filter, I was barely able to detect a faint signal at 60 kHz one afternoon using a HackRF Pro. Later that evening the signal was stronger and easily identifiable as WWVB. I live in Ontario, Canada, over a thousand miles away from WWVB, and I think it’s pretty nifty that I could pick up the signal from such a long distance on my first attempt!

Based on this success, I designed Teewee, an active loopstick antenna named for (the popular name of) the similarly shaped Tetris block. Teewee consists of a small PCB that performs amplification and filtering, a hand-wound ferrite core, and a 3D-printed enclosure. While my initial experiment required an external power supply, Teewee is powered by HackRF Pro’s built-in bias tee.

Inspired by an older design, I used an instrumentation amplifier for Teewee’s first stage. The purpose of this is to isolate the magnetic field (which is seen by the amplifier as a differential signal) from the electric field (which is seen as a common-mode signal). Instrumentation amplifiers have high common-mode rejection, eliminating much of the electric field noise that likely originates locally.

My first test with Teewee was disappointing. I detected WWVB not at all, instead picking up pulses of broadband noise. After a frustrating couple of days, I decided to reproduce my original setup and found that it had the same poor result! The reason was that I had recently rearranged my lab and had placed my PC tower on my desktop, close to the antenna test area. While Teewee is designed to reject electric field interference, it is highly sensitive to magnetic interference, something my PC evidently produces quite a bit of. Fortunately, I was able to eliminate this near-field interference by moving the antenna just half a meter farther away from the PC.

After solving the near-field problem, I found that Teewee actually performed quite well. While my original setup was useful only during periods of favorable ionospheric propagation at night, I was able to pick up WWVB at any time of day with Teewee.

Observing the WWVB signal

A distinguishing characteristic of WWVB is that the very precise carrier frequency of 60 kHz turns off and back on once per second with varying pulse duration. With most receivers it looks like on-off keying (OOK), but it is actually amplitude-shift keying (ASK) where the “off” periods are 17 dB lower power than the “on” periods. At times when propagation is good, I can barely detect the signal during the “off” periods with Teewee.

Pulse width modulation (PWM) carries time of day and other status information in 60-second data frames. The falling edge of each pulse occurs at the start of each second. Once every ten seconds there is an extra-long “off” period. This pattern makes it easy to identify the signal when there is sufficient signal-to-noise ratio to observe the modulation.

Since 2012 the phase of each pulse carries a second data stream. The last time I experimented with WWVB was prior to 2012, so I hadn’t observed the phase modulation before. The phase modulation is binary phase-shift keying (BPSK) at one bit per second with the phase transition happening 0.1 seconds into the “off” period. Using a derived phase plot in inspectrum I was able to see the phase abruptly change from one pulse to the next.

In theory, the BPSK modulation makes it possible to implement a receiver capable of detecting a weaker signal than can be achieved with an ASK receiver, particularly once per hour when the BPSK stream carries an extended symbol sequence that lasts 6 minutes and includes a fixed 106-bit synchronization word. I think it would be interesting to try detecting this “medium mode” from farther away, maybe even on another continent.

When using WWVB as a frequency reference, the digital modulation can be ignored except that the detector (software, in my case) must be designed to tolerate BPSK.

Measuring Doppler shift with WWVB

Shortly after getting Teewee working, I traveled to British Columbia, so I decided to try picking up WWVB on my flight across Canada, hoping that I would be able to see the Doppler shift from the motion of the aircraft relative to the transmitter. I found that I was unable to detect the signal with the antenna at my seat in the aircraft but that I could pick it up by placing Teewee in a window, connected to a HackRF Pro by an SMA cable. I captured the signal from WWVB for a full hour while the aircraft headed west, starting from a point roughly north of the transmitter.

I analyzed the hour-long capture and found that the Doppler shift was, in fact, evident when plotting the received WWVB frequency over time. About halfway through the capture, the aircraft changed course, and this caused an abrupt change of frequency that clearly confirmed that I really was seeing the Doppler effect.

As further confirmation, I later downloaded ADSB flight data and used it to plot the expected Doppler shift. This correlated quite well with the WWVB observations. Apart from some blips due to interference, the primary discrepancy between the expected and observed Doppler shift was an offset of 15 mHz due to the HackRF Pro TCXO being 250 ppb slow. (This TCXO was better than average. I typically see frequency error of approximately 1 ppm.)

I had hoped to acquire an even longer capture on the return flight to Ontario, but there was too much interference, perhaps from avionics or from a jet engine. This was on a smaller aircraft, and I was seated at the front edge of the wing, adjacent to an engine.

Try it yourself

I’ve published the Teewee design for anyone who would like to build their own. Teewee is intended for use with HackRF Pro, but I’ve also had some limited success with HackRF One even though it has significantly worse 60 kHz performance than HackRF Pro.

Since our previous timeline update, we have encountered additional unexpected delays in our production progress. These delays are the result of a necessary hardware revision to account for MacOS users. During late stage testing, our team encountered issues with USB signaling on Mac devices, and while able to find potential workarounds, agreed that the next step would be to modify the PCB design to address this issue. HackRF Pro will ship as r1.2.1, our final revision. We decided that this revision was imperative to ensure that all users could have an equal user experience with HackRF Pro, regardless of operating system.

As a result, our new projected shipping window is December 2025.

We appreciate the patience and support we have received during this exciting transition period for Great Scott Gadgets. While another board revision was not in our original plans, we are confident in our decision to prioritize quality and user experience over meeting our original deadline.

Learn More:

Visit the HackRF Pro product page for full specs and reseller pre-order links. The open source design, migration guide, and user documentation will be published prior to initial shipment. We invite you to join the discussion in the #hackrf channel on our Discord server!

The belated June 2025 recipient for the Great Scott Gadgets Free Stuff Program is Ashen Chathuranga, a university student from Sri Lanka. He is working on a project involving the development of an open source satellite monitoring station and requested a HackRF One to conduct his research. He will also be researching radio wave penetrating materials for his university. Being able to assist students in need of equipment for academic research and goals is one of our primary goals for our Free Stuff Program, so we are happy we were able to help Ashen out!

The belated July 2025 recipient for the Great Scott Gadgets Free Stuff Program is Murat Sever, a professor from Turkey who teaches at TOBB ETU University and recently ran a workshop titled “Simple Replay Attack Demo with GNU Radio.” In this workshop, Murat utilized several open-source software and hardware tools to demonstrate how to receive and transmit RF signals. Workshop participants then used SDR and GNU Radio to perform replay attacks with the captured radio signals. We sent a handful of HackRF Ones to Murat for participants to learn and experiment with in this workshop. He has also informed us that the HackRF Ones will be put to use in the course he is teaching this fall on SDR applications! We are glad that we could continue to support Murat’s efforts to educate others about the capabilities of software defined radio and wish him and his students best of luck with their fall term!

The belated June 2025 recipient for the Great Scott Gadgets Free Stuff Program is Joe Caton from the United States! Joe has requested a HackRF One for his senior project. He has the opportunity to work with a local wildlife preserve and assist them in an ongoing project to track and study the behavior of the large population of eastern box turtles nearby. Joe will be aiding the nature center in developing quality, low cost alternatives to their current tracking technology. He plans to refine their current VFH tracking modules and implement HackRF One into a more compact system that will enable image recognition capability in the field to identify specific turtles. He hopes that this could lead to similar systems being replicated for other wildlife preserves and contribute to an open source repository so foundations with less funding can have access to accurate and successful DIY monitoring systems. We are looking forward to hearing about the progress and outcome of Joe’s project and excited to assist in this unique application of our hardware!

The belated May 2025 recipient for the Great Scott Gadgets Free Stuff Program is Nagamani C Gunjal, a university student who has requested a HackRF One for an academic project that involves research and demonstration of real-world vulnerabilities in consumer and commercial drones by analyzing and manipulating radio communication protocols. Her focus is on ethical hacking and the security testing of drones that operate using RF signals, specifically targeting control signals transmitted between the radio transmitter and onboard radio receiver module of the drone. This project is part of a broader study on UAV (Unmanned Aerial Vehicle) security with an ultimate goal of proposing and implementing improved countermeasures for secure UAV communication. She has told us that the requested device will be essential for capturing, decoding, and replaying drone communication signals in controlled environments for testing purposes!

The belated April 2025 recipient for the Great Scott Gadgets Free Stuff Program is Ashen Chathuranga from Sri Lanka! Ashen is a university student who plans to use the HackRF One we are sending him for multiple academic projects, including an open source satellite monitoring station and researching radio wave penetration. We are glad we could provide Ashen with equipment to further his education and support his academic journey!

The belated March 2025 recipient for the Great Scott Gadgets Free Stuff Program is Mrinal Kumar from India! Mrinal is currently running a small, free cybersecurity learning group for young adults aged 18-21 who come from financially limited backgrounds. Currently, there are about 15 students who actively participate in regular meetings to study the fundamentals of cybersecurity, ethical hacking, and responsible digital security practices.

We will be sending Mrinal and his students a HackRF One so he can introduce them to software-based cybersecurity and the world of wireless and RF security. He tells us that they will explore signals, learn about vulnerabilities in everyday wireless systems, and will safely demonstrate examples of real world attack and defense scenarios. His vision of providing accessible, hands-on learning for students who would not otherwise have an opportunity to dive into the world of open source hardware and software defined radio aligns pretty perfectly with ours! We are excited to see what Mrinal and his students accomplish and discover with their new equipment.

Since our June announcement, we’ve made substantial progress toward the HackRF Pro launch, and we’d like to share an update on the project timeline.

Progress So Far:

• All of the production parts that we expected to have a long lead time (which were ordered months in advance of our initial announcement in June) have been delivered to our contract manufacturer.
• We completed two additional hardware revisions to improve RF performance. We are now on HackRF Pro r1.1.1, which we anticipate will be the final revision. If there are further changes, they will be minor and will not include a PCB layout change.
• We delivered production files to our manufacturer in mid-July 2025.
• All other parts for production have been purchased.
• Sample PCBs have been ordered for RoHS and internal testing and are expected to be assembled and shipped by next week.
• Tooling for the final enclosure is in progress.
• Packaging design should be finalized by the end of the month.

Updated Timeline:

One critical component, the crystal oscillator, came with an unexpectedly long lead time. There is no drop-in alternative with a shorter lead time. As a result, SMT is delayed, and we’ve adjusted the expected date of first shipments of HackRF Pro to our resellers from September 2025 to the end of October 2025.

We appreciate our community’s patience and support as we work to ensure HackRF Pro meets the highest performance standards possible before shipment. With production underway and all parts secured, we are confident that the updated end-of-October shipping target is achievable!

Learn More:

Visit the HackRF Pro product page for full specs and reseller pre-order links. The open source design, migration guide, and user documentation will be published prior to initial shipment. We invite you to join the discussion in the #hackrf channel on our Discord server!

This post is a collection of some of the first questions asked by the community about HackRF Pro shortly after we announced it. Questions were asked by folks across our various social media accounts and in our Discord server. The answers given here are expanded versions of how the folks on our team responded to the public question we observed.

Why is it called HackRF Pro and not HackRF Two?

We felt that “Pro” expressed the idea that this is a refinement of the HackRF One design and that “Two” would more likely be interpreted as a revolutionary design. Our goal was to make a better HackRF One, not to make something as revolutionary as HackRF One was when it was new. We did consider “10”, “360”, and “Tau”.

What is the baseband bandwidth of HackRF Pro?

In normal operation, HackRF Pro supports up to 20 Msps with 8-bit I and Q samples over USB, just like HackRF One. Internally, HackRF Pro uses a sample rate of up to 40 Msps with decimation and interpolation performed in an FPGA. At lower USB sample rates HackRF Pro supports an extended-precision mode with 16-bit samples and an effective number of bits (ENOB) of 9 to 11, depending on the sample rate. We’re also developing a half-precision mode that uses 4-bit samples at up to 40 Msps over USB.

Some tools allow tuning up to 7.25 GHz with HackRF One. Is the limit of 7.1 GHz on HackRF Pro correct or just “suggested”?

7.1 GHz is the highest tuning frequency that should work reliably with HackRF Pro. You can try tuning up to 7.25 GHz, but it may fail (as may HackRF One). Unlike HackRF One, the performance of HackRF Pro up to 7 GHz is pretty good. HackRF One is quite lossy above 6.1 or 6.2 GHz.

Will there be different host tools and libraries for interacting with HackRF One vs. HackRF Pro?

We’re adding features to libhackrf and hackrf-tools. In the future, there may be some software specially written for HackRF Pro, but we anticipate that most software will continue to support any HackRF (including Pro, One, Jawbreaker, and rad1o). Backward compatibility was our primary goal for HackRF Pro. We tried hard to find ways to enhance the HackRF One design without radical changes to the architecture that would make compatibility difficult.

Will the hardware design be published online before this starts shipping?

Yes, like all of our electronic designs, we will publish the entire hardware design under an open source license online before shipping HackRF Pro. Our mission at Great Scott Gadgets is to put open source tools into the hands of innovative people.

Does that mean no more cracking the case open to set up triggers?

That’s right! Both CLKIN and CLKOUT can be configured to connect internally to either the trigger input or trigger output signal.

Is HackRF Pro compatible with Portapack H4M ?

Yes, we’ve tested with H4M and a few other PortaPacks, including the original PortaPack H1 from ShareBrained Technology. To the best of our knowledge, HackRF Pro is compatible with all PortaPacks; however, we can’t guarantee this.

Will Opera Cake be improved so that it can take full advantage of HackRF Pro’s frequency range?

A new revision of Opera Cake is likely, but we are not working on it yet.

How is RF port protection enhanced on HackRF Pro?

HackRF Pro has the same reverse current protection diode on the RF port bias tee that is present on newer revisions of HackRF One. This has been quite effective in improving amplifier robustness in HackRF One r9 and r10. In addition to over-voltage protection provided by the diode, the bias tee on HackRF Pro features over-current protection. HackRF Pro has new amplifiers, replacing the obsolete part on HackRF One. ESD protection has been enhanced on HackRF Pro, and the RF port is also protected from high RF power by a PIN-Schottky limiter.

Will HackRF Pro be suitable for classroom use?

Yes. We even added a little feature with classroom use in mind: It is possible to hardware-disable transmit mode by cutting one trace on the PCB.

Do you have any projects in mind for the extended frequency range of HackRF Pro?

We’re excited to try HackRF Pro with new very low power (VLP) devices that operate in the 6 GHz band. We’ve already had success receiving WWVB at 60 kHz.