HackRF One on Android: everything you need to start surveying

Consentiva turns an Android phone into a walking spectrum analyzer with one piece of hardware: a HackRF One software-defined radio. This guide covers what to buy, how to connect it, how to set the gain so your readings mean something, how to recognise the receiver's own artefacts, and how to fix the problems people actually run into on the street.

What the HackRF One is, and what it isn't

The HackRF One is a small open-source software-defined radio made by Great Scott Gadgets. It tunes from 1 MHz to 6 GHz. Inside, it converts a slice of radio spectrum (up to about 20 MHz wide at a time) into a stream of digital samples and sends them over USB. Software on the other end decides what to do with them.

Consentiva uses the HackRF as a sweeping receiver. It tunes to one frequency, grabs a short burst of samples, works out how much energy sits in each small slice of that chunk, then hops to the next chunk. Stitch enough chunks together and you get a spectrum from, say, 70 MHz to 2.7 GHz. Repeat that while you walk, tag each sweep with GPS, and you have a map of what the radio environment looked like along your route. Our spectrum analyzer explainer covers the idea from first principles.

Three things are worth knowing before you buy:

• It isn't a calibrated instrument. Out of the box, levels are in dBFS (decibels relative to the converter's full scale), not dBm. That's fine for comparing one walk with another, as long as your settings stay the same. If you want approximate dBm, Consentiva lets you enter a calibration offset. The RF units guide explains the difference.
• Its converter is 8-bit. That limits how strong and how weak a signal it can show at the same moment. The theoretical range of an 8-bit converter is about 48 dB. Clever processing helps, but a very strong signal nearby will still squeeze out weak ones. This is why gain matters so much.
• It can transmit, but Consentiva never does. The HackRF is a transceiver. Consentiva only puts it in receive mode.

What to buy

The full kit is small: the radio, an antenna, a cable, and optionally a power bank. The table summarises it; the sections below explain the choices.

The HackRF One itself

Buy from a reseller listed on the Great Scott Gadgets website. Expect to pay about $350. Clones exist and some work, but their filters, oscillators and shielding vary. If a clone has a problem, you can't tell whether you're looking at a real signal or the board, and no one can help you find out. For a tool whose whole job is telling you what's unusual, a predictable receiver is worth the money.

Check what's in the box when it arrives. Most units ship with a case and a USB cable, but that cable usually has a full-size USB-A plug for a computer, which won't fit your phone. Some resellers bundle an antenna; many don't.

Antennas

The HackRF's ANTENNA port is a female SMA socket. You need an antenna with a male SMA plug: a centre pin inside a threaded collar. Beware RP-SMA ("reverse polarity"), common on Wi-Fi gear. It screws on happily but has no centre pin, so nothing connects and the spectrum looks dead.

Two practical choices for walking:

• ANT500. Great Scott Gadgets' own telescopic antenna, designed for roughly 75 MHz to 1 GHz. You can extend or shorten it. It still picks up higher frequencies, less efficiently. It's long when fully extended, which is awkward on a crowded sidewalk.
• A small wideband whip. Compact antennas sold for wide frequency ranges (often quoted as covering several cellular and Wi-Fi bands) are easier to carry and steadier because they don't flop about. They're usually weaker at the bottom of the range, such as FM broadcast.

The section on antenna choice by band, below, explains how to pick between them for a particular survey.

The cable or adapter

This is where most first-day problems come from. Your phone has a USB-C port; the HackRF has a micro-USB port. You need a cable or adapter with USB-C on the phone end and micro-USB on the HackRF end, and it must carry data. Many cheap cables only contain the two power wires. The HackRF's lights come on, which looks like success, but Chrome never sees the device.

• Look for "OTG", "data" or "sync" in the description.
• Prefer short cables. Every extra length of thin wire drops voltage, and the HackRF draws a fair amount of current.
• A one-piece cable is more reliable than a stack of adapters. Each joint is a place for a loose fit when you walk.
• Older phones with micro-USB ports need a micro-to-micro OTG cable instead. Most current phones are USB-C.

Power bank

The HackRF draws roughly 500 mA from the phone's USB port. At 5 volts that's about 2.5 W, on top of the phone running its screen, GPS and Chrome. A one-hour walk is usually fine on a charged phone. For longer walks, carry a power bank.

There are two ways to use it. The simple way is to top the phone up between walks. The other is a powered OTG adapter, which has a separate charging input so a bank can feed the phone and HackRF while the HackRF is connected. Not every phone accepts charging and OTG at the same time, so test one at home before relying on it.

Worked example: a bank labelled 10,000 mAh usually means 10,000 mAh at the cell's 3.7 V, about 37 Wh. After conversion losses you get less than that at the USB port, but even a generous allowance leaves many hours of HackRF power. In practice the phone, not the radio, decides how long you can walk.

Carrying it

Your body absorbs and blocks radio signals, especially at higher frequencies. A HackRF in a back pocket sees a different street from one held at chest height. Choose a carry method you can repeat every time: a pouch on a shoulder strap, a lanyard, or a small bag with the antenna poking out of the top. Keep the antenna vertical, since most of the signals you'll survey (cellular, broadcast, two-way radio) are vertically polarised or close to it.

Is your phone compatible?

Consentiva drives the HackRF through Chrome's WebUSB feature. There's no app to install. That means your phone needs three things:

1. Android with USB OTG (host) support. Most current Android phones have it. OTG means the phone can act as the USB host and power a device, like a computer does.
2. Google Chrome, kept up to date. Other browsers may not support WebUSB; Firefox, for example, doesn't. Use Chrome even if it isn't your everyday browser.
3. GPS and a microphone that Chrome can access, for locating sweeps and recording voice marks.

Test OTG before you buy anything else. Plug in a USB flash drive or keyboard through an OTG adapter. If the phone reacts, OTG works. Some phones have an OTG switch in their settings, and on some it turns itself off after a period without use. If yours has one, turn it on before each walk.

iPhone: Apple doesn't allow web pages to talk to USB devices, so an iPhone can't drive the HackRF. On an iPhone you can still sign in with your passkey, log marks with GPS, and read your reports. Choose No receiver - marks & GPS only as the receiver.

Two phones: if you have a spare Android phone, a one-time link can connect it as a linked phone. Walks recorded on it go into your account, under your plan, without signing in on that device. That lets you leave a dedicated survey phone attached to the HackRF.

First connection, step by step

Do your first connection at home, with time to spare, not on the street.

1. Fit the antenna. Screw it onto the port labelled ANTENNA, finger-tight. Don't use pliers; SMA threads are small and easy to damage. Never connect anything that could transmit into this port.
2. Connect the HackRF to the phone with your OTG cable. LEDs on the HackRF light up. If nothing lights, the cable or OTG isn't supplying power.
3. Open Chrome and go to consentiva.xyz/app. Sign in with your passkey.
4. Choose the receiver. Set Receiver to HackRF (USB).
5. Choose a frequency range. For a first test, Common bands 70 MHz – 2.7 GHz is a good choice: it includes FM broadcast, which is easy to recognise.
6. Tap Start walk. Chrome shows a list of USB devices. Pick the HackRF and tap Connect. Chrome then asks for your location and microphone. Allow both: location places each sweep on the map, and the microphone is for voice marks. If you record video clips, Chrome also asks for the camera.
7. Watch the spectrum appear. Within a few seconds the live display draws and the sweep counter starts climbing.

Chrome remembers the USB permission for the site, so next time you won't see the device list unless you unplug and replug or clear site data.

If you want to learn the screens before the hardware arrives, choose Simulator (demo, no hardware). It produces made-up sweeps so you can try marks and the walk flow.

What you should see first

A quick sanity check tells you the chain from antenna to screen is working. In almost any US city you should find:

If FM is missing in a city, the antenna isn't making contact. Check for RP-SMA, a loose collar, or the antenna on the wrong port. For a guided tour of what's on a busy street, see radio signals on a Miami street.

The three gain stages, explained

Gain is the single setting that most affects what you see. The HackRF has three adjustable gain stages in its receive path. Consentiva exposes all three under Receiver & recording settings.

The app labels the RF amp as about +14 dB. The real figure varies with frequency, and Great Scott Gadgets' own documentation describes it as somewhat lower, so treat it as "roughly 11–14 dB of extra gain". If you type an LNA value that isn't a multiple of 8, or a VGA value that isn't even, Consentiva rounds it down to the nearest step the hardware supports.

Why the order of the stages matters

Each stage amplifies the signal and also adds a little noise of its own. Gain early in the chain (the RF amp, then the LNA) lifts weak signals above the noise of everything that follows, so it improves sensitivity. But early gain also amplifies every strong signal reaching the antenna, across a wide range of frequencies, before any narrow filtering. That makes early stages the easiest to overload.

Gain late in the chain (the VGA) mostly just scales what's already there. It helps fill the converter's range but doesn't improve sensitivity much.

The practical rule: use the LNA to set sensitivity, use the VGA to set how full the converter is, and leave the RF amp off unless you're somewhere quiet.

How to choose gain: a procedure

1. Start at the defaults: amp off, LNA 16, VGA 20. They're chosen to suit a typical city street.
2. Walk somewhere representative of where you'll survey. Gain that suits a quiet suburb won't suit a block beside a rooftop cell site.
3. Look at the noise floor, the flat level between signals. Raise the LNA one step (8 dB). If the floor rises by a few dB too, you were limited by the receiver's own noise and the extra gain helps. If weak signals stand out more without strong ones misbehaving, keep it.
4. Look at the strongest signals. If they get very close to the top of the scale, or new peaks appear that weren't there before, you've gone too far. Go back a step.
5. Use the VGA to fine-tune in 2 dB steps once the LNA is right.
6. Write the final values down and use them for every walk in that area.

Don't chase the most sensitive setting possible. A survey's value comes from walks being comparable with each other, and that matters more than seeing one extra faint signal.

Gain by situation

These are starting points, not rules. The test in the next section tells you whether a setting is actually overloading.

Gain and the calibration offset

If you enter a calibration offset, Consentiva adds it to every reading and shows levels in dBm instead of dBFS. An offset only holds for the gain settings, antenna and frequency range you worked it out with. Change the LNA by 8 dB and every dBFS reading shifts by roughly 8 dB, so the old offset is now wrong. Change the antenna and the offset is wrong at some frequencies and not others. If you calibrate, do it once, at your chosen settings, and then don't touch them.

Overload, spurs and images

An overloaded receiver doesn't just clip the strong signal. It creates signals that don't exist. For a tool that flags "unusual" signals, that's the problem to avoid above all.

What overload looks like

• The whole noise floor lifts across a wide range when you walk near a transmitter, then drops as you pass.
• New peaks appear at frequencies where there's no plausible service, and they rise and fall in step with a strong signal elsewhere.
• Copies of a strong signal show up at other frequencies, often at evenly spaced intervals.
• Strong signals look flattened on top, and their level stops increasing as you get closer.

The 8 dB test

This is the most useful check you can learn. When a peak looks suspicious, lower the LNA by one step (8 dB) and watch it.

• A real signal drops by about 8 dB on the dBFS scale, the same as the noise floor and everything else.
• A peak made by the receiver mixing two strong signals together (an intermodulation product) drops by much more. A common type, third-order intermodulation, falls about three times as fast as the gain change: around 24 dB for an 8 dB step. Often it disappears entirely.

If the suspicious peak shrinks far more than everything else, it was overload. Keep the lower gain for that area. If it drops in line with everything else, it's probably a real signal.

Spurs and images

Every receiver has a few spurs: small fixed peaks produced by its own clocks and digital circuits. They sit at the same frequencies whatever the antenna sees. A good way to find them is to replace the antenna with a 50-ohm SMA terminator (a small cap that absorbs signals) and run a sweep at home. Anything left is the receiver talking to itself.

An image is a mirrored copy of a strong signal, reflected around the centre of a tuning step. It happens because the receiver's two internal signal paths (called I and Q) are never perfectly matched. Images are much weaker than the original signal, so they matter only when the original is very strong. They move when the original moves.

Consentiva helps here by learning a baseline. A fixed spur is present on every walk, so it becomes part of "normal" and isn't flagged. A one-off overload peak, though, can look unusual. That's another reason to keep gain moderate and constant.

The DC spike at the centre

If you've used a HackRF with other software, you've probably seen a sharp spike in the exact middle of the display, wherever you tune. That's the DC spike. The HackRF converts the radio signal straight down to around zero frequency. Tiny offsets in its circuits, and a little of its own tuning signal leaking through, add up to a constant that appears as a spike at the centre of every tuned chunk.

When you sweep, each tuning step has its own centre, so an uncorrected sweep would show a comb of spikes at regular intervals. Consentiva handles this: it replaces the few points at the centre of each step with the median of their neighbours. You lose a very small slice of frequency at each step, and you don't get a false signal there. If you compare Consentiva with another HackRF tool and see spikes in one but not the other, this is usually why.

Choosing an antenna by band

No small antenna works equally well from 1 MHz to 6 GHz. An antenna is most efficient when its size relates to the wavelength of the signal. A common reference is a quarter of a wavelength.

How to use this:

• Surveying the common bands (70 MHz – 2.7 GHz): a telescopic antenna at around a third of its length is a fair compromise. A wideband whip works too and is easier to carry.
• Surveying cellular and Wi-Fi up to 6 GHz (Full plan): use a wideband antenna that's actually specified up to 6 GHz. A long telescopic antenna is poor at the top of the range.
• Hunting VHF/UHF radio (30 MHz – 1 GHz): the telescopic antenna, extended, does better than a short whip.

Most important of all: use the same antenna, at the same length, on every walk you want to compare. A telescopic antenna changes its response when you change its length. Mark the length you use with a bit of tape. Our survey method guide explains why consistency matters more than raw sensitivity.

Power, battery and heat

The HackRF draws around 500 mA continuously while receiving. That's more than most USB accessories, and it shows up in three ways.

• Battery. Expect the phone to drain noticeably faster than normal. Start each walk with a full charge, turn the screen brightness down a little, and carry a power bank for anything over an hour or so.
• Voltage drop. A long or thin cable loses voltage. Near the limit, the HackRF can reset mid-walk, which looks like a dropout. A short, decent cable fixes this.
• Heat. The HackRF gets warm in use, and so does a phone running GPS, the screen and USB at once. On a hot day in direct sun, both can get hot. Phones protect themselves by slowing down or dimming the screen, and Android may cut USB power if it overheats. Keep the HackRF out of a sealed pocket against the phone, and don't leave the kit on a car dashboard between walks.

Temperature also nudges the receiver's gain and frequency slightly. For comparable baselines, let the HackRF run for a few minutes before a walk you'll use for learning what's normal, so it reaches its working temperature. Start it at home, then walk out.

Firmware updates

The HackRF runs its own firmware, separate from Consentiva. You don't need to update it to use Consentiva, but a recent release from Great Scott Gadgets fixes bugs and is a good idea on a new unit. You'll need a computer (Windows, macOS or Linux); you can't do it from the phone.

1. Install the HackRF host tools on the computer. On Linux they're usually a package named hackrf; on macOS they're available through Homebrew. Great Scott Gadgets publishes releases, including Windows builds, on its GitHub page.
2. Download the latest firmware release from Great Scott Gadgets. The release archive contains the firmware file for the HackRF One, named hackrf_one_usb.bin.
3. Check what you have. Connect the HackRF to the computer and run hackrf_info. It prints the serial number and firmware version.
4. Write the new firmware with hackrf_spiflash -w hackrf_one_usb.bin, using the path to the file you downloaded.
5. Restart the HackRF by pressing its RESET button or unplugging and replugging it, then run hackrf_info again to confirm the new version.

Use host tools from the same release as the firmware; mismatched versions can behave oddly. If an update is interrupted and the HackRF stops responding, Great Scott Gadgets documents a recovery method using its DFU button. Follow their instructions for your release rather than guessing.

After a firmware update, run a short walk on a route you know. If the noise floor or the levels of familiar signals have shifted, it's cleaner to start fresh baselines than to mix before-and-after walks.

Safety: protecting the radio and staying legal

Never connect a transmitter directly to the HackRF. That includes a two-way radio's antenna socket, a phone booster's output, a signal generator, or any cable that might carry transmit power. Great Scott Gadgets' current documentation puts the maximum safe input at −5 dBm, well under a milliwatt, and warns that more can permanently damage the receiver. You'll see +10 dBm quoted in older material; treat the lower figure as your ceiling.

• Walking past transmitters is fine. Signals arriving over the air at the antenna, even beside a cell site, are far weaker than a direct cable connection. The risk is overload (false readings), not damage. Lower the gain.
• Don't touch the antenna to a transmitting antenna or hold it right against a two-way radio while someone keys up.
• Static. Touch something grounded before handling the antenna port on a dry day, and don't leave the port uncovered in a bag of keys.
• Never transmit without a licence. The HackRF can transmit, and other software can make it do so. Transmitting on most frequencies without the right FCC licence is illegal and can interfere with services people rely on. Consentiva doesn't transmit, and nothing in this guide requires it.
• Recording people. Florida requires everyone's consent to record a conversation. Consentiva's video clips record sound only if you switch it on and audio notes are hold-to-record, but be aware of what your microphone can hear.
• Street sense. Watch where you're walking, not the screen. Voice marks exist so you can keep your eyes up.

Keeping settings identical between walks

Consentiva learns what's normal for each block of about 150 metres, separately for night, morning, afternoon and evening. It flags signals stronger than that baseline as unusual. That comparison is only fair if the equipment behaves the same way every time. A 3 dB rise means something only if you didn't change anything that could cause a 3 dB rise.

Keep these the same for every walk you want to compare:

The setting Use this walk to learn what's normal controls whether a walk feeds the baseline. Turn it off for a one-off walk where something about your setup is different, such as a borrowed antenna or a test of new gain. That keeps the experiment from muddying your baseline.

A walking routine

A routine makes your walks comparable and saves you from discovering a problem halfway round. Here's one that works.

Before you leave

1. Charge the phone and the power bank.
2. Check the antenna is tight and at its marked length.
3. Connect the HackRF and start it at home so it warms up for a few minutes.
4. Open the app, confirm the receiver, preset and gain match your written settings, and give the walk a name you'll recognise later.

On the walk

1. Tap Start walk and check the sweep counter climbs before you set off.
2. Keep Consentiva in the foreground. Phones pause web pages when the screen turns off. Consentiva asks the phone to keep the screen awake during walks, but switching to another app can still pause it.
3. Walk at a steady pace. Rushing through one block and lingering in another gives uneven coverage.
4. Mark what you see as you see it: tap a button or hold to record a short note. A mark with a time and place is worth far more later than a memory.
5. On Standard and Full, record a short video clip of anything you'll want to show someone. The clip carries time, GPS and live RF in the picture.
6. Glance at the spectrum at corners, not while crossing the street.

A scenario

Say you're on a sidewalk in Brickell at 7 pm, two weeks into surveying the same loop. Your settings are the defaults, written on a card in your wallet. Halfway down the block the display shows a strong new peak near 900 MHz that you don't remember. You say "parked van, antenna on the roof" and keep walking. Back home, the report shows the block flagged with an unusual signal at that time, with your voice mark right beside it on the map. Before drawing conclusions, you check the strongest-signals list: the peak is well above the noise but nowhere near overload, and nothing appeared at odd frequencies alongside it. Because your gain was unchanged, the comparison with the evening baseline for that block is fair. Next evening you walk the loop again to see if it repeats.

After the walk

1. Tap stop and let the walk upload. Video clips are large; Consentiva sends sweeps and marks first so results don't wait for them.
2. Open the report and skim the unusual-signal table and timeline while the walk is fresh. Our guide to reading a Consentiva report explains each section.
3. If something matters, download the evidence package. It contains the raw sweep data, audio, video, report, and a ledger with a SHA-256 hash chain plus a VERIFY.txt explaining how to check it hasn't been altered. See the sample report for what that looks like.
4. Note anything that changed about your setup, and decide whether that walk should have fed the baseline.

Free accounts record from 30 MHz to 2.7 GHz and keep recordings for 7 days, with analysis locked. Reports, evidence packages and video need Standard; 2.7–6 GHz needs Full. See plans for details.

Troubleshooting

Most problems fall into a handful of patterns. Start with the table, then read the notes for the trickier ones.

"Chrome doesn't list the HackRF"

Work through the chain in order. Are the HackRF's LEDs lit? If not, the phone isn't supplying power: check OTG and the cable. If they are lit but the device list is still empty, the cable probably isn't carrying data. Swap it before trying anything else. Then check you're in Chrome, not a different browser or an in-app browser opened from a messaging app.

"It connected yesterday and won't today"

Unplug the HackRF, close every Chrome tab for Consentiva, and plug it in again. If you had another SDR app open on the phone, close it fully; only one program can use the HackRF at a time. If the phone has an OTG switch that turns itself off, turn it back on.

"The readings look different from last week"

Before suspecting the street, suspect your setup. Compare your gain values, preset and antenna length with your notes. If anything changed, either change it back or start a new baseline. If nothing changed and the difference is in one band only, that may be a genuine change, which is what the survey is for. Our cell site guide covers how to look into a new cellular signal.

Common mistakes

• Changing gain mid-survey. Every walk after the change is now measured on a different scale. If you must change it, start a fresh baseline.
• Turning on the RF amp in a city. It rarely helps on a busy street and often causes overload. Leave it off unless the area is genuinely quiet.
• Reading dBFS as dBm. Without a calibration offset, the numbers are relative to the converter, not absolute power. They're excellent for comparison and meaningless as an absolute figure.
• Treating one reading as the truth. Cellular signals, especially 5G, change from moment to moment. Patterns across walks are what count. The 5G bands guide explains why mid-band levels flicker.
• Ignoring the cable. A bad cable causes more lost walks than anything else. Carry a spare.
• Using the survey as an exposure meter. Consentiva measures received levels relative to a learned baseline. It doesn't measure exposure. The exposure limits guide explains the difference.
• Walking with the antenna folded or horizontal. It saves space and costs you consistency.

Glossary

• dBFS: decibels relative to full scale. 0 dBFS is the strongest signal the converter can represent; readings are negative numbers below it.
• dBm: decibels relative to one milliwatt, an absolute power level. Consentiva shows dBm only when you enter a calibration offset.
• DC spike: an artefact at the centre of each tuned chunk, caused by the receiver's direct-conversion design.
• Gain: amplification, in decibels. The HackRF has three stages: RF amp, LNA and VGA.
• Image: a weak mirrored copy of a strong signal around the centre of a tuning step.
• Intermodulation: false signals created when strong signals mix inside an overloaded receiver.
• LNA: low-noise amplifier; on the HackRF, 0–40 dB in 8 dB steps.
• Noise floor: the background level between signals, set by the receiver's own noise and the gain.
• OTG: USB On-The-Go, which lets a phone act as a USB host and power a device.
• Overload: when signals are too strong for the receiver to handle cleanly, causing distortion and false peaks.
• SMA / RP-SMA: small threaded RF connectors. The HackRF uses SMA; RP-SMA looks similar but won't connect.
• Spur: a fixed false peak produced by the receiver's own circuits.
• Sweep: one pass across the chosen frequency range, built from many tuning steps.
• VGA: variable-gain amplifier at baseband; on the HackRF, 0–62 dB in 2 dB steps.
• WebUSB: a Chrome feature that lets a web page talk to a USB device after you grant permission.

Common questions

Can I use a HackRF One with an iPhone?

Not as a live receiver. Apple doesn't let web pages talk to USB devices, so on iPhone Consentiva can log marks with GPS and show your reports, but it can't drive the HackRF.

What cable do I need to connect a HackRF One to an Android phone?

A USB-C to micro-USB cable or adapter that carries data and supports OTG. Many cheap cables only carry charging current; if Chrome never lists the HackRF, the cable is the first suspect.

What gain settings should I use on a HackRF One for walking surveys?

Start with LNA 16 dB, VGA 20 dB and the RF amp off, which are Consentiva's defaults. Lower the LNA in 8 dB steps if you see overload near strong transmitters, and keep whatever you settle on identical for every walk.

Does the HackRF One need a separate power supply?

No. It runs from the phone's USB port and draws roughly 500 mA. On long walks a power bank helps keep the phone going, and a short, good-quality cable avoids dropouts.

What is the spike in the middle of a HackRF spectrum?

It's the DC spike, an artefact of the HackRF's receiver design that appears at the centre of each tuning step. Consentiva replaces the few centre points of each step with the median of their neighbours so the spike doesn't show up as a false signal.

Can a HackRF One be damaged by strong signals?

Yes. Never connect a transmitter, a radio's antenna socket or a signal generator directly to the input. Great Scott Gadgets' current documentation puts the maximum safe input at -5 dBm, well under a milliwatt.

Do I need a licence to use a HackRF One?

You don't need one to receive. The HackRF can also transmit, and transmitting on most frequencies needs an appropriate FCC licence; Consentiva only receives.