muehlbronner.de
DE EN

← All projects

Project overview

WiFi Sensing

Radio as a sensor

WiFi does not just carry data – every signal also carries traces of its surroundings. When a person moves, breathes or their heart beats, the radio waves change measurably. WiFi sensing reads these changes: presence and motion without a camera, through walls, with hardware that costs a few euros.

  • ESP32 hardware
  • CSI 64–256 subcarriers
  • 2.4 + 5 GHz
  • in progress: breathing, heartbeat

How it works

Channel state information (CSI)

WiFi splits every channel into many narrow subcarriers – 64 at 20 MHz, 256 at 80 MHz (5 GHz band only). For each one, the receiver reports how strongly and with what shift the signal arrives. This “channel state information” is produced with every packet anyway, because the radio needs it for equalisation.22

People change the signal

The signal reaches the receiver along many paths: directly and via reflections off walls, furniture – and people. Walls and furniture stay still, a person does not. Their movement, even the chest rising while breathing, changes how the paths overlap and therefore the CSI.

From noise to result

The raw data is noisy. Filtering, frequency analysis and machine learning turn it into “motion detected”, a breathing rate or an activity. Breathing lies at 0.1–0.5 Hz, the heartbeat at roughly 0.8–2 Hz – so both can be searched for in separate frequency bands.

2.4 GHz or 5 GHz?

The frequency band decides what can be measured. In short: 2.4 GHz reaches further and through more walls, 5 GHz looks more closely.

2.4 GHz5 GHz
Wavelengthapprox. 12.5 cmapprox. 6 cm
Sensitivity to small movements1 mm of chest movement shifts the phase of the reflection by about 6°about 12.5° – roughly twice as sensitive; a big advantage for breathing and especially the heartbeat (fractions of a millimetre)
Channel width and subcarriersusually 20 MHz (64 subcarriers), at most 40 MHz20 to 160 MHz; 256 subcarriers at 80 MHz – more measurement points per packet
Separating pathsat 20 MHz only from about 15 m path differenceat 80 MHz from about 3.75 m, at 160 MHz from about 1.9 m – reflections from a person and from furniture are easier to separate
Through wallsbetter; concrete attenuates about 20–25 dB20attenuated much more21 – better suited to measurements in the same room
Interferencecrowded: only three to four non-overlapping channels, plus Bluetooth and microwavesmany more channels, quieter – but on DFS channels the router must switch channel when it detects weather or aviation radar, interrupting measurements
Hardware with CSIESP32, ESP32-S3, -C3, -C6 (2.4 GHz only)ESP32-C5 (dual-band, CSI at 20/40 MHz)23; Raspberry Pi with Nexmon (up to 80 MHz)24

Rule of thumb: 2.4 GHz for presence and motion across several rooms, 5 GHz for breathing and heartbeat close to the radio link.

My project

Today

  • Presence and motion: two ESP32 boards form a radio link; the receiver reads the CSI of every packet and detects whether something moves in the room – without a camera and even through walls.
  • Home Assistant: events go to the smart home via MQTT, plus an ESPHome component for the battery of a Fiido Air e-bike.
  • Related: the Beacon Radar for Bluetooth devices.

In progress

  • Breathing: the chest rises by a few millimetres when breathing – enough to read the breathing rate from the CSI. This has been shown with the ESP32.1016
  • Heartbeat: the motion caused by the heartbeat is a fraction of that and sits underneath the breathing. The challenge is to filter it out cleanly; research shows it works with two ESP32 boards.16
  • The heartbeat as a fingerprint: every heart moves slightly differently – the shape and rhythm of its motion are individual. With radar, 78 people could be told apart with 98.6% accuracy.6 Whether this works with the coarser WiFi measurement is an open research question I am working on.

Heartbeat features are biometric data and specially protected under the GDPR (Art. 9). Measurement and identification only with the consent of the people concerned.

Research milestones

  1. 2011CSI from ordinary WiFi hardware

    A tool makes the channel state information of off-the-shelf Intel cards readable – the starting point of WiFi sensing research.1

  2. 2012Passive WiFi radar

    University College London detects motion through a wall using only third-party WiFi signals; the UK Ministry of Defence offers funding for a study on urban combat.2

  3. 2013Wi-Vi: through walls with WiFi

    MIT detects people behind walls with a small 3-antenna radio in the 2.4 GHz band.3

  4. 2015Breathing and heartbeat during sleep

    Breathing and heart rate from standard WiFi for the first time, without a wearable.4

  5. 2016–2018Emotion, body pose

    EQ-Radio reads individual heartbeats and infers emotions, RF-Pose draws stick figures through walls – both with dedicated radio radar instead of WiFi.57

  6. 2017The heartbeat as an ID

    Cardiac Scan identifies people without contact by the motion of their heart: 98.6% across 78 people (continuous-wave radar).6

  7. 2019CSI at 5 GHz and 80 MHz

    Nexmon makes CSI readable from Broadcom chips – including the Raspberry Pi, in both bands and with up to 80 MHz bandwidth.24

  8. 2020–2022The ESP32 becomes a sensor

    CSI can be captured with microcontrollers costing a few euros; first breathing measurement with the ESP32.910

  9. 2023Body pose from WiFi

    Carnegie Mellon reconstructs the body surface of several people from WiFi signals alone.11

  10. 2023–202418 m through five rooms

    TU Wien: an ESP32-S3 with a directional antenna recognises activities through walls, 92% accuracy without line of sight.1213

  11. 2025Its own IEEE standard

    IEEE 802.11bf makes sensing an official WiFi feature; two ESP32 boards measure heart and breathing rate (PulseFi).1416

Where it is used

Home and smart home

Comcast has brought “WiFi Motion” to millions of Xfinity routers: the router reports motion in the home without a camera.17 Espressif ships a ready-made sensing component for the ESP32.18

Care and health

Fall detection, sleep and breathing monitoring without wearables – especially for older people living alone. So far mainly in research and pilot projects.411

Military and security

To “see through walls”, military and police mostly use dedicated radar devices, such as Camero-Tech’s Xaver range – in 50 countries according to the manufacturer.19 In 2012 the UK Ministry of Defence commissioned a study on passive WiFi radar for urban combat.2 The Pentagon’s “Jetson” system identifies people by their heartbeat at 200 m – by laser, not WiFi.8

Technology and limits

FactorWhat it doesIn practice
Frequency bandDetermines range, sensitivity and resolution – see “2.4 GHz or 5 GHz?” above.2.4 GHz through walls, 5 GHz for vital signs.
Reinforced concreteConcrete attenuates strongly: around 20–25 dB at 2.4 GHz, considerably more at 5 GHz.2021 The rebar grid also acts like a coarse cage – the closer the bars relative to the wavelength, the less gets through.Often barely any signal through a concrete ceiling; drywall, timber and brick are unproblematic.
Metal and foilsMetal-coated windows, foil-backed insulation, lifts and radiators reflect almost completely.Route the radio link so it does not cross such surfaces.
AntennasThe ESP32’s PCB antenna radiates in all directions. A directional antenna focuses the energy: with a biquad antenna, 18 m through five rooms was achieved.13 Multiple antennas (MIMO) add viewing angles.External antenna (IPEX/U.FL) on the ESP32-S3, aimed at the measurement area.
Packet rateCSI only exists when packets flow. Breathing and heartbeat need a steady rate, e.g. 50–100 packets per second.Own transmitter or regular pings instead of random traffic.
Cheap hardwareLow-cost chips have an unstable phase (clock and frequency offsets), so usually only the amplitude is used.22Phase sanitisation or amplitude-only features.
EnvironmentEvery room has its own signal picture. Moved furniture, open doors, pets or several people change it.Calibrate per room, keep updating the baseline.

Privacy

  • WiFi sensing works invisibly and through walls – people do not notice they are being sensed.
  • Even motion patterns reveal a lot: when someone is home, asleep or has visitors. With commercial services it often remains unclear who receives this data.17
  • Breathing, heartbeat and certainly a heartbeat fingerprint are health or biometric data: only with consent, processed locally, stored sparingly.

Outlook

  • Sensing in the router: with IEEE 802.11bf, devices can request measurements in a standardised way – sensing becomes a core feature of future routers, including in the 60 GHz range.1415
  • Finer resolution: Wi-Fi 7 uses channels up to 320 MHz wide – more subcarriers, more precise measurement.
  • Better models: learning methods that do not need retraining for every room are the biggest open problem.
  • Health at home: contactless vital signs and fall detection as an alternative to cameras and wearables.
  • Rules: as it spreads, so does the need for clear privacy rules for invisible sensors.

Side project: a covert radio channel

The same ESP32-C5 boards led to a second experiment – this time not for sensing, but for communicating. It hides a message not in the content of the Wi-Fi packets, but in their transmit power: the receiver only reads the signal strength (RSSI) and reconstructs the bits from it. With Hamming error correction, encryption, a Bluetooth-controlled chat and a ping-pong range test.

Explainer (3:18, Full HD, narrated with subtitles): how Wi-Fi transmit power becomes a covert communication channel – Wi-Fi sensing as the starting point, principle, error correction, chat, range test and possible uses.
Web interface of the radio chat with an RSSI oscilloscope: the square wave is the message modulated onto the transmit power Radio chat with a clean signal: message decoded without errors Radio chat at about 30 percent bit errors: the error correction still recovers the text
The radio chat live: on top the real RSSI stream (the square wave is the message), below a clean reception and a run with about 30 % bit errors that the error correction absorbs.

What it could be used for

Pure basic research – but the idea of carrying data inconspicuously over Wi-Fi that is present anyway has many conceivable uses:

Military & conflict zones

Encrypted, hard-to-locate communication without a dedicated, easily traceable transmitter – the signals disappear into everyday Wi-Fi noise.

Covert agency radio

An inconspicuous back-channel between devices right at the scene, e.g. for covert police or rescue teams.

Industry & M2M

Machines confirm control commands over a second, independent channel – a gain in security and tamper resistance.

Medicine

Devices on the body exchange readings without an extra transmitter and with little additional radio load.

Hobby & radio chat

A small chat entirely without the internet, just between your own devices – for tinkering and learning.

Children’s toys

Two figures “whisper” secret messages to each other – no pairing, no cloud, simply over the air.

Dual-use note: a research and learning project between my own devices. Covert radio channels are an established academic field; the appeal is robustness and inconspicuousness, not circumventing rules.

Videos

Introduction to Wi-Fi Sensing and the IEEE 802.11bf StandardIEEE ComSoc Oregon · Talk: fundamentals and the new standard Your Wi-Fi Might Be Secretly Watching You! (Wi-Fi Sensing Explained)Behfor · Short, accessible introduction ESP-CSI: Transforming Wi-Fi into a Sensing PlatformEspressif Systems · The chip maker on WiFi sensing with the ESP32 Synaptics Wi-Fi SensingSynaptics · Motion and presence from WiFi signals WiTrack: 3D Motion Tracking Through Walls Using Wireless SignalsMIT CSAIL · Tracking motion through walls (radio, not WiFi) Capturing a Human Figure Through a Wall using RF SignalsMIT CSAIL · RF-Capture: a body outline behind a wall This AI Senses Humans Through WallsTwo Minute Papers · RF-Pose explained briefly DensePose from WiFi – High Level ExplanationAI With Rithesh · Body pose from WiFi signals alone (CMU)

Sources

  1. D. Halperin, W. Hu, A. Sheth, D. Wetherall: Tool Release: Gathering 802.11n Traces with Channel State Information. ACM SIGCOMM CCR 41(1), 2011. dl.acm.org
  2. Popular Science: Seeing Through Walls With a Wireless Router, July 2012 – on the passive radar by K. Chetty and K. Woodbridge (UCL); the UK Ministry of Defence funds a study on urban combat. www.popsci.com
  3. F. Adib, D. Katabi: See Through Walls with WiFi! ACM SIGCOMM 2013. www.mit.edu
  4. J. Liu, Y. Wang, Y. Chen, J. Yang, X. Chen, J. Cheng: Tracking Vital Signs During Sleep Leveraging Off-the-shelf WiFi. ACM MobiHoc 2015. doi.org
  5. M. Zhao, F. Adib, D. Katabi: Emotion Recognition using Wireless Signals (EQ-Radio). ACM MobiCom 2016. eqradio.csail.mit.edu
  6. F. Lin, C. Song, Y. Zhuang, W. Xu, C. Li, K. Ren: Cardiac Scan: A Non-contact and Continuous Heart-based User Authentication System. ACM MobiCom 2017. doi.org
  7. M. Zhao et al.: Through-Wall Human Pose Estimation Using Radio Signals. CVPR 2018. people.csail.mit.edu
  8. MIT Technology Review: The Pentagon has a laser that can identify people from a distance – by their heartbeat, June 2019. www.technologyreview.com
  9. S. M. Hernandez, E. Bulut: ESP32-based CSI collection on edge devices (PerCom Workshops 2020). staff.itee.uq.edu.au
  10. COVID-Beat: a low-cost breath monitoring approach for people in quarantine during the pandemic. Journal of Computational Design and Engineering 9(3), 2022 (ESP32, breathing). academic.oup.com
  11. J. Geng, D. Huang, F. De la Torre (CMU): DensePose From WiFi. arXiv 2301.00250, 2023. arxiv.org
  12. J. Strohmayer, M. Kampel (TU Wien): WiFi CSI-Based Long-Range Through-Wall Human Activity Recognition with the ESP32. ICVS 2023. doi.org
  13. J. Strohmayer, M. Kampel: Directional Antenna Systems for Long-Range Through-Wall Human Activity Recognition. IEEE ICIP 2024. arxiv.org
  14. IEEE: 802.11bf – Enhancements for WLAN Sensing (IEEE Standards Association overview); standard approved in 2025. standards.ieee.org
  15. R. Du, H. Hua, H. Xie et al.: An Overview on IEEE 802.11bf: WLAN Sensing. arXiv 2310.17661. arxiv.org
  16. PulseFi: A Low Cost Robust Machine Learning System for Accurate Cardiopulmonary and Apnea Monitoring Using Channel State Information (two ESP32 boards). arXiv 2510.24744, 2025. arxiv.org
  17. PCWorld: Xfinity routers can now sense movement in your home without cameras. www.pcworld.com
  18. Espressif: esp_wifi_sensing component (ESP-IDF 5.4+, e.g. ESP32-S3/C6). components.espressif.com
  19. Janes: Camero-Tech releases new ISR imaging platform – Xaver radars used by military and police in 50 countries according to the manufacturer. www.janes.com
  20. Keenetic: Wi-Fi signal attenuation coefficients when passing through different materials (2.4 GHz guide values). help.keenetic.com
  21. iBwave: Exploring Attenuation Across Materials & the 2.4 GHz / 5 GHz Bands. blog.ibwave.com
  22. Exposing the CSI: A Systematic Investigation of CSI-based Wi-Fi Sensing Capabilities and Limitations. arXiv 2302.00992. arxiv.org
  23. Espressif: ESP-IDF Programming Guide – Wi-Fi Driver, Channel State Information (ESP32-C5, dual-band 2.4/5 GHz, CSI at 20/40 MHz). docs.espressif.com
  24. F. Gringoli, M. Schulz, J. Link, M. Hollick: Free Your CSI: A Channel State Information Extraction Platform for Modern Wi-Fi Chipsets. ACM WiNTECH 2019 (Broadcom chips incl. Raspberry Pi, up to 80 MHz, 2.4 and 5 GHz). github.com

As of October 2026. This page summarises published research; product details come from the reports and manufacturer statements cited.