Meshtastic packet decoder

The Meshtastic toolkit talks to a node and maps what it hears. This is the magnifying glass: give it one packet and it shows every field, which key opened it and how, and what the payload says.

How to use it

Decode — paste a packet as hex or base64. Detect works out what it is:
- a ServiceEnvelope, as published on MQTT topics msh/<region>/2/e/<channel>/<gateway>;
- a MeshPacket or FromRadio message from the phone API (or the device’s serial or Bluetooth link);
- a decrypted Data message;
- a raw over-the-air packet as an SDR or a radio’s debug log shows it — the 16-byte header (to, from, packet id, flags with hop limit and hop start, channel hash, next hop, relay node) and then the encrypted Data;
- or JSON from a …/2/json/… topic.
  
  Encrypted packets are decrypted with AES-CTR. The counter block is the packet id (64-bit, little-endian), then the sender’s node number (32-bit, little-endian), then zeros — shown under AES-CTR nonce. The packet’s channel byte is a hash of the channel name and key, so the keys whose hash matches are tried first.
Channel keys — name and PSK as base64, as in the app. AQ== is the public default key used by LongFast and the other preset channels: one byte that stands for the published 16-byte key 1PG7OiApB1nwvP+rz05pAQ== (Ag== to Cg== are the same key with its last byte changed). A private channel has a random 16- or 32-byte key. Direct messages since firmware 2.5 are encrypted with the recipient’s public key (PKI) and can’t be read here.
The payload is decoded by port: text, position, node info (names, hardware, role), telemetry (device, environment, power, air quality), routing (acks and errors), traceroute (the route there and back with the SNR of each hop), neighbour info, waypoints and map reports.
Bytes and fields lists every protobuf field with its byte range, wire type and value; hover or tap a row to highlight its bytes.
Airtime of this packet opens the LoRa airtime calculator with its size. Open … in the Meshtastic toolkit hands the channel that decrypted it to the toolkit’s Channels tab as a channel URL, where you can turn it into a QR code.
Live (MQTT) — connect to a broker that speaks MQTT over WebSockets and subscribe (for example msh/EU_868/2/e/LongFast/#). Every message is decoded with your keys; tap a row to open it in the decoder. The public broker mqtt.meshtastic.org only listens on TCP 1883, so a web page reaches it through the gitwebsite app’s TCP relay (gw companion tcp add mqtt.meshtastic.org:1883). Open this broker in the MQTT client adds the broker and topic to the MQTT client for a raw view. Replay the examples runs the built-in packets through the same path.
Nodes — everyone heard: name, hardware, role, position, battery, hops, packets and their last text, with a map.

Checks

The examples were made with the official @meshtastic/protobufs 2.8 package and encrypted with Node’s AES-CTR: all of them (text, position, node info, telemetry, routing, traceroute, neighbour info, waypoint, a private AES-256 channel, an over-the-air frame) decrypt and decode to the values they were built from, and field byte ranges match the encoder’s output.
A packet on the default key fails with any other key; the channel hash of LongFast with AQ== is 8.

Limits

The schema is the part of the Meshtastic protobufs the toolkit uses (it covers the ports above); other ports show their payload bytes. Admin messages aren’t decoded.
PKI-encrypted direct messages can’t be decrypted without the recipient’s private key.
The over-the-air view expects the packet as the radio received it, without the LoRa PHY header or CRC.

Privacy

Decoding happens in your browser. Live mode connects only to the broker you name, and loads the MQTT library (mqtt.js) from cdn.jsdelivr.net; the map loads Leaflet from there and tiles from OpenStreetMap. Channel keys are kept only if you tick Remember keys, the password is never stored, and neither goes into a share link.

Works with

How to use it

Checks

Limits

Privacy