ExpressLRS

ExpressLRS
Developers	ExpressLRS LLC and Community
Release	2018; 8 years ago (2018)
Stable release	3.6.0 / 5 September 2025; 14 months ago (2025-09-05)
Written in	C++, Python
Operating system	Cross-platform
License	GPLv3
Website	expresslrs.org
Repository	github.com/ExpressLRS

ExpressLRS is an open-source radio control link protocol for long range and low latency communication. It is used primarily in drones and aircraft. ExpressLRS uses LoRa, and FSK modulations on Semtech RF transceivers using an ESP32 or ESP8266 microcontroller. Since its release in 2018, ExpressLRS has been adopted in the FPV community for both hobbyist and commercial applications. It supports packet rates up to 1000 Hz on the 2.4 GHz frequency band and up to 1000 Hz on the 915/868 MHz bands while less frequent update rate settings enable ranges in excess of 100 km.

Overview

ExpressLRS is noted for its use of LoRa modulation combined with short packet sizes, allowing for very low latency and the ability to maintain link stability over long distances.

• Packet rates: up to 1000 Hz on the 2.4 GHz band using FLRC, and up to 1000 Hz on the 915/868 MHz bands using FSK on LR1121 hardware
• Bandwidth: sufficient for RC channel data and telemetry, around 100bps-20kbps dependent on settings
• Telemetry support: MAVLink telemetry can be carried over ExpressLRS from Ardupilot or PX4 vehicles and displayed/controlled by ground stations such as Mission Planner and QGroundControl
• Range: >100 km on both 2.4 GHz and 900 MHz
• Output protocols: CRSF, SBUS, MAVLink, SUMD, PWM, HoTT, SmartAudio, Tramp, and raw serial
• Supported bands: officially 2.4 GHz and 868/915 MHz ISM bands, limited support for 433 MHz, and unofficial hardware/software available for other frequencies.
• Modulation schemes: LoRa for long range, FLRC and FSK for higher packet rates and lower latency.
• Frequency hopping: frequency-hopping spread spectrum (FHSS) to mitigate interference.
• Antenna diversity: some transmitters/receivers support dual antennas with dual simultaneous transmission ("Gemini") for improved link reliability, including dual-band simultaneous operation in 2.4 GHz and 900 MHz ("GeminiX").
• RC Channel count: Up to 16 full-resolution (10-bit) channels can be used with "Full" modes

History

ExpressLRS development began in 2018, created by hobbyists seeking to build a low-cost, low-latency control link using commodity hardware and open-source community-driven software.

Early versions of ExpressLRS focused on the 900 MHz ISM band and offered 200 Hz packet rates, higher than commercially available competitors at the time. Commercial hardware was not yet available, so prospective users were required to build receivers themselves using plans from the ExpressLRS repositories. By 2020, the introduction of the 2.4 GHz band and readily-available low-cost commercial hardware significantly increased adoption among first-person view (FPV) drone pilots, who valued the reduced retail cost and improved latency compared to proprietary systems such as TBS Crossfire and FrSky. Community contributions accelerated through 2021 and 2022, with regular firmware releases and the addition of features such as higher packet rates, full telemetry, and support for MAVLink telemetry. As of the mid-2020s, ExpressLRS has been adopted within the FPV drone community and is described by hobbyist sources as approaching a de facto standard.

Since the Russian invasion of Ukraine in 2022, ELRS has become the dominant method of flying kamikaze FPVs due to its resilience to Electronic Warfare, long-range signal, and open-source flexibility. Both sides constantly modify offensive and defensive measures to operate on a wider variety of frequency spectrums and custom hardware, allowing them to adapt to rapid developments on the battlefield. For example, a 2024 analysis of a captured Russian T-72 tank found that a basic EW system needed multiple antennas ranging from 700 MHz to 5.8 GHz to counter Ukrainian strike drones.

Alleged vulnerabilities

In 2022, a report claimed that a vulnerability in ExpressLRS could allow remote takeover of drones. The report claimed that the protocol used a binding phrase encrypted with the MD5 hashing algorithm. It also alleged that synchronization packets exposed most of the identifier used for pairing, which attackers could reconstruct to hijack the communication link.

Subject-matter experts responded that the report conflated cryptographic concepts and overstated the feasibility of a real-world attack.^{[citation needed]} Security researchers note that, in real-world scenarios, simple electromagnetic jamming is a more practical and effective means of disrupting remote-control links than the protocol-level attack described, reducing the practical significance of the reported vulnerability.^{[failed verification]}

See also

• MAVLink
• LoRa
• 2.4 GHz radio use

References