Concern About ESPHome USB Flashing Now Requiring an Online Web Flasher

ESPHome
1

Hello everyone,

I would like to raise a concern regarding a recent change in the ESPHome flashing workflow from within Home Assistant.

Previously, my workflow was:

  1. Connect ESP32 to the computer via USB.
  2. Open Home Assistant locally in the browser.
  3. Compile the firmware in ESPHome.
  4. Click Install → Plug into this computer.
  5. The browser would directly access the USB serial port and flash the device.

This workflow felt completely local and aligned with the “local-first” philosophy that attracted many of us to Home Assistant and ESPHome.

However, after updating (currently on HAOS 2026.7.3), the process appears different:

  1. Firmware compiles successfully.
  2. I select USB Flash.
  3. The browser redirects to an online Home Assistant / ESPHome web flashing page.
  4. That online page then requests USB access and performs the flashing.

My concern is not about privacy or telemetry specifically. Rather, it is about the loss of a fully local flashing workflow.

Questions:

  • Is this behavior intentional and expected?
  • Is the USB flashing process now dependent on an external online service?
  • Is there still a way to perform browser-based USB flashing entirely from the local Home Assistant instance without redirecting to an Internet-hosted page?
  • What is the rationale behind moving part of the flashing workflow from a local interface to an online web flasher?

From a user perspective, this change creates the impression that a previously local operation now requires Internet connectivity, which seems contrary to the local-first approach that Home Assistant and ESPHome are known for.

I would appreciate clarification from the ESPHome/Home Assistant team regarding the design decision and whether a fully local USB flashing option will remain available in the future.

Thank you.

3

You won’t find them here. Try the Discord server.

4

I’m pretty sure, that only happens if your connection to HA is not over https.

5

Which seems pointless when you are on a internal LAN connection, thus can’t connect via HTTPS…

6

IIRC it’s a requirement of the WebSerial protocol, not an ESPHome-specific thing.

You can always download the .bin and use ESPTool or ESPHome CLI.

7

You can install esphome on a PC/Mac and run it locally. You do not need to run it from HAOS.

Note that esphome uses Platform IO under the covers and that definitely requires an Internet connection to download compilers and libraries.

8

ESPHome itself is not part of Home Assistant — it has always been a separate application that normally runs on a regular computer (typically Linux). Most people run it as an add‑on inside Home Assistant, but that’s just a convenience wrapper around the standalone ESPHome service.

In older versions of ESPHome, the instruction “Plug into this computer” meant “plug the ESP device into the computer that is running ESPHome.” That was confusing because many of us run ESPHome as an add‑on, and the Home Assistant server is often a headless device sitting in a closet or rack. Meanwhile, we interact with ESPHome through a web browser, and web browsers do not have direct access to USB serial ports.

ESPHome has now clarified this wording. When you access ESPHome through a browser, “this computer” refers to the computer you are physically using, and ESPHome will offer a browser‑based USB flasher. It is optional — not required.

If you prefer not to use the web flasher, you can simply use Advanced Options to compile the firmware and download the .bin file. You can then flash it using any of the standard tools (most of which are front‑ends for Espressif’s esptool.py).

9

There are several ways to run ESPHome - which can make it confusing - however almost all the options are fully local.

I am curious why you are using the “plug into this computer” option instead of “on the network” (commonly referred to as OTA, or over-the-air) as your normal workflow. OTA is preferred, and the easiest - but it requires ESPHome (with the ota: component) to already be installed on the ESP32 device. Connecting by USB is normally only required the first time you load ESPHome firmware onto a device.

My understanding is that all the above replies are correct … though stevemann has provided the clearest explanation. I myself have to run Home Assistant and the ESPHome Device Builder in Chrome browser because Firefox (which I use for everything else) does not support Webserial which is used for the non-OTA downloading.

I also have ESPHome CLI installed on my desktop linux PC because a serial connection is required to see the log of ESPHome booting up. You don’t need both, but there are some times when one is better than the other.

I agree that the wording Steve referred to was confusing … it wasn’t clear whether “this computer” is the server running HA and ESP and generating the web page, or the desktop PC on which you are viewing the same web page ?

Security should always be a concern - hence the move to https:, and warnings about web apps accessing your hardware. I am curious however that you consider web.esphome.io a problem, despite (presumably) having no issue with looking at ESPHome documentation also on the same public server.

10

It has supported it since version 151.

11

Just to clear up the privacy concern here: your firmware is never sent to any server. The flash is 100% local over USB.

The reason web.esphome.io is involved at all is a browser restriction, not an ESPHome design choice. WebSerial only works in a secure context, which means the page must be loaded over HTTPS (or from localhost). If your dashboard is served over plain HTTP, the browser simply will not expose the serial port to the page, so it cannot flash from there no matter what we do. If you open the dashboard over HTTPS you never see any of this; flashing happens right in the dashboard and web.esphome.io is never involved.

For the plain HTTP case, what actually happens is: the dashboard fetches the compiled firmware from your own instance into your browser, opens web.esphome.io (which is served over HTTPS and therefore allowed to use the serial port), and hands the firmware directly to that tab inside your browser. The flashing itself runs entirely in the page using esptool compiled for the browser; the firmware never travels anywhere except from your instance, to your browser, to the device on your desk.

This is not just a matter of the code happening not to upload anything, it is structurally incapable of it. The web.esphome.io page ships a Content-Security-Policy that tells your browser to block it from talking to any outside server, so even a bug could not send your firmware anywhere; the browser itself would refuse. The hand-off between the tabs is pinned to the web.esphome.io origin and protected by a one-time token, so only the flasher tab your dashboard opened can receive the firmware, and nothing else. If you want to see the details, the sender side is usb-flasher.ts (device-builder-frontend/src/util/usb-flasher.ts at 3ade3995dba1087d6cfa6fd3d2bdf9519f0b4e59 · esphome/device-builder-frontend · GitHub), the receiver is esphome-web-flash-receiver.ts (device-builder-frontend/src/web/flash-receiver/esphome-web-flash-receiver.ts at 3ade3995dba1087d6cfa6fd3d2bdf9519f0b4e59 · esphome/device-builder-frontend · GitHub), and you can watch your browser’s network tab during a flash to confirm no request carries your firmware anywhere.

And as noted above, Firefox 151 added WebSerial support, so this now works in Chrome, Edge, and recent Firefox.

12

Thank you very much for your detailed and clear explanation. It completely addressed my privacy concerns and helped me understand how the flashing process actually works. I really appreciate the time you took to explain the browser restrictions and the security design behind it. Greatly appreciated!