I put a good amount of time into refining a phone and watch IRK capture ESPHome package. So far its been working great with iPhones, Apple Watches, iPad and Android phones like the Samsung Galaxy S25+ and Pixel 9.
My GitHub repo has the full installation instructions and covers both Apple and Android devices. It simulates two type of BLE devices: heart rate monitor for Apple devices, and a keyboard for Android phones.
Android watches that do ‘normal’ pairing could also work (see Github for details) via a third party watch app. Some watches only do ‘reverse’ pairing, which won’t work with this package.
At a high level the process is:
Flash my ESPHome IRK Capture package to your favorite ESP32 device.
Open the device in ESPHome and select heart rate or keyboard BLE emulation, depending on your device type.
Pair your phone/watch to the broadcast BLE device.
Copy the IRK from the ESPHome device page into the “Private BLE device” Home Assistant integration.
Samsung Galaxy Watches aggressively filter BLE devices, and neither the Keyboard nor Heart Sensor profile will likely appear as a pairable device in the watch’s Bluetooth settings. The app “BLE Scanner” by Stefan Thomas does list the ESP32 device on the watch, however the app does not allow pairing attempts. This appears to be an app limitation, as user reviews have also complained about the lack of pairing functionality.
Worked well with retrieving the IRKs for two Pixel phones.
Did anybody find a way, though, to get the IRKs for their Fitbits (here: Inspire 3)?
After the last device software update to 63.20001.220.31 they also seem to randomize their MAcs
Per Claude, these might be issues for ‘reverse’ pairing devices:
Many fitness devices (Fitbit, Garmin) only bond with their companion app and reject pairing from unknown centrals. The device may refuse the pairing request entirely.
Some devices require proprietary pairing flows (PIN exchange through the app, account authentication, etc.)
Even if you get a bond, the device might use a different IRK for its companion app vs. other connections.
Just wanted to say a huge thanks to @DuckDuck25 for this IRK extraction mechanism (I followed the blog post actually) was a straightforward setup and easy to implement!
Way way better than my previous methods using Arduino or psexec, at least for my iOS devices.
That’s usually due to the device not frequently broadcasting via BLE. This can be problematic on Android phones/watches. I would search for any OS options that enable more frequent BLE broadcasts.
Hi @DuckDuck25, I just wanted to say I’m super excited to finally found a working solution for discovering IRK’s of my BLE devices. Huge thanks for putting this package together — really appreciate the effort!
Quick question: I’ve got a Garmin Venu 3, and I just noticed the watch actually offers the option to connect Bluetooth headsets. I was wondering if it might be possible to integrate a headset dummy device into the IRK Capture process? That could potentially enable reverse pairing from the watch’s side.
If you think it’s worth exploring, I’d be happy to help with testing and provide feedback. Either way, thanks again for the guide!
Thanks! I tried to go down the headset path. However, there are two major flavors of Bluetooth: BLE (Bluetooth Low energy) and Bluetooth Classic. Headphones/audio usually use Bluetooth classic and not BLE. ESPHome does not support the BT classic stack. BLE can use IRKs, so I leverage the BLE stack in ESPHome. Happy to be told otherwise, but that’s where my research and trials landed. Even if BT classic was supported in ESPHome, BT classic doesn’t have the concept of IRKs and rotating MAC addresses. Identity uses a fixed address.
