What is a WebSDR? We measured 221 of them
Short answer: a WebSDR is a radio receiver someone else owns, connected to the internet, and offered to the public through a browser page: pick a frequency, click, listen, no account, no hardware, no payment. The name covers three different pieces of software built by three different projects — WebSDR-classic (the original, University of Twente), KiwiSDR (a specific hardware product, HF-only), and OpenWebRX (open-source, often VHF/UHF-capable too) — each with its own network protocol. We built a client for all three and ran a real 48-hour listening campaign against a pool of 221 public receivers we discovered through their own public directories. Result: 18,002 decoded FT8 digital-mode messages, 8,823 distinct callsigns, from 175 countries, and 58.5% of resolvable decodes captured a complete two-way contact between two different foreign countries, neither of them the receiver's own. All of it through the ordinary public listen feature, used exactly as each operator offers it.
Why this matters now
Search "what is a WebSDR" or "public SDR receivers" today and the results are almost entirely directory pages, project homepages, and forum threads from years ago. Nobody has published a numbers-first measurement of what the live network actually looks like right now: how many receivers are really up, which protocols they speak, and what passes through them in a given window. That gap is the whole reason this post exists.
It is also not just a hobby curiosity. A peer-reviewed 2024 paper in Intelligence and National Security studied exactly this network's role as informal, crowdsourced SIGINT infrastructure during Russia's 2022 invasion of Ukraine, with online communities processing WebSDR intercepts and assessing whether that intelligence was credible enough for state security institutions to use. The public WebSDR network is not a toy; it is tradecraft that happens to be free and legal for anyone to use, which is exactly the kind of "accidental capability" we like writing about.
WebSDR vs KiwiSDR vs OpenWebRX
These names get used interchangeably online, which causes real confusion, because the three ecosystems do not share a protocol and a client for one will not talk to either of the others.
- WebSDR-classic is the original project (PA3FWM, University of Twente), with its own hand-curated network of operators. Its software is architecturally HF-first but several installations cover wider ranges.
- KiwiSDR is a specific hardware-plus-firmware product. It is hard-capped at 0–30 MHz (HF, MW, LW only) — architecturally incapable of tuning VHF weather-satellite or ADS-B frequencies, no matter what the operator wants.
- OpenWebRX is open-source software that runs on general-purpose SDR hardware (RTL-SDR, Airspy, SDRplay), and many deployments do cover VHF/UHF, including 2m/70cm ham bands and occasionally weather-satellite downlinks, when the operator chooses to expose that range.
Discovery has fragmented the same way. kiwisdr.com runs its own directory, self-reporting roughly 850–875 public receivers. The old universal aggregator, sdr.hu, shut down in June 2020 and is still mis-cited as current in search results and old blog posts — do not trust anything that points there. receiverbook.de stepped in to fill that gap and now indexes all three ecosystems together; it was our main discovery source. websdr.ewi.utwente.nl also publishes its own live directory specifically for the WebSDR-classic network.
What we actually did
A skeptic should be able to rebuild this, so here is the whole pipeline, run from our own lab box, nothing third-party involved beyond reading public directory pages and using each receiver's own listen feature.
- Discovery. Scraped receiverbook.de's KiwiSDR and OpenWebRX listings and websdr.ewi.utwente.nl's own live directory JSON for WebSDR-classic — the same data any visitor's browser already loads to populate those sites' own maps and lists. kiwisdr.com's own native directory was unreachable from our network path for the full campaign (a routing issue on our end, not a finding about the service); receiverbook.de's KiwiSDR mirror covered that gap.
- Three clients, one for each protocol. KiwiSDR: reused the open-source
kiwiclient. OpenWebRX: built from scratch by reading a live instance's own served JavaScript, including its custom ADPCM-with-sync audio codec. WebSDR-classic: built a client against its public stream, verified bit-exact against a reference decoder before trusting a single sample from it. - Verification, not a blind scan. Every candidate receiver was checked via its own public status endpoint or a brief real tune-and-listen before being added to the working pool — the same check any cautious visitor would do before settling in to listen.
- The listening task. At each live receiver, in rotation, we tuned the standard FT8 digital-mode calling frequencies on each HF amateur band (7.074 MHz, 14.074 MHz, and so on), recorded a short clip, and ran it through
ft8_lib, an open-source reference FT8 decoder, extracting callsigns, grid squares, and signal reports from any real traffic present. - Boundary, enforced in code, not just policy. Amateur HF bands only. No public-safety, police, fire, EMS, or other LMR frequencies were tuned, searched for, or decoded, regardless of what any directory happened to list. No admin, control, or configuration endpoint on any instance was touched.
Hit rate varied sharply by ecosystem, and that gap is itself a real, reproducible finding, not sampling noise:
| Ecosystem | Candidates probed | Confirmed live | Hit rate |
|---|---|---|---|
| OpenWebRX | 149 | 138 | 92% |
| WebSDR-classic | 100 | 78 | 78% |
| KiwiSDR | ~150 | 2 | ~1-in-75 |
KiwiSDR's directory listings are stale far more often than the other two: an entry that is "in the directory" has frequently gone offline, locked behind a password, or dropped off the network entirely by the time anyone tries it. The final working pool for our 48-hour campaign held 221 receivers: 2 KiwiSDR, 139 OpenWebRX, 80 WebSDR-classic, rotating through evenly so the whole pool got real airtime, not just the first few discovered.
What 221 open radios actually heard
Over 48 hours (2026-10-06 11:52 UTC to 2026-10-08 11:57 UTC), 91 of the 221 pool receivers produced at least one real FT8 decode. In total:
- 18,002 decoded FT8 messages.
- 8,823 distinct callsigns heard, resolved to a country for all but 2.
- 175 distinct countries represented.
- 58.5% of the 17,846 country-resolvable decodes captured a complete exchange between two stations in two different countries, neither of them where the listening receiver sits — a receiver in a UK bunker museum, say, overhearing a Spanish station working an Italian one.
Activity concentrated heavily on the lower HF bands, as expected for propagation conditions during the campaign window: 40m carried the most traffic (5,736 decodes), followed by 20m (3,398) and 80m (2,915), tapering off through 15m, 17m, 160m, 10m, and 12m.
One receiver did most of the work: sdr.gb0snb.com, a KiwiSDR hosted at the Kelvedon Hatch Secret Nuclear Bunker museum in Essex, UK, alone accounted for 8,770 of the 18,002 decodes, roughly half the entire campaign, simply by staying live and reachable the whole window while many other candidates came and went. The next busiest, sdr.websdrmaasbree.nl in the Netherlands, logged 743.
A worked example: 13 countries in 15 seconds
Numbers are convincing; a real decoded slice is more convincing. From a single 15-second FT8 cycle captured at GB0SNB on 14.074 MHz, 20 meters, here is exactly what came back, unedited:
| Message | What it means |
|---|---|
CQ CT1EEX IM58 | Portugal calling CQ (general call), grid square IM58 |
AM5CV EA5MR R-22 | Spain to Spain, signal report −22 dB |
CQ 2E1HAT JO01 | UK/Guernsey calling CQ, grid JO01 |
M7MOK SP8WB RR73 | UK to Poland, sign-off ("got your report, 73") |
C5R TF4M HP85 | The Gambia (special-event call) to Iceland, grid HP85 |
CQ E70A JN94 | Bosnia & Herzegovina calling CQ, grid JN94 |
A41KB EA1HDN IN91 | Oman to Spain, grid IN91 |
DL1YBI LZ2VQ R+00 | Germany to Bulgaria, signal report 0 dB |
Eight of the nine messages decoded from that one slice, two of them trimmed above for space; between them, operators in at least eight different countries, audible in the clear, through one free public receiver, with no equipment or account on our end beyond a browser-equivalent client talking to the same listen endpoint the site offers every visitor. FT8 carries no encryption and is fully published, open-spec traffic — decoding it is identical to what any licensed ham or shortwave listener does daily with free software like WSJT-X.
The one real security story: the KiwiSDR backdoor
In July 2021, security researchers disclosed that KiwiSDR firmware had shipped, since roughly 2017, with a hardcoded admin password granting full root shell access to the underlying computer, transmitted in the clear over plain HTTP, present without consent or disclosure to the broader user base. The creator added it as an informal remote-support convenience, not malice, but it meant anyone who found the password had a root shell on the device behind any public KiwiSDR, not just radio-tuning control. Roughly 600 public KiwiSDR instances were internet-reachable at disclosure; a fix shipped the same month, and most exposed units auto-updated within weeks.
It is worth being precise about what kind of story this is. It is a firmware supply-chain issue the vendor built in, not a case of individual operators misconfiguring their own deployments — an important distinction, because the natural instinct is to blame the hundreds of hobbyists running these receivers, and that is not what happened here. For comparison, current OpenWebRX ships an explicit OPENWEBRX_ADMIN_ENABLED setting specifically so an internet-facing operator can disable the admin interface entirely; its existence is the maintainers' own acknowledgment that an exposed admin UI is a real risk class, though we found no documented incident of it actually being exploited in the wild, unlike KiwiSDR's backdoor. We also searched for a published compilation of Shodan-indexed KiwiSDR or OpenWebRX exposure beyond the 2021 case and found none — a real gap in public literature, worth stating honestly as "not found," not "does not exist."
What this does not prove
Honest limits, because a number without its caveats is marketing.
- This is an opt-in, self-registered population, not an internet-wide census. Every receiver in our pool chose to list itself in a public directory. There is no claim here about how many WebSDR-type receivers exist that never opted into any directory.
- Country counts attribute the callsign, not the receiver. "175 countries heard" means 175 countries' licensed stations were audible somewhere in the pool, resolved by standard DXCC callsign-prefix lookup against the amateur-radio world database; it says nothing about where the 221 listening receivers themselves are hosted.
- One protocol, one window. We measured FT8 digital-mode traffic specifically, because it is reliably present on HF in daylight and lets us prove a receiver's antenna actually works. Voice (SSB) traffic is real but far patchier; across two separate, deliberate SSB-hunting sessions on live receivers we did not catch a clean voice contact, a genuinely useful negative result but not evidence voice traffic is rare on this network generally, just that it is harder to guarantee inside a short, unscheduled window.
- Reachability from our own network is not a finding about the service. kiwisdr.com's own canonical directory timed out consistently from our lab's network path for unrelated routing reasons; we used the receiverbook.de mirror instead rather than overclaim an outage that was specific to us.
How to listen yourself
Everything here is open to anyone, free, right now. Start at receiverbook.de, filter by type and band, and pick a receiver that shows as currently active. Open its page, tune to an HF ham band, and for a near-guaranteed signal to confirm the receiver is working, try one of the universal FT8 calling frequencies: 7.074 MHz (40m) or 14.074 MHz (20m) in upper sideband. You will hear a distinctive cluster of short overlapping tones; decode it yourself for free with WSJT-X. For the WebSDR-classic network specifically, websdr.ewi.utwente.nl's own flagship receiver at the University of Twente is the canonical starting point.
Why this matters
The public WebSDR/KiwiSDR/OpenWebRX network is a genuine, if accidental, piece of open SIGINT infrastructure: hundreds of real radios, offered by their owners to anyone, no permission needed beyond showing up. That is a remarkable thing to exist on the open internet in 2026, and the 2024 academic study of its role in the Ukraine war shows it is already being used that way by people who take it seriously. It is also, per the 2021 backdoor, a reminder that "public by design" and "secure by design" are two separate properties that do not automatically travel together — a device built for exactly one kind of public access turned out to also offer a kind nobody consented to. We measured what we could honestly measure, said plainly where our sample is incomplete, and named no operator's instance as exposed, because none of the 221 receivers in this campaign were.