# flipper-zero-bad-usb: a payload collection for typing into other machines > flipper-zero-bad-usb is a collection of BadUSB scripts for the Flipper Zero, a hardware device that emulates a USB keyboard, with payloads organised per target operating system and a usage agreement attached to the download. It suits a user who wants to automate typing on a machine they control, and it is the same class of device that red team operators and pranksters reach for, so the legal and ethical questions are part of the product. **SeenKid/flipper-zero-bad-usb** — My collection of BadUSB scripts for the Flipper Zero. By downloading the files, you automatically agree to the license and the specific terms in the ReadMe. - Repository: https://github.com/SeenKid/flipper-zero-bad-usb - Website: https://links.seenkid.dev - Stars: 686 · Forks: 76 - Language: Batchfile - License: MIT - Published: 2026-10-21 · Updated: 2026-10-21 · Language: en - Canonical page: https://hysenlabs.com/projects/seenkid-flipper-zero-bad-usb ## The device is a keyboard, and that is the whole mechanism A BadUSB payload is a sequence of keystrokes that the Flipper Zero sends to a computer as if a keyboard had typed them. That is the entire mechanism, and everything else in this repository is a collection of such sequences. The project description calls it a collection of BadUSB scripts for the Flipper Zero, and the topics list names the format explicitly with duckyscript and rubber-ducky-script alongside flipper-zero, flipperzero-firmware and keyboard. The primary language recorded for the repository is Batchfile, which is the tell for how these are written: text files of timed keystroke lines rather than code in a conventional sense. Two details in the project documentation's header set the tone for the rest of it. There is a warning that some scripts may not work on slow computers, with the note that you can add more delay to make them work. And there is a note that if your anti-virus does not let you download the release, you should download the bad-usb-without-memz version instead, which is the packaging detail that trips people up most often. The M5Stack caveat appears twice, once in the header and once in the requirements: it might work with M5Stack products, but the author is unable to provide support because they do not own those devices. That is an honest limitation stated in two places, and worth repeating here rather than discovering later. ## Installing is a file copy into the SD card, not a build The installation section is short because there is nothing to compile. The requirements are a Flipper Zero, with the M5Stack caveat attached, and an internet connection. The installation itself is: download the repository from the releases page, drag and drop the repo files into qflipper at SD Card/badusb, and you are ready. Then there is a verification step that is easy to skim past and expensive to skip: double check that the keyboard layout on the Flipper Zero is the same as on the computer. That last point is the difference between a payload that works and a payload that appears to do nothing, because the device is emitting key codes and the target interprets them through its own layout table. A French AZERTY machine will receive a qwerty sequence and produce a different character, and the symptom is a string of wrong letters rather than an error. The layout question also explains the directory structure. The top-level entries are windows10/, windows11/, Android/ and Iphone/ alongside utils/ and a .github/ directory, so the payloads are grouped by the operating system they were written for, and the utils/ directory holds the images and supporting material referenced from the header. The version history tracks the same axis. The releases are 1.0 for Windows 10 and 11, dated 2023-03-21, then 1.1 for iPhone and Android support on 2023-03-31, then 1.2, described as a long overdue edition, on 2024-07-16. The last push to the repository was on 2026-06-21. ## The usage agreement is part of the download This is the part of the project that makes it different from a plain script dump, and it is worth reading closely. The repository description states that by downloading the files, you automatically agree to the license and to the specific terms in the project documentation. And the usage agreement section opens by saying that by downloading and using the scripts provided, you are automatically agreeing to the following usage agreement, and if you do not agree, please refrain from downloading or using the scripts. The five terms are worth quoting because they are unusually direct. You acknowledge that SeenKid is not responsible for your actions or any damage you may cause as a result of using the scripts. You are permitted to share all of the files. You are allowed to modify the files, but are still responsible for your own actions. If you are using the scripts in your own repo, please consider giving credits. And please check the license file. So the sharing terms are permissive, the modification terms are permissive, and the responsibility terms are absolute. The licence recorded in the metadata is MIT and the tree carries a license.md file, and there is a SECURITY.md in the repository as well, so the terms are distributed alongside the payloads rather than being implied. The sponsoring section asks for help with the project, and the credits section names UNC0V3R3D. The contact is a Discord, and there is a Discord server link in the header. The homepage is links.seenkid.dev. ## Where this belongs, and where it does not The honest assessment has to name the dual use, because a USB device that types into any machine is the same object in a security assessment and in a prank. What the collection actually contains is a set of automation payloads. The mechanism is keyboard emulation, and the payloads are for automating typing on a machine you control: a configuration sequence, a text expansion, a scripted interaction. Nothing here is an exploit, and there is no vulnerability to patch. The risk is entirely in what a keyboard can do when it is aimed at a machine where a human would have been asked to confirm something, which is why the project attaches a usage agreement to the download and states the author is not responsible for your actions. The boundary that matters in practice is authorisation. A BadUSB payload is a way of making a machine accept input from a device that a person is not sitting at. On your own laptop, plugging in a Flipper and running a setup macro is a convenience. Plugged into a colleague's machine, an office terminal or a kiosk, the same payload is a way of taking actions on a machine whose owner did not know a device was attached, and on a locked screen it is a way around the physical presence requirement. So the first question for anyone evaluating this is not technical. It is whether the machine is yours and whether the operator is the person who would have pressed the keys. The repository's own framing, the usage agreement attached to the download, is an acknowledgment of exactly that, and a team deploying one of these payloads in a corporate environment should expect the security team to ask the same question. The second practical limit is that these payloads are text. They are as reliable as the layout table, as reliable as the target machine's timing, and as reliable as the person who wrote them understanding what the application expects. A payload that clicks through a wizard works on the machine it was written for, and the warning about slow computers and adding delay is the acknowledgment that this is true. ## Where flipper-zero-bad-usb is the wrong tool The first limit is that it does not solve the problem it appears to. If you want to run the same setup on twenty machines, a payload collection is the wrong shape, because a device per machine is a device per machine. A configuration management tool that talks to the operating system is the right answer for that, and a device that presents itself as a keyboard cannot. The second is the fragility. The payload is a sequence of keystrokes with timings, and it is sensitive to the layout, to the speed of the machine, to the application version, and to whether a dialog appeared where the script did not expect one. The project documentation's own warning about slow computers is the honest summary, and the fix is to add delay, which makes the payload slower and more brittle in the other direction. The third is that the collection is unversioned against its targets. The release names track operating systems, 1.0 for Windows 10 and 11, and the directory names are the operating systems, but nothing documented ties a payload to a specific application version, and a script that clicks a button by position will break when that button moves. The fourth is the security tooling comparison. A device that types into a machine is also the basis of the red team and phishing demonstration tooling, and a team buying hardware for legitimate automation is buying the same object. The difference is entirely in the authorisation and in the environment, and the project is candid about the first and silent about the second. The fifth is the support boundary. M5Stack products are mentioned as possibly working with no support offered, because the author does not own those devices, and the last release was in 2024 with the last push in June 2026. A payload collection is only as good as the person maintaining it, and this one is one person. ## Conclusion flipper-zero-bad-usb is worth a look if you own a Flipper Zero and want a starting set of keyboard emulation payloads for a machine you are authorised to work on, because the collection is organised per target operating system, the install path is a file copy rather than a build, and the project publishes a usage agreement that says plainly what you may do with the files. It is the wrong thing to download if you are looking for a security tool, because the payloads automate typing rather than exploit anything, and it is the wrong thing to run on a machine you are not authorised to touch, because the device is a keyboard and a keyboard can approve anything. Before you use it, check the three things the project itself flags: that the keyboard layout on the Flipper Zero has to match the layout on the target computer, since a mismatched layout is the most common reason a payload does nothing useful; that some scripts may not work on slow computers and need more delay added; and that the scripts are provided as is with the author explicitly not responsible for your actions or any damage you cause, which is the arrangement to read before you point the device at someone else's desktop. ## FAQ ### How do I install the flipper-zero-bad-usb scripts? Download the repository from the GitHub releases page, drag and drop the repo files into qflipper at SD Card/badusb, and the device is ready. The project documentation then tells you to double check that the keyboard layout on the Flipper Zero is the same as on the computer you are targeting. ### What licence are the flipper-zero-bad-usb scripts under? The repository is recorded as MIT licensed with a license.md file in the tree, and by downloading the files you automatically agree to the licence and to the specific terms in the project documentation. The usage agreement permits sharing all of the files and modifying them, asks for credits if you use them in your own repo, and states that the author is not responsible for your actions or any damage you cause. ### Why does a flipper-zero-bad-usb payload not work on my machine? Two reasons are called out in the project documentation: the keyboard layout on the Flipper Zero has to match the layout on the target computer, and some scripts may not work on slow computers, in which case you need to add more delay. The payloads are stored per target operating system, in the windows10/, windows11/, Android/ and Iphone/ directories. ## Sources - [License: MIT](https://github.com/SeenKid/flipper-zero-bad-usb/blob/main/LICENSE) - [Project website](https://links.seenkid.dev) - [README](https://github.com/SeenKid/flipper-zero-bad-usb/blob/main/README.md) - [Releases](https://github.com/SeenKid/flipper-zero-bad-usb/releases) - [SeenKid/flipper-zero-bad-usb on GitHub](https://github.com/SeenKid/flipper-zero-bad-usb) --- Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/seenkid-flipper-zero-bad-usb