Skip to content
Free public beta until December 4, 2026: every course is open, no card needed. After that, the first chapter of each course stays free and full access is a one-time $39 ($19 for up to 100 founding members chosen for helpful feedback). Your progress is kept. How the beta works

secure boot

The chip runs only code signed by a key whose digest is burned into eFuse (Secure Boot v2 on ESP32).

Secure boot is the boot-time verification that each loaded image is signed by a key the device was provisioned to trust; ESP32 Secure Boot v2 checks an RSA-PSS or ECDSA signature block against public-key digests stored in eFuse.

Examples

  • With Secure Boot v2 on, an ESP32 refuses to boot an app image not signed by a key whose digest is burned into eFuse.

  • Secure boot doesn't stop someone reading the flash, installing an older signed image, or using a leaked signing key.

See also

chain of trust root of trust flash encryption
Read the full section →