What is ultra-wideband (UWB), and how does it work?

Ultra-wideband (UWB) is a short-range wireless technology that sends very short, very low-power radio pulses spread across a wide slice of spectrum, at least 500 MHz. Because each pulse lasts only a couple of nanoseconds, two UWB devices can time how long their signals take to travel between them and turn that into a distance accurate to roughly 10 cm, plus a direction if one side has several antennas.

That is why UWB technology now ships in phones, car keys, item trackers and indoor positioning systems. Its job there is measuring distance, not moving data. This article covers what the rules say counts as UWB, why short pulses give fine timing, how two-way ranging cancels clock error (derived step by step, with a small tested model), how angle of arrival works, how UWB compares with Bluetooth and Wi-Fi ranging, and what an engineer has to get right when designing a UWB product.

Scope: an engineering explainer. Regulatory figures are quoted from the US eCFR and the CEPT/ECC decision text as published in October 2026. They summarise the rules; they are not compliance or legal advice. A US rulemaking that could change the rules is open (see below).

How does UWB work? The short version

1. Find and pair over another radio. Devices usually discover each other and agree a session key over Bluetooth LE.
2. Exchange pulse packets. One device sends a UWB packet made of nanosecond pulses; the other answers after a known delay.
3. Timestamp the first path. Each receiver finds the earliest-arriving copy of the signal, which is the straight-line path, not a reflection.
4. Convert time to distance. Round-trip time minus the reply delay, halved, times the speed of light gives the distance. A third message cancels clock error (derived below).
5. Add direction if available. A small antenna array compares the signal’s phase at each antenna to estimate the angle of arrival.

The rest of this article explains each step and the rules that shape it.

UWB meaning: what counts as ultra-wideband

UWB stands for ultra-wideband, also written ultra wideband or ultra wide band. The name describes the signal: it is “wide” because it occupies hundreds of megahertz at once, rather than a narrow channel. Regulators define it precisely.

The US definition comes from the FCC’s 2002 First Report and Order (FCC 02-48, ET Docket 98-153, adopted 14 February 2002). It is codified in 47 CFR Part 15, Subpart F. Section 15.503 measures bandwidth between the points 10 dB below the strongest emission, “based on the complete transmission system including the antenna.” Call the upper point f_H and the lower point f_L. Then:

• centre frequency f_C = (f_H + f_L) / 2
• fractional bandwidth = 2(f_H − f_L) / (f_H + f_L)
• a UWB transmitter has a fractional bandwidth of at least 0.20, or a UWB bandwidth of at least 500 MHz whatever its fractional bandwidth.

A worked check: IEEE channel 5 is centred at 6489.6 MHz with a nominal 499.2 MHz bandwidth, a fractional bandwidth of 2 × 499.2 / 12979.2 ≈ 0.077. That is far below 0.20, so a device on that channel qualifies only through the 500 MHz test, and the nominal width is just under 500 MHz. The rule tests the measured −10 dB bandwidth of the real emission, antenna included, so whether a product qualifies is settled by measurement, not by the channel number.

How little power UWB is allowed

For indoor systems (§15.517) and hand-held systems (§15.519), the UWB bandwidth must sit between 3.1 and 10.6 GHz. Average EIRP in that range is capped at −41.3 dBm in any 1 MHz. On top of that, peak power in a 50 MHz bandwidth around the strongest frequency is capped at 0 dBm EIRP. To put the average limit in perspective: spread evenly over 500 MHz, −41.3 dBm/MHz adds up to −41.3 + 10·log₁₀(500) ≈ −14.3 dBm, or about 37 microwatts in total. That low power is what lets UWB share spectrum with existing services, and it is the main reason UWB is a short-range technology.

US devices fall into two classes. Indoor systems must be capable of operating only indoors and may not use outdoor-mounted antennas. Hand-held systems may work outdoors, but must stop transmitting within 10 seconds unless the associated receiver acknowledges them. Under §15.521, no UWB device may be used to operate toys, and UWB operation on board aircraft, ships or satellites is prohibited.

Europe

In CEPT countries the reference text is ECC Decision (06)04, last amended on 18 November 2022. EU member states apply comparable conditions through Commission Decision 2007/131/EC, as amended. The decision allows the full −41.3 dBm/MHz without extra mitigation only in 6–8.5 GHz. Lower and higher bands need Low Duty Cycle (LDC) or Detect-And-Avoid (DAA) techniques. Conformity under the Radio Equipment Directive is shown against the harmonised standard ETSI EN 302 065; Part 1 (V2.1.1, 2016-11) covers generic UWB devices.

Rules in motion. On 9 September 2026 the FCC circulated a draft Notice of Proposed Rulemaking, “Unleashing the Power of Unlicensed Ultra-Wideband Devices” (ET Docket 26-245). The FiRa Consortium reported on 30 September 2026 that the Commission had voted to open the proceeding. According to the FCC fact sheet, the NPRM proposes to update the definition of a UWB transmitter, modernise measurement procedures and create a new device category. It also asks for comment on the toy, ship, aircraft and satellite prohibitions and on emission limits and duty-cycle rules. Nothing changes until a final order takes effect. Other countries set their own conditions, so check each market’s regulator.

Why short pulses measure time so well

Most UWB ranging radios use impulse radio: information is carried by very short pulses rather than a continuous carrier. In the IEEE 802.15.4 high-rate-pulse (HRP) mode, the channels phones use are 499.2 MHz wide and a pulse lasts about 2 ns. The mean pulse repetition frequency is 64 MHz, so pulses are roughly 16 ns apart (Leu et al., USENIX Security 2022).

The useful rule of thumb is that time resolution scales roughly as 1/bandwidth. A 500 MHz signal can tell apart echoes that arrive about 2 ns apart, a path difference of about 60 cm. A 1 MHz-wide narrowband signal smears everything within about 1 µs, or 300 m of path, into one blob. Indoors, a signal reaches the receiver along the direct path and many reflected paths. A UWB receiver correlates the incoming signal against a known sequence to estimate the channel impulse response, then searches it for the first path rather than the strongest one. The first path is the one whose delay corresponds to the straight-line distance.

IEEE 802.15.4 defines two UWB PHYs. HRP sends many weak pulses; low-rate-pulse (LRP) sends fewer, stronger ones. Both are bounded by the same mean power-spectral-density limit (Coppens et al., IEEE Access 2022). The 2020 amendment IEEE 802.15.4z added ranging integrity and accuracy features, including the scrambled timestamp sequence discussed under security below, and MAC support for controlling time-of-flight ranging. IEEE now lists 802.15.4z-2020 as superseded. The current base standard, IEEE 802.15.4-2024, includes modes for precision ranging.

Measuring distance: time of flight and two-way ranging

Distance is the time of flight multiplied by the speed of light (c ≈ 0.2998 m/ns). A one-way measurement needs the transmitter and receiver clocks to be synchronised to well under a nanosecond, which is impractical between a phone and a key fob. Two-way ranging (TWR) avoids this: each device only measures intervals on its own clock.

Single-sided TWR, and where clock drift bites

Initiator A sends a poll. Responder B receives it, waits a reply delay, and answers. A measures the round trip T_round on its clock; B measures its reply delay T_reply on its own clock and reports it. Ideally the time of flight is T_f = (T_round − T_reply) / 2.

Now add real crystals. Say A’s clock runs fast by a fraction e_A and B’s by e_B (20 ppm means e = 20×10⁻⁶). If the true reply delay is Δ_B, then:

Tround = (2*Tf + dB) * (1 + eA)        measured by A
Treply = dB * (1 + eB)                 measured by B

(Tround - Treply) / 2 = Tf*(1 + eA) + dB*(eA - eB)/2

The first term is harmless: a 20 ppm scale error on a 10 m distance is 0.2 mm. The second term is the problem. It is proportional to the reply delay, which is hundreds of microseconds, not to the distance. With a 300 µs reply delay and a 40 ppm relative offset (+20 vs −20 ppm), the error is 300 µs × 40×10⁻⁶ / 2 = 6 ns, or about 1.8 m. Single-sided TWR therefore needs either very short, tightly controlled reply delays or a measurement of the clock offset, which the initiator can then compensate for.

Double-sided TWR cancels the offset

Double-sided TWR adds a third message. A sends a poll, B responds, and A sends a final message after its own reply delay. Each side now has one round-trip and one reply measurement:

      A (initiator)                         B (responder)
        |  poll  ------------------------->  |
        |                                    |  Treply1 (B's clock)
 Tround1|  <-------------------------  resp  |
 (A's   |                                    |
 clock) |  Treply2 (A's clock)               |  Tround2 (B's clock)
        |  final ------------------------->  |
        v                                    v

Write the true reply delays as Δ_B and Δ_A:

Tround1 = (2*Tf + dB)*(1 + eA)    Treply1 = dB*(1 + eB)
Tround2 = (2*Tf + dA)*(1 + eB)    Treply2 = dA*(1 + eA)

Tround1*Tround2 - Treply1*Treply2
    = (1+eA)(1+eB) * [(2Tf + dB)(2Tf + dA) - dA*dB]
    = (1+eA)(1+eB) * 2Tf * (2Tf + dA + dB)

Tround1 + Tround2 + Treply1 + Treply2
    = (2 + eA + eB) * (2Tf + dA + dB)

Tf_est = (Tround1*Tround2 - Treply1*Treply2)
         / (Tround1 + Tround2 + Treply1 + Treply2)
       = Tf * 2(1+eA)(1+eB) / (2 + eA + eB)
       ~ Tf * (1 + (eA + eB)/2)

The reply delays cancel exactly, even when they are unequal. What remains is a scale error of about the average clock offset, sub-millimetre at room scale. This ratio form matches the double-sided formula shown in the Ghost Peak paper’s description of IEEE 802.15.4z ranging. The cost is a third message (more airtime and energy) and the need to carry timestamps between the devices.

A small model you can run

The model below is educational. It produces the intervals each device would measure for a given true distance, reply delays and clock offsets, then applies both estimators. It deliberately leaves out antenna delay, timestamp resolution, noise and multipath, which are all covered in the design section.

// Educational two-way-ranging (TWR) model. Not a driver, not calibrated:
// it ignores antenna delay, timestamp quantisation, noise and multipath.
// All times are in seconds; ppm values describe how fast a device clock runs.

import { pathToFileURL } from 'node:url';

export const C = 299792458; // speed of light in vacuum, m/s

function check(name, v) {
  if (typeof v !== 'number' || !Number.isFinite(v) || v < 0) {
    throw new RangeError(`${name} must be a finite number >= 0, got ${v}`);
  }
}

// Single-sided TWR. tRound: measured by the initiator; tReply: measured by
// the responder (and sent back to the initiator in a message).
export function ssTwrDistance({ tRound, tReply }) {
  check('tRound', tRound);
  check('tReply', tReply);
  return ((tRound - tReply) / 2) * C;
}

// Double-sided TWR with three messages (poll, response, final).
// tRound1/tReply2 are measured by the initiator A, tReply1/tRound2 by the
// responder B. Uses the asymmetric (ratio) form, so the two reply delays
// do not need to be equal.
export function dsTwrDistance({ tRound1, tReply1, tRound2, tReply2 }) {
  for (const [k, v] of Object.entries({ tRound1, tReply1, tRound2, tReply2 })) check(k, v);
  const den = tRound1 + tRound2 + tReply1 + tReply2;
  if (den === 0) throw new RangeError('all intervals are zero');
  return ((tRound1 * tRound2 - tReply1 * tReply2) / den) * C;
}

// Produce the four intervals each device would measure for a given true
// distance. Each device schedules its reply delay in its OWN clock ticks,
// and a clock that runs fast by e reads (1 + e) x true elapsed time.
export function simulate({ distanceM, replyB, replyA, ppmA = 0, ppmB = 0 }) {
  check('distanceM', distanceM);
  check('replyB', replyB);
  check('replyA', replyA);
  for (const [k, v] of Object.entries({ ppmA, ppmB })) {
    if (!Number.isFinite(v) || Math.abs(v) >= 1e6) throw new RangeError(`${k} out of range`);
  }
  const eA = ppmA * 1e-6;
  const eB = ppmB * 1e-6;
  const tof = distanceM / C;
  const replyBTrue = replyB / (1 + eB);
  const replyATrue = replyA / (1 + eA);
  return {
    tRound1: (2 * tof + replyBTrue) * (1 + eA), // A: poll TX -> response RX
    tReply1: replyB,                            // B: poll RX -> response TX
    tRound2: (2 * tof + replyATrue) * (1 + eB), // B: response TX -> final RX
    tReply2: replyA,                            // A: response RX -> final TX
  };
}

// Demo used for the article output.
if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
  const distanceM = 10;
  const replyB = 300e-6; // 300 us
  const replyA = 500e-6; // 500 us, deliberately different
  console.log(`true distance ${distanceM} m, reply delays B=${replyB * 1e6} us, A=${replyA * 1e6} us`);
  console.log('ppmA   ppmB   SS-TWR (m)   error       DS-TWR (m)   error');
  for (const [ppmA, ppmB] of [[0, 0], [20, -20], [-20, 20], [20, 20], [10, -5]]) {
    const t = simulate({ distanceM, replyB, replyA, ppmA, ppmB });
    const ss = ssTwrDistance({ tRound: t.tRound1, tReply: t.tReply1 });
    const ds = dsTwrDistance(t);
    const f = (x) => x.toFixed(4).padStart(9);
    const e = (x) => {
      const cm = (x * 100).toFixed(2).replace(/^-0\.00$/, '0.00');
      return ((cm.startsWith('-') ? '' : '+') + cm + ' cm').padStart(12);
    };
    console.log(`${String(ppmA).padStart(4)}   ${String(ppmB).padStart(4)}   ${f(ss)}  ${e(ss - distanceM)}   ${f(ds)}  ${e(ds - distanceM)}`);
  }
}

Output for a 10 m link with reply delays of 300 µs (B) and 500 µs (A):

true distance 10 m, reply delays B=300 us, A=500 us
ppmA   ppmB   SS-TWR (m)   error       DS-TWR (m)   error
   0      0     10.0000      +0.00 cm     10.0000      +0.00 cm
  20    -20     11.7990    +179.90 cm     10.0000      +0.00 cm
 -20     20      8.2011    -179.89 cm     10.0000      +0.00 cm
  20     20     10.0002      +0.02 cm     10.0002      +0.02 cm
  10     -5     10.6746     +67.46 cm     10.0000      +0.00 cm

As derived, the single-sided error follows the difference of the clock offsets times the reply delay. When both clocks are fast by the same amount, the single-sided error almost vanishes. Double-sided TWR stays within a fraction of a millimetre in every case. The companion test file (twr.test.mjs, run with node --test) checks zero drift, ±20 ppm in all four sign combinations, unequal reply delays, a zero-distance case where single-sided TWR goes negative, and rejection of negative, non-numeric and non-finite inputs.

Locating many tags: time difference of arrival

Two-way ranging needs messages in both directions for every pair, which does not scale well to a warehouse full of tags. In time-difference-of-arrival (TDoA) systems, a tag simply transmits a short “blink”. Fixed anchors timestamp its arrival. The difference between two anchors’ arrival times puts the tag on a hyperbola, and the intersection of several hyperbolas gives its position. The tag does not need to be synchronised, but the anchors must be synchronised with each other. The tag never learns its own position unless the system sends it back (Coppens et al.). That trade-off suits asset tracking and real-time location systems, where the infrastructure needs the answer and the tag does not. TWR suits ad-hoc uses such as hands-free access, where two devices meet without fixed infrastructure.

Finding direction: angle of arrival

A receiver with two antennas a distance d apart sees a wave from angle θ (measured from the array’s boresight) travel an extra d·sinθ to the farther antenna. Comparing the carrier phase at the two antennas, known as phase difference of arrival (PDoA), gives:

dphi  = 2*pi * d * sin(theta) / lambda
theta = asin( lambda * dphi / (2*pi*d) )

Phase is only known modulo 2π. For the mapping to be unambiguous across ±90°, d must be at most half a wavelength. At channel 5 (6489.6 MHz) λ ≈ 46.2 mm, so d ≤ 23.1 mm. At channel 9 (7987.2 MHz) λ ≈ 37.5 mm, so d ≤ 18.8 mm. That is why UWB antenna arrays fit inside a phone. Add a third antenna off the first axis and you get elevation as well as azimuth. Angle plus a TWR distance gives a position from a single device.

AoA is not standardised the way the ranging exchange is. Chips compute it with proprietary methods that depend heavily on the antenna design (Coppens et al.). On Android, the UWB Jetpack library reports azimuth and elevation as angles of arrival relative to the boresight of the device’s antenna array, the normal to the back of the phone. Apple’s Nearby Interaction documentation describes a directional field of view similar to the iPhone Ultra Wide camera. A peer outside that cone returns a distance but no direction, and Apple Watch provides distance only.

Channels used by phones and cars

Both channels sit inside the 3.1–10.6 GHz US band and inside Europe’s 6–8.5 GHz mitigation-free band, which helps explain why devices sold worldwide use them. The Car Connectivity Consortium notes that UWB receivers handle distant narrowband interferers well, but they are susceptible to higher-power wideband transmitters close by, citing Wi-Fi and mobile (IMT) as examples. It has argued for keeping channel 9 free of IMT allocations.

Security: secure ranging and distance-reduction attacks

For access control, the distance is the security property. A relay attack on keyless entry makes a far-away key look close. UWB’s defence is to make the timing itself cryptographic. IEEE 802.15.4z HRP adds a scrambled timestamp sequence (STS), a pseudo-random pulse sequence generated with AES from a session key. Only the two legitimate devices can predict it, so an attacker cannot simply transmit it early. In the CCC Digital Key system, ranging keys are derived from the Digital Key authentication handshake, stored in the phone’s secure element, and given a limited lifetime.

Whether STS actually delivers that guarantee depends on the receiver:

• Ghost Peak (Leu et al., USENIX Security 2022) showed the first over-the-air distance-reduction attack on HRP ranging. It targeted Apple U1 chips, and U1 chips paired with NXP and Qorvo parts, without any key material. Reported distances fell from 12 m to 0 m with a success probability of up to 4% per attempt, using about USD 65 of hardware. Because both ends contribute timestamps, one vulnerable device is enough. The authors note this cannot be fixed at one end only.
• Singh et al. (ACM WiSec 2021) analysed 802.15.4z HRP and concluded it is hard to configure to be both performant and secure in realistic deployments.
• Luo et al. (IEEE S&P 2024) presented a reference STS receiver and argued that, with an adequate receiver design, STS can achieve secure ranging.
• On the LRP side, UWB-PR (Singh, Leu and Čapkun, NDSS 2019) reorders pulses to resist physical-layer distance shortening. The authors report ranges up to 93 m with 10 cm precision in line of sight.

Platform settings matter too. Android’s UWB guide compares static STS, configured with an 8-byte key and still susceptible to replay/relay, with provisioned STS, which uses a 16-byte per-session key and mitigates those attacks. Provisioned STS is supported on all UWB-capable devices running Android 14 or later. In practice: use per-session keys, do not trust a single ranging result for an unlock decision, and require certified implementations on both ends.

UWB vs Bluetooth (and Wi-Fi) for distance

These figures come from different organisations, measured under different conditions, and several come from parties promoting the technology. Treat them as orders of magnitude, not a benchmark.

The trade-offs cut the other way on cost and power. The Bluetooth SIG points out that UWB needs an extra chipset, and that its power consumption, though falling, is still higher than Bluetooth’s. That is why the two are usually paired. Android’s UWB API leaves discovery and parameter exchange to an out-of-band channel such as Bluetooth LE. Apple’s Nearby Interaction has apps exchange discovery tokens over Bluetooth, the network or a server. FiRa’s setup procedure and CCC Digital Key Release 3 both use Bluetooth LE before UWB ranging starts.

What UWB technology is used for

• Digital car keys. CCC Digital Key Release 3 (completed May 2021) combines UWB with Bluetooth LE for passive, location-aware entry and engine start with the phone left in a pocket or bag. NFC remains for backward compatibility and low-battery use.
• Item finding. Apple’s design guidance uses AirTag precision finding as its example: the display moves from a directional arrow to a pulsing circle as you get closer.
• Device-to-device interaction. Apple’s Nearby Interaction and Android’s UWB Jetpack library expose distance (and, where supported, direction) to apps, including third-party accessories. Android requires IoT accessories to be FiRa MAC 1.3 compliant.
• Indoor positioning and asset tracking. TDoA infrastructure tracks tags around buildings. The FCC also lists door locks, property tags and sports tags that track players and the ball.
• Imaging and sensing. The original FCC rules also cover ground-penetrating radar, wall and through-wall imaging, and medical imaging. These are separate device classes with their own limits.

Practical design considerations

Antenna placement and orientation

Direction finding only works inside the array’s field of view, so the antenna array’s boresight has to face the expected peer. Apple’s guidance says Nearby Interaction works best when iPhones are within 9 m, in portrait orientation, and facing each other with their back cameras. It also says landscape orientation reduces accuracy and availability.

Bodies, walls and non-line-of-sight

When the direct path is blocked, the receiver may lock onto a reflected or diffracted path, and that path is longer. NLOS errors are therefore mostly positive: ranges read long. In one measurement study of a person carrying a tag, median error rose to 32 cm when the body faced away from the anchor (angles above 160°). The 99th percentile was 1.53 m, with outliers up to 4.05 m (De Cock et al., Sensors 2023). Apple likewise warns that people, animals or large objects between devices reduce accuracy or availability. Design for it: use redundant anchors, filter over time, and let the application cope with missing or late fixes.

Calibration

Every radio adds a fixed delay between its timestamp point and the antenna. Coppens et al. measured pulse-shape differences between chips that alone shift timing by more than 0.5 ns, which is more than 15 cm, and note that antenna-delay calibration resolves it. Calibrate antenna delay per design, and verify it per unit if your accuracy budget needs it. AoA arrays also need phase calibration, because the angle comes straight from a phase difference.

Clocks

Use double-sided TWR, or measure and compensate the clock offset if you must use single-sided. The model above shows why ignoring it costs metres.

Power and duty cycle

Keep UWB off until it is needed. The CCC describes Digital Key ranging as triggered only after a Bluetooth LE match. During ranging the transmitter is active 1–5% of the time, and the typical daily activity factor is 0.1%.

Coexistence and regulation

Choose channels each target market allows without mitigation, or implement LDC/DAA for the European 3.1–4.8 GHz range. Keep strong wideband transmitters on the same board (Wi-Fi, cellular) from desensitising the UWB receiver. Plan for regional radio approval (FCC Part 15 Subpart F, ETSI EN 302 065 under the Radio Equipment Directive) and, where interoperability matters, ecosystem certification: the FiRa Certification Program with its authorised test labs, CCC certification for Digital Key, or Apple’s accessory programme for Nearby Interaction.

Limitations to plan around

• Range: the power limit keeps typical consumer ranging to room or car scale; Apple quotes 9 m as the best-working range for iPhone-to-iPhone.
• Multipath and NLOS: covered above. First-path detection is good, but it cannot see through a body.
• Cost and power: an extra radio and antennas, with a higher power draw than Bluetooth LE.
• Interoperability: the PHY can interoperate with the right settings. MAC scheduling, localisation methods and AoA are largely proprietary, and Coppens et al. found no commercial indoor localisation systems that interoperate with each other.

Frequently asked questions

What does UWB mean?

UWB means ultra-wideband: a radio signal whose bandwidth is at least 500 MHz (or at least 20% of its centre frequency), transmitted at very low power. In phones and cars, “UWB” usually refers to the ranging technology built on that signal.

How does ultra wideband work, in one sentence?

Two devices exchange packets of nanosecond-long pulses, timestamp when each arrives, and multiply the time of flight by the speed of light to get the distance between them.

UWB vs Bluetooth: what is the difference?

Bluetooth LE uses narrow 2.4 GHz channels. UWB spreads very low power over 500 MHz or more, mostly between 6 and 9 GHz in phones. Devices normally use Bluetooth LE to find each other and agree keys, then UWB to measure distance and direction.

How accurate is UWB positioning?

Android’s documentation describes UWB ranging accuracy of about 10 cm, and the CCC states better than 5 cm for a typical Digital Key application. Real systems are worse when the direct path is blocked: body shadowing alone can add tens of centimetres to metres.

What frequency does UWB use?

US rules place it in 3.1–10.6 GHz. Europe allows generic devices in 6–8.5 GHz without mitigation. Phones and car keys mainly use IEEE channel 9 (centre 7987.2 MHz) and channel 5 (centre 6489.6 MHz).

Does UWB work through walls?

Signals can pass through some materials, but ranging through an obstruction usually reads long and less reliably, because the receiver measures a longer indirect path or a weakened direct one. Apple’s guidance asks for a line of sight clear of people, vehicles and walls.

Can UWB distance be spoofed?

Relay attacks that work against signal-strength systems are much harder against UWB with STS. Still, researchers have demonstrated distance reduction against real HRP implementations (Ghost Peak, 2022), so security depends on the receiver design, per-session keys, and not relying on a single measurement.

Which phones have UWB?

Apple’s security guide places UWB in iPhone 11 and later iPhone models, but not every later iPhone has it: Apple’s technical specifications list an Ultra Wideband chip for iPhone 16 and none for iPhone 16e. Android’s UWB guide (as of January 2025) lists Pixel Pro models from the 6 Pro, Pixel Fold and Tablet, the Motorola Edge 50 Ultra, and Samsung Galaxy Note 20, S21+/Ultra and later, and Z Fold2 and later. Check the platform capability API at runtime rather than relying on a model list.

Related reading on Ambimat

• Mobile payments: what is NFC card emulation mode? (NFC, the fallback interface in digital car keys)
• What is token-based authentication?
• Smart card APDU commands reference (how hosts talk to secure elements)

Sources

• US Government Publishing Office, Electronic Code of Federal Regulations, Title 47, Part 15, Subpart F – Ultra-Wideband Operation (current text, retrieved 10 Oct 2026), §§15.503, 15.517, 15.519, 15.521. ecfr.gov
• Federal Communications Commission, Revision of Part 15 of the Commission’s Rules Regarding Ultra-Wideband Transmission Systems, First Report and Order, FCC 02-48, ET Docket 98-153; summary published in the Federal Register, 67 FR 34852, 16 May 2002. govinfo.gov
• Federal Communications Commission, News release: FCC authorization of ultra-wideband technology, 14 Feb 2002. fcc.gov
• Federal Communications Commission, Fact Sheet: Unleashing the Power of Unlicensed Ultra-Wideband Devices, Notice of Proposed Rulemaking, ET Docket No. 26-245, 9 Sep 2026. docs.fcc.gov
• FiRa Consortium, FiRa Consortium Welcomes FCC Vote to Modernize UWB Rules, press release, 30 Sep 2026. firaconsortium.org
• CEPT Electronic Communications Committee, ECC Decision (06)04: harmonised use, exemption from individual licensing and free circulation of devices using UWB technology in bands below 10.6 GHz, approved 24 Mar 2006, latest amended 18 Nov 2022, Annex 1 Table 1. docdb.cept.org
• ETSI, EN 302 065-1 V2.1.1 (2016-11): Short Range Devices using Ultra Wide Band technology; Harmonised Standard; Part 1: Requirements for Generic UWB applications, clause 1 (Scope). etsi.org
• IEEE Standards Association, IEEE 802.15.4z-2020, Amendment 1: Enhanced UWB PHYs and Associated Ranging Techniques, standard page (abstract, status). standards.ieee.org
• IEEE Standards Association, IEEE 802.15.4-2024, Standard for Low-Rate Wireless Networks, standard page (abstract). standards.ieee.org
• D. Coppens, A. Shahid, S. Lemey, B. Van Herbruggen, C. Marshall, E. De Poorter, An Overview of UWB Standards and Organizations (IEEE 802.15.4, FiRa, Apple): Interoperability Aspects and Future Research Directions, IEEE Access 10, 2022, doi:10.1109/ACCESS.2022.3187410 (open access; Sections III, V, VII, IX; Table 4). arxiv.org
• P. Leu, G. Camurati, A. Heinrich, M. Roeschlin, C. Anliker, M. Hollick, S. Čapkun, J. Classen, Ghost Peak: Practical Distance Reduction Attacks Against HRP UWB Ranging, 31st USENIX Security Symposium, 2022 (Sections 1, 2.1, 4.4–4.5). usenix.org
• M. Singh, M. Roeschlin, E. Zalzala, P. Leu, S. Čapkun, Security analysis of IEEE 802.15.4z/HRP UWB time-of-flight distance measurement, ACM WiSec 2021, doi:10.1145/3448300.3467831. cispa.de
• X. Luo, C. Kalkanli, H. Zhou, P. Zhan, M. Cohen, Secure Ranging with IEEE 802.15.4z HRP UWB, IEEE Symposium on Security and Privacy 2024 (abstract). arxiv.org
• M. Singh, P. Leu, S. Čapkun, UWB with Pulse Reordering: Securing Ranging against Relay and Physical-Layer Attacks, NDSS 2019 (abstract). ndss-symposium.org
• C. De Cock, E. Tanghe, W. Joseph, D. Plets, Robust IMU-Based Mitigation of Human Body Shadowing in UWB Indoor Positioning, Sensors 23(19):8289, 2023, doi:10.3390/s23198289 (open access). ncbi.nlm.nih.gov
• Android Developers, Ultra-wideband (UWB) communication (Jetpack guide: definition, STS configurations, ecosystem support), retrieved 10 Oct 2026. developer.android.com
• Android Developers, RangingPosition (androidx.core.uwb API reference). developer.android.com
• Android Developers, Wi-Fi location: ranging with RTT, retrieved 10 Oct 2026. developer.android.com
• Apple Developer, Nearby Interaction framework documentation and Initiating and maintaining a session (section “Coach the user on range, orientation, and line of sight”). developer.apple.com
• Apple Developer, Human Interface Guidelines: Nearby interactions (Device usage). developer.apple.com
• Apple Support, iPhone 16 – Technical Specifications and iPhone 16e – Technical Specifications (Cellular and Wireless), retrieved 10 Oct 2026. support.apple.com, support.apple.com
• Apple, Ultra Wideband security in iOS, Apple Platform Security guide. support.apple.com
• Car Connectivity Consortium, UWB Spectrum Regulatory Position: Car Connectivity Consortium Digital Key – The Future of Vehicle Access, 2022 (“Digital Key Operation”, “Technical Spectrum Facts”). carconnectivity.org
• Car Connectivity Consortium, Car Connectivity Consortium Delivers Digital Key Release 3.0 Specification, press release. carconnectivity.org
• FiRa Consortium, FiRa Consortium Publishes PHY Technical Requirements Specification, 7 Apr 2020, and FiRa Certification Program page. firaconsortium.org
• Bluetooth SIG, Bluetooth Core 6.0 Feature Overview (Channel Sounding). bluetooth.com
• J. Hillyard, C. Bachmann, L. Huang (Bluetooth SIG blog), Bluetooth Channel Sounding: A step towards 10-cm ranging accuracy for secure access, digital key, and proximity services, 30 Nov 2023. bluetooth.com

Written by the Ambimat engineering team. The two-way-ranging model was tested on Node.js 25.8.2.