WHOOP 5.0 / MG on NOOP — what works, what doesn't, and why (read first)

[NoopApp]

Canonical status for everyone on a WHOOP 5.0 or MG. If you've opened (or are about to open) an issue about deep data / R22 / steps or history not syncing — please read this first. It consolidates the findings from a lot of community testing.

✅ What works today

• Live heart rate — works well. On the 5/MG it's PPG-derived (optical), streamed continuously. Continuity over chest-grade precision, but solid and instant.
• Haptics / buzz — works on most 5/MG straps.
• History offload (recovery / strain / sleep computed from the strap) — works once the strap is "clocked" (see below).
• Standard motion + HR backfill — works.

⏰ The clock prerequisite — the #1 cause of "only HR, no history or steps"

A WHOOP 5/MG that's been reset or unpaired from the official app banks nothing to its flash until it's been "clocked" (handed a valid time reference). Until then you get live HR only — no history, no steps, no sleep. NOOP clocks it automatically, but the first offload needs a sustained connection.

If you're stuck on HR-only: stay connected for a few minutes and watch the strap log for a line like Backfill: session persisted N rows. If that line never appears, the strap isn't banking yet — keep it connected and charged; it usually starts within a session or two.

🔒 R22 "deep data" — why it's a dead end (for now)

The big recurring one. The R22 enable sequence works — straps acknowledge all 15/15 flags. But the stream that follows is DTLS-PSK encrypted with a per-strap key negotiated between the strap and the official WHOOP app at first pairing. (Credit to @Extazian for identifying the encryption, and @Joshsil03, @darylbleach and @subscriptiondestroyer for the captures that nailed it down.)

• The type-0x2F packets after R22 enable are ciphertext — useless without that unique per-strap key.
• Nobody has publicly extracted a 5.0 per-strap key, so deep-data decoding isn't possible today.
• A universal bypass would require the key derivation to have a predictable weakness (serial-based, weak KDF). That's unknown — and not assumed either way.

NOOP's position: we won't build or ship key-extraction tooling (for example, pulling the PSK out of an iOS Keychain backup). That crosses the line from "read your own strap over Bluetooth" into circumventing the official app's encryption — which can put your WHOOP account at risk, and isn't what NOOP is. NOOP stays a clean, offline, Bluetooth-only reader. The R22 sequence is implemented and ready the moment a safe key path ever exists; until then, cloud-equivalent deep scores for 5/MG simply aren't available.

🩸 SpO₂

Raw red/IR optical values only — no validated SpO₂ number. We walked back an earlier SpO₂ claim honestly rather than show a figure we can't stand behind.

👟 Steps

The 5/MG reports steps, and NOOP surfaces them once history syncs (same clock prerequisite as above). WHOOP 4.0 steps aren't readable off the strap yet.

---

Bottom line: on a 5/MG, NOOP gives you excellent live HR + motion + — once clocked — history and scores. That's already a real alternative to a subscription. Full cloud-score parity is gated behind per-strap encryption nobody has cracked. We'll update this thread the moment that changes.

Live trackers: R22 deep-data → #278 · steps/history sync → #276.

[spasypaddy]

Does auto detect of activities work?

[NoopApp]

@spasypaddy yes — NOOP auto-detects workouts from your heart rate + motion (no need to start/stop one manually), and you can rename, edit times/sport, delete, or dismiss a false detection afterwards. It works on all three platforms. It's heuristic (a sustained elevated-HR bout), so very short or very gentle sessions can be missed — those you can add manually. On a WHOOP 5.0 specifically, live HR drives it fine.

[spasypaddy]

@NoopApp thanks. It did an awful job just now on a 2.5hour road bike ride. Can i send data?