// the take
esp32FOTA is an Arduino/PlatformIO library that adds over-the-air firmware updates to ESP32 projects: it polls a JSON manifest on your server, compares versions, and downloads/flashes a new firmware (and optionally filesystem) image. It's for anyone shipping ESP32 devices in the field who needs update distribution without building that machinery from scratch.
RSA signature verification is a real security feature, not just HTTPS — you sign the firmware image with openssl and the device checks it before switching partitions. It supports multiple firmware 'types' in one manifest so a single server can serve different device configurations and the device only accepts matching updates. Certificate/key storage is flexible (SPIFFS, LittleFS, SD, or hardcoded progmem), and Arduino 3.x's bundled cert store means you can skip managing your own root CA for most HTTPS endpoints. Semantic version comparisons via semver.c are more correct than the naive integer-version schemes most DIY OTA scripts use.
The manifest format has a sharp edge the README itself has to warn about in bold: if you set a `url` field, host/port/bin/spiffs/littlefs are silently ignored, so a misconfigured manifest can skip a filesystem update with no error. SPIFFS/LittleFS updates have no A/B redundancy like the OTA0/OTA1 firmware partitions — a failed filesystem update can brick that partition until a manual format, which is a real risk for unattended field devices. Compression (zlib/gzip) and signature verification are mutually exclusive, so you have to choose between bandwidth savings and integrity checking, not both. It also leans on two separate external libraries (esp32-flashz, ESP32-targz) just for compression support, which is more third-party surface area to track for a feature this core to an OTA library.
We read the README, the directory tree and a key source file in October 2026. Nobody pays to be listed. How we judge →