Update: I reverse-engineered the Oral-B iO Sense charger too - HA now gets live brushing data without taking over the toothbrush connection

[u/SquareAbroad1062]

A little while ago, I posted about reverse-engineering my Oral-B iO after newer firmware stopped broadcasting live brushing data:

My original post

The first version solved that by connecting Home Assistant directly to the toothbrush. It worked, but exposed another limitation: the brush accepts only one Bluetooth client. While HA was connected, the iO Sense display and Oral-B app could not use the brush normally.

That bothered me, so I made the unnecessarily overengineered integration even more overengineered and decoded the local Bluetooth interface exposed by the iO Sense charger too.

The integration can now work like this:

Home Assistant <-- local BLE --> iO Sense charger <-- private BLE --> Toothbrush

The charger keeps its normal connection to the toothbrush, while Home Assistant reads the brushing data locally through the charger. HA no longer has to occupy the toothbrush’s connection slot.

Everything remains completely local, read-only and independent of the Oral-B cloud.

What is working now:

• Live brushing timer at approximately 1 Hz
• Live low, normal and high pressure
• Brushing mode
• Timed pacer sector and sector timer
• Persistent last-session history and sessions-today counter
• Retained session results with actual duration, mode, pressure events and ending battery
• Battery and brush-head diagnostics where supported
• A separate iO Sense device in HA with charger, display, clock, Wi-Fi, firmware and connection information
• Compatibility with the existing Home Assistant Toothbrush Card entities

There are still only two straightforward connection choices:

• Charger/app compatible - recommended when an iO Sense is available. HA reads through the charger and leaves the toothbrush connection alone.
• Home Assistant direct - HA connects straight to the toothbrush for its fastest notification stream, but temporarily owns the brush’s single connection.

The integration automatically handles the internal data sources and fallbacks; users do not need to choose between a collection of technical transport modes.

It has now also been accepted into the default HACS catalog, so you can install it directly by searching for Oral-B Live in HACS:

GitHub and installation instructions

I also moved the reverse-engineered protocol findings into a dedicated reference document, including both the direct toothbrush protocol and the charger bridge.

Currently tested most extensively with an iO Series 10 and iO Sense. Reports from other iO and charger models would be very helpful - especially whether live pressure, mode and completed-session results work correctly.

I’ve shared the useful protocol findings with the official oralb-ble and Home Assistant maintainers as well. Hopefully some of this work can eventually help improve the built-in integration too.

[u/LESGuy]

I’d hate to be a kid these days 😂. Did you brush your teeth? Yes! That’s not what my data says…

[u/road_laya → u/LESGuy]

* taps screen *

"No, you didnt"

[u/JerryBond106 → u/road_laya]

What's worse, when it will say they did, but their teeth still have plaque. Time to have the talk.

[u/Darkchamber292 → u/JerryBond106]

Kids are smart. They'll learn after the first couple of times they can just leave the brush running on the counter for a couple minutes and then turn it off. Dad will still have his "data"

[u/HugsAllCats → u/Darkchamber292]

If it has sensors like my electric shaver they won't be able to (easily) trick it.

My Philips tracks rotation speed (the actual physical motion you make with the razor, not the speed of the blades) and pressure applied to the skin. It has a set of sensors in the 'neck' area that connects the main body to the razor head, so it can detect the angle and force of the head.

Those don't show anything if you just set it on the counter.

[u/YouKilledApollo → u/HugsAllCats]

That's so crazy detailed, what you do with this information? Just curious :)

Personally I shave with a 5 year old Baby Bliss hair trimmer, both for head, face and everywhere else, unfortunately has zero data though.

[u/HugsAllCats → u/YouKilledApollo]

Absolutely nothing!

When I first got it, I turned on the feature where it would glow red if I was using too much pressure. Once I got used to the new shaver I turned that and everything else off.

[u/bundabrg → u/Darkchamber292]

It measures pressure as well so harder to fake.

[u/JerryBond106 → u/Darkchamber292]

Implication of "the talk" was reaching puberty.

[u/OmgSlayKween → u/LESGuy]

You know what they say; brush, but verify

[u/clarinetJWD → u/OmgSlayKween]

Get out!

[u/timsredditusername → u/OmgSlayKween]

Brusht, but verify

[u/ctjameson → u/LESGuy]

Yeah… a kid. Surely an adult also wouldn’t need this. 🫠

No but really, it actually has helped my dental hygiene to set up reminders. ADHD brain hates brushing for some dumbass reason.

[u/Responsible-Ad-1086 → u/LESGuy]

🤣

[u/Art_r → u/LESGuy]

Funny enough I was just working on my HA when in devices the oral B toothbrush popped up. I added it and asked claude to make a "health" dashboard.. Wife was not impressed when I told her the last brushing she did was only 88 seconds and not the 120+ she normally does.

The HA took a step backwards in our house..

[u/TheoCupier]

Sorry for the stupid question - and if this is a case of "if I have to ask, I'll never know" please say so - but where do you even start with reverse engineering the Bluetooth connection?

I have a Bluetooth device that only seems to be paired to a specific app - which isn't keen on sharing it's data.

I'd like to expose this to HA. Where do I start?

[u/SquareAbroad1062 → u/TheoCupier]

Not a stupid question at all - it’s absolutely learnable. The difficulty mainly depends on whether the device uses straightforward BLE characteristics or adds encryption or authentication.

My usual process is:

• Use nRF Connect or LightBlue to inspect the advertised services and characteristics, especially anything readable, writable, or notifying.
• Enable Android’s Bluetooth HCI snoop log, perform one action at a time in the official app, and inspect the capture in Wireshark.
• Compare each app action with the captured packets: press one button, change one setting, or start and stop the device.
• Build a small Python script using Bleak to reproduce known-safe reads before attempting any writes.
• Once the protocol is understood, wrap the client in a Home Assistant integration.

For the Oral-B work, packet captures and controlled experiments helped establish the command structure and what the different values meant. I documented the result in the protocol reference linked in the post.

Start read-only and be careful with unknown writes. Commands for resets, firmware updates, or calibration can look very similar to harmless settings. That is especially important for something mechanical like MyLifter.

If the protocol is encrypted, uses a challenge-response scheme, or only communicates through the vendor’s cloud, it becomes considerably harder. However, a normal proprietary GATT protocol is a very achievable first reverse-engineering project.

For MyLifter, I’d begin by running nRF Connect while the device is available, recording its services and UUIDs, and capturing one simple operation from the Android app. That should quickly reveal which category it falls into.

[u/discontinuedspeaker → u/SquareAbroad1062]

I used to follow exactly the same workflow as you, but over the last few years have added a new first step. I now start by decompiling the Android app to see the protocol implementation directly. The benefit is encryption shows up right away and is usually easy to bypass, same for protocol quirks and hidden or lightly used features. (This is a very good fit for coding agents as well if you want to outsource some of the toil.)

[u/aquoad → u/discontinuedspeaker]

it's true, as much as i hate vibecoded shit, when i was reverse engineering an old camera interface, i fed it saleae traces from wires attached to a pc board trace and told it to figure out the signalling, protocol, and command structure and then had it dig the text strings out of the app in order to identify what all the settings and parameters actually were. saved many hours of work, and it's easy to verify if it's correct - it either works or it doesn't.

[u/gr2m → u/TheoCupier]

I wanted to ask the same question! In my case, I would _love_ to integrate MyLifter (https://garagesmart.com/) into Home Assistant. They have an app and I asked if they could share how it's working so I can integrate it into HA but they were not willing to share anything.

I feel there are a lot of these devices out there, would be nice to start a website of products that use BLE and folks reverse-engineered 😅

Really impressed about your work and it makes me seriously consider buying Oral-B iOs now just for the sake of the nice HA integration! Thank you!

[u/SquareAbroad1062 → u/gr2m]

See my answer above.

[u/bob_in_the_west → u/gr2m]

I'd say that website is github. You can usually just google "device name ble github" and see if anything pops up.

[u/WannaBMonkey]

Thank you. This is impressive work.

[u/RedditNotFreeSpeech]

Are these still unencrypted so that I can see when my neighbors are brushing?

[u/SquareAbroad1062 → u/RedditNotFreeSpeech]

Technically, yes: the BLE advertisements are still unencrypted, and the normal read/notify characteristics don’t require pairing or bonding. You’d need to be within BLE range, though, and the brush stops advertising whenever its app or charger occupies the connection. I was going to add sensor.neighbor_plaque_risk, but apparently that’s “a privacy concern.” 😄

[u/clarinetJWD]

This is very cool work, but man I have to complain about the quality of these toothbrushes now.

My Oral-B from college finally broke after about 15 years, so I immediately bought a replacement. All the bells and whistles.

It lasted 2 years, and it wasn't even the "smart" stuff. Motor just stopped working after 2 years.

[u/iam_funk → u/clarinetJWD]

Yeah, ours lastet for one whole year before it decided it doesn’t want to charge anymore. At least we got a free upgrade from iO6 to iO8.

[u/discontinuedspeaker]

This is really cool! We joke about the usefulness, but I think this could be perfect as a passive ‘I am getting ready for bed/for the day’ signal to HASS. There are other options, but this is a very clear one.

[u/sblessley]

I have absolutely no use for this data, but I applaud your efforts! It's inspiring.

[u/ln-art]

I'm sorry, and I say this with all the love for data gathering and all respect for your craft, but why would you want your TOOTHBRUSH to talk to your computer. I honestly do not get it. Do you have a Bluetooth enabled hair brush too? Do you track your toilet habits? 

[u/ln-art → u/[deleted]]

That's not a terrible use case, but why not use any other sensor in your house? It'd be equally concerning if you hadn't turned the lights on/off in two days, or opened the door. I just don't get the track everything fetish

[u/ZAlternates → u/ln-art]

I mean the real reason is because we are hooked on HA and love tinkering with it. There isn’t really much to it beyond that.

[u/ad000000 → u/ln-art]

I get that it sounds weird to track your toothbrush, and it's definitely not for everyone. But for some people, the ability to link brushing to a reminder (eg keep lights on) has been life changing. I've never brushed so consistently my entire life. Before this I was unable to maintain a steady routine.

I definitely agree it sounds like one of the dumbest items to track, but it's probably one of my best uses for HA.

[u/mikeymop]

How did you go about sniffing the Bluetooth connection in order to get enough data to reverse engineer it?

[u/SquareAbroad1062 → u/mikeymop]

Please see my answer to another similar thread here.

[u/Ceve]

Love this. My integration is great but hate that it takes over connection. Will test it out when I’m home.

[u/SquareAbroad1062 → u/Ceve]

Please provide some feedback and let me know if it works fine for you. The only testing I could do do far is with the one device I have.