WBS01 WiFi Configuration

Configure your Withings WiFi Scale via USB

Device

Not connected

About the Withings WBS01

The Withings Wi-Fi Body Scale (WBS01) is a smart scale that measures weight and body composition, syncing data to your Withings account over WiFi. It was one of the first consumer WiFi-connected scales, released around 2009.

Privacy: 100% Local

This tool runs entirely in your browser. There is no server. Your WiFi password and all communication with the scale happens directly between your browser and the USB device on your computer. No data is ever transmitted over the internet. You can verify this by disconnecting from the internet after loading this page - everything will still work.

Why This Tool Exists

The WBS01 requires WiFi configuration via USB using the "Withings Pairing Wizard" application. Unfortunately, Withings has abandoned support for this scale:

  • macOS 10.15+ dropped 32-bit app support, and the wizard is 32-bit
  • Apple Silicon Macs (M1/M2/M3) have additional compatibility issues
  • The download links on the Withings website are broken
  • Withings support tells users to buy a new scale

This tool solves that problem by implementing the USB protocol directly in your browser using WebHID. No downloads, no compatibility issues, works on any modern computer with Chrome.

How to Use This Tool

  1. Connect your WBS01 scale to your computer using a mini USB cable
  2. Click "Connect USB Device" and select "Body Scale" from the browser's device picker
  3. The tool will automatically probe the device and display its MAC address and firmware version
  4. Click "Scan WiFi" to search for nearby networks (this takes about 8 seconds)
  5. Select your network from the list, or type the SSID manually for hidden networks
  6. Enter your WiFi password and click "Connect"
  7. Note the 6-digit blindcode displayed on screen
  8. Go to withings.com/install and enter the blindcode to complete setup

How It Works

This tool uses the WebHID API to communicate directly with the scale over USB. The protocol was reverse-engineered by capturing USB traffic from the original Withings Pairing Wizard running in a virtual machine.

The scale appears as a USB HID (Human Interface Device) with vendor ID 0x1fb2 and product ID 0x0001. Communication happens through 57-byte HID reports.

When you connect to WiFi, the tool computes the WPA PSK (Pre-Shared Key) using PBKDF2-SHA1 with 4096 iterations, then sends the credentials to the scale in a two-packet sequence. The scale attempts to connect and returns a "blindcode" - a 6-digit pairing code that you enter on the Withings website to link the scale to your account.

Wire Protocol Specification

The complete USB HID protocol for the WBS01, reverse-engineered and verified byte-for-byte against the original wizard.

USB Device Information

Vendor ID0x1fb2
Product ID0x0001
Usage Page0xFF00 (Vendor-defined)
Report IDs1, 2, 3
Report Size57 bytes

Packet Structure

Each packet is 58 bytes (1-byte report ID + 57-byte payload):

+----------+--------+---------+----------------------------------+
| Type/ID  | Length | Frag ID | Payload (55 bytes, zero-padded)  |
| (1 byte) | (1 byte)| (1 byte)|                                  |
+----------+--------+---------+----------------------------------+
  • Type: 0x01 = Data/Command, 0x02 = Debug log
  • Length: Number of bytes after this field
  • Frag ID: 0x01 for single/first packet, 0x02+ for continuations

Command Sequence

Host                                    Scale
  |                                       |
  |--- Init (01 02 01 00...) ------------>|
  |<-- Ack -------------------------------|
  |                                       |
  |--- Probe Request -------------------->|
  |<-- Device Info (MAC, FW, UID) --------|
  |                                       |
  |--- Set Country (US) ----------------->|
  |--- WiFi Scan Ch11 ------------------->|
  |--- WiFi Scan Ch12 ------------------->|
  |--- Get WiFi Settings ---------------->|
  |--- Get IP Settings ------------------>|
  |                                       |
  |     [Wait 5-10 seconds for async]     |
  |                                       |
  |<-- SSID + RSSI data (async) ----------|
  |                                       |
  |--- WiFi Connect Pkt1 (creds) -------->|
  |--- WiFi Connect Pkt2 (PSK + IP) ----->|
  |<-- Connect Result + Blindcode --------|

Complete Command Reference

All commands are 58 bytes, zero-padded:

Init Command

01 02 01 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00

Probe Command - Returns device info (MAC, firmware, unique ID)

01 09 01 01 00 05 01 01 01 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00

Set Country (US)

01 12 01 01 00 0e 01 01 08 00 09 01 08 00 05 00
00 02 55 53 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00

WiFi Scan Channel 11

01 13 01 01 00 0f 01 02 04 00 0a 02 04 00 06 01
03 0b 03 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00

WiFi Scan Channel 12

01 13 01 01 00 0f 01 02 04 00 0a 02 04 00 06 01
03 0c 03 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00

Get WiFi Settings

01 09 01 01 00 05 01 01 04 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00

Get IP Settings

01 09 01 01 00 05 01 01 02 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00

WiFi Connect Command

The connect command spans two packets. The WPA PSK is computed as:

PBKDF2(SHA1, password, SSID, 4096 iterations, 32 bytes)

Packet 1 Structure:

  • Header: 01 [len] 01
  • Command: 01 00 [total_len]
  • Outer TLV: 01 01 03 00 [inner_len]
  • Credentials TLV: 01 04 00 [field_len] [ssid_len] [ssid] [pass_len] [pass]
  • Security TLV: 01 09 00 05 04 a1 73 31 81

Packet 2 Structure:

  • Header: 01 [len] 01 02 (fragment #2)
  • PSK TLV: 01 0b 00 21 20 [32-byte PSK]
  • IP TLV: 01 0c 00 06 00 00 00 00 00 00 (DHCP mode)

Response Format

The scale returns a mix of data packets (type 0x01) and debug log messages (type 0x02). The connect response includes JSON embedded in debug messages:

{"blindcode":"123456","status":205,"error":"Not yet associated"}

WebHID Implementation Note

In WebHID, the report ID is handled separately from the data. For a 58-byte protocol packet where byte 0 is the report ID:

// Send: use byte 0 as report ID, bytes 1-57 as data
await device.sendReport(packet[0], packet.slice(1, 58));

// Receive: prepend report ID to reconstruct full packet
const fullPacket = new Uint8Array([event.reportId, ...event.data]);

Resources