That’s a topic that gets really complex. I’ve read so much conflicting info on it that I’ve kinda given up. I just put a 100nF X7R capacitor with a voltage rating at least 2x what it’s expected to see on each pin and call it a day. If it’s a power supply pin then I’ll do a 10uF version of the same thing, usually in a 1206 package as well.
That comment was about putting the decoupling cap on the ‘power’ pins of the ESD suppressor, though, because it’s the type that has an internal diode bridge that directs energy into the rails, as well as its internal TVS.
This is the type that I suggested:
Each IO pin has a diode to Vcc and a diode to ground. That’s basically the same structure that’s in the ESP32, just that it won’t be designed to handle a lot of current because they’re trying to cram a ton of other stuff onto that die and using tiny structures in order to keep the die size and subsequently costs down. In this device it’s designed to take much higher pulses of current specifically for ESD strike situations, although it’s still relatively small as protection devices go as can be seen by it’s 4.5A rating, it’s a ‘bit extra’ protection, not anything super bombproof.
So when the ESD strike occurs, it’s basically the same as having a tiny capacitor charged to several kV connected directly to the incoming pin. With no protection devices that voltage will get applied directly to the ESP32 and lead to a lot of current flowing where it shouldn’t, burning out the pathways on the chip.
These devices work by redirecting that energy elsewhere, ideally before any of it gets to the ESP32 but in reality more like sharing it out. With a plain TVS is is basically just a big zener diode with a crappier datasheet. Assuming a positive ESD strike, the one you posted above will do nothing until the voltage gets to around 16V then it will start conducting. As the voltage continues to try to rise it will start conducting more with its terminal voltage rising accordingly until it sees ~18V at a few amps or whatever. Depending on how serious the ESD strike is, the current will keep rising to a point and then start to drop back as the capacitor is discharged into the device. The TVS is just there to try to reduce how much of that ~10kV actually makes it to the ESP32 or other devices, or even the circuit board traces themselves. You’ll never actually see that 10kV because things will start to break down and conduct before that, which makes the explanation difficult, but if the TVS was soaking up 4-5A at 20V then if it wasn’t there that same current would have to go through the ESP32, eventually. The TVS is designed to handle that, though, and so it survives, just getting a little warm in the process as the energy is dissipated in the lossy semiconductor junction.
With the diode bridge style then ideally they’re connected with the Vcc and 0V pins to your rails. As the ESD event happens and the voltage starts to rise the diode between the IO pin and Vcc starts to conduct and essentially ‘clamps’ it at Vcc. For a small strike and low current that might keep it to Vcc + 0.5V, let’s say. For a larger strike there will be more voltage between the IO pin and the Vcc pin but it also starts to depend on what happens to the Vcc pin. Maybe it ends up going to Vcc + 2V at 4A, let’s say. The next part of that is where the energy goes because all that diode is doing is steering it to the Vcc connection. If there’s nothing else connected to the Vcc pin then the internal TVS will start to conduct and the voltage will rise to 11V or so. If the Vcc pin is connected to the voltage rail then the rail itself will start to rise, charging the capacitors. An ESD strike has a lot of voltage but not actually that much energy, fundamentally. It just delivers it very fast and in such a way that a lot of bulk capacitance like electrolytic capacitors won’t be able to ‘keep up’ and respond. That’s why having a decent high-frequency decoupling cap on the pins is a good compromise, it’s not so much energy that it can entirely swamp the ESD strike but it’s fast enough that it can respond and absorb some to limit the voltage rise further. The other nice thing about having the strike redirected to Vcc is that it can cause Vcc to rise slightly during the event which also helps to protect the IO pins. Usually the damage to the IO pins is because of them exceeding Vcc and causing parasitic conduction within the die. If Vcc rises along with the IO pin then this doesn’t happen. Of course, that puts you at risk of damaging the entire chip with Vcc getting too high but that’s less likely given the limited energy of the ESD strike and the number of decoupling capacitors around the place.