The fundamental information-theoretic limits of covert, or low probability of detection/intercept (LPD/LPI), communication have been extensively studied for over a decade, resulting in the square root law (SRL): only L √ n covert bits can be reliably transmitted over time-bandwidth product n, for constant L > 0. Transmitting more either results in detection or decoding errors. The SRL imposes significant constraints on the hardware realization of mathematically guaranteed covert communication. These preclude the use of standard link maintenance operations that are taken for granted in non-covert communication. Thus, experimental validation of covert communication is under-explored: to date, only two experimental studies of SRL-based covert communication are available, both focusing on optical channels. Here, we demonstrate provably secure covert radio-frequency (RF) communication using software-defined radios (SDRs). We combine system design, theory, and experiments by 1) developing a sparse-signaling pulse shape to enable covert transmission of data in an environment with potential mobility, 2) proving the covertness of the resulting system, and 3) validating the theoretical predictions by implementing it on SDRs. We uncover and address unique challenges specific to using SDR architecture for covert communications. This opens practical avenues for implementing covert communication systems and raises further research questions.