See discussion here: https://hackaday.com/2016/07/28/ask-hackaday-is-the-esp8266-... and official reply on Facebook (of all places): https://www.facebook.com/groups/1499045113679103/permalink/1...
> Teo Swee Ann i can reply officially here: it is 5V tolerant at the IO. while the supply voltage is at 3.3V.