Free tool · Powered by MVT
A free spyware and stalkerware check for iPhone and Android
Our free spyware scanner runs the checks of Amnesty International's Mobile Verification Toolkit (MVT) right in your web browser. It looks for known traces of Pegasus, Predator and commercial stalkerware, with no install, no account and nothing uploaded.
How the scan works
- Android: connect the phone to a computer with a USB cable and open the scanner in Chrome, Edge or Brave. After you turn on USB debugging, the page reads app lists, settings, logs and a diagnostic report, then checks them. It usually takes 5 to 10 minutes.
- iPhone: browsers can't connect to an iPhone over USB, so you check a backup instead. Make a backup with Finder (Mac) or Apple Devices / iTunes (Windows), ideally encrypted, and open its folder in the scanner.
- Existing file: already have an AndroidQF acquisition? Check it again with the latest indicators.
What it looks for
The scan compares records from the phone with thousands of published indicators of compromise: app names, file fingerprints, signing certificates, domains and process names. They come from investigations by Amnesty International, Citizen Lab and other researchers, and cover mercenary spyware such as Pegasus and Predator, commercial stalkerware such as TheTruthSpy, and on Android, warning signs like apps from outside the Play Store, Play Protect switched off, apps using accessibility services and rooting tools.
Your phone's data stays on your computer
Everything runs inside your browser tab. The data read from the phone or backup, your backup password and the report are never sent to us or anyone else, and are deleted when you close the tab unless you download them. Once the page has loaded you can switch off Wi-Fi and run the whole scan offline. We only count how many scans are started each day, nothing about you or your phone.
Who it's for
- Anyone who suspects a partner, ex or family member is tracking their phone.
- Journalists, lawyers, activists and business travellers who could be targeted.
- Support workers and IT teams who help other people check their phones.
- Anyone who wants peace of mind after a phone was out of their hands.
If you're worried about someone close to you
If someone is monitoring your phone, they may notice you checking it or changing settings. If you feel unsafe, talk to someone first: in Australia, call 1800RESPECT (1800 737 732), and see the eSafety Commissioner's advice on technology-facilitated abuse. In an emergency, call 000.
What a scan can't tell you
No tool can prove a phone is clean. A clean result means none of the published traces were found; new or undocumented spyware leaves no known traces. Forensic tools such as Cellebrite and GrayKey, used on a phone someone has physically taken, rarely leave anything to find.
If the scan finds something
Don't factory reset or delete anything yet, because that destroys the evidence. Download the report and keep it safe. People at risk, such as journalists and human rights defenders, can ask for a free expert review from Amnesty International's Security Lab or the Access Now Digital Security Helpline. Our guide on how to check your phone for spyware explains what to do next, and if you want a phone that's harder to compromise, see our GrapheneOS phones or contact us.
Built on MVT
The scanner is Privacy First's unofficial web port of the open-source Mobile Verification Toolkit (MVT License 1.1), released by Amnesty International's Security Lab, with indicators from the mvt-indicators project. MVT runs unmodified in your browser. It is not an official MVT or Amnesty International product and is not affiliated with or endorsed by them.
Add the free scanner to your website
Support services, schools, IT teams and bloggers are welcome to link to the scanner; no permission needed. Copy one of the snippets below. The badges are a plain image or graphic and a link, with no scripts, tracking or cookies. The image badges are loaded from our site, so your visitors' browsers connect to it like any other image; the snippets send no referrer and load the image only when it scrolls into view. If you would rather your page loads nothing from us, use the inline badge.
Badge, dark
<a href="https://www.privacyfirst.com.au/scan"><img src="https://www.privacyfirst.com.au/badges/free-spyware-scanner-dark.svg" width="264" height="60" alt="Free spyware scanner by Privacy First" referrerpolicy="no-referrer" loading="lazy"></a>Badge, light
<a href="https://www.privacyfirst.com.au/scan"><img src="https://www.privacyfirst.com.au/badges/free-spyware-scanner-light.svg" width="264" height="60" alt="Free spyware scanner by Privacy First" referrerpolicy="no-referrer" loading="lazy"></a>Badge, inline (loads nothing from our site)
The same badge, dark and light, with the graphic built into the snippet itself. Your visitors' browsers only contact us if they click the link.
<a href="https://www.privacyfirst.com.au/scan"><svg xmlns="http://www.w3.org/2000/svg" width="264" height="60" viewBox="0 0 264 60" role="img" aria-label="Free spyware scanner by Privacy First"><rect x="0.5" y="0.5" width="263" height="59" rx="10" fill="#0b0b0b" stroke="#3a3226"/><path d="M30 12l14 5v10c0 9.5-6 16.5-14 20-8-3.5-14-10.5-14-20V17z" fill="none" stroke="#e8c07a" stroke-width="2.2" stroke-linejoin="round"/><path d="M24 30l4.5 4.5L37 26" fill="none" stroke="#e8c07a" stroke-width="2.4" stroke-linecap="round" stroke-linejoin="round"/><text x="56" y="28" font-family="Helvetica, Arial, sans-serif" font-size="14" font-weight="700" letter-spacing="0.6" fill="#f5f1e8">FREE SPYWARE SCAN</text><text x="56" y="45" font-family="Helvetica, Arial, sans-serif" font-size="11.5" fill="#e8c07a">iPhone & Android · Privacy First</text></svg></a><a href="https://www.privacyfirst.com.au/scan"><svg xmlns="http://www.w3.org/2000/svg" width="264" height="60" viewBox="0 0 264 60" role="img" aria-label="Free spyware scanner by Privacy First"><rect x="0.5" y="0.5" width="263" height="59" rx="10" fill="#ffffff" stroke="#d9cfbd"/><path d="M30 12l14 5v10c0 9.5-6 16.5-14 20-8-3.5-14-10.5-14-20V17z" fill="none" stroke="#8a6a2f" stroke-width="2.2" stroke-linejoin="round"/><path d="M24 30l4.5 4.5L37 26" fill="none" stroke="#8a6a2f" stroke-width="2.4" stroke-linecap="round" stroke-linejoin="round"/><text x="56" y="28" font-family="Helvetica, Arial, sans-serif" font-size="14" font-weight="700" letter-spacing="0.6" fill="#141414">FREE SPYWARE SCAN</text><text x="56" y="45" font-family="Helvetica, Arial, sans-serif" font-size="11.5" fill="#8a6a2f">iPhone & Android · Privacy First</text></svg></a>Text link
<a href="https://www.privacyfirst.com.au/scan">Free spyware scanner for iPhone and Android</a>Writing about phone spyware or stalkerware? We're happy to explain how the scanner works, or answer questions about mobile security: get in touch.
Questions
Is the spyware scanner really free?
Yes. It's free for everyone, needs no account and installs nothing, and there is no paid version.
Can I link to the scanner from my website?
Yes, no permission needed. Use the badge or text link on this page, or link to privacyfirst.com.au/scan however you like.
Is my phone's data uploaded?
No. The scan runs in your browser tab, and the phone's data, your backup password and the report never leave your computer unless you download them.
Is it an official Amnesty International tool?
No. It is Privacy First's unofficial web port of Amnesty International's open-source Mobile Verification Toolkit (MVT). It uses MVT's own checks and published indicators but is not affiliated with or endorsed by Amnesty International.
Does a clean result mean my phone is safe?
Not with certainty. It means none of the published traces of known spyware were found. Keeping the phone updated and restarting it regularly also lowers your risk.