PRIVACY FIRSTPUTTING YOUR PRIVACY FIRST.
READY OFFLINE
FREE SPYWARE SCANNER · POWERED BY MVT
A free spyware scan for Android phones and iPhones. Connect an Android phone by USB, or open an iPhone backup, and run Amnesty International's Mobile Verification Toolkit (MVT) against published indicators for Pegasus, Predator, stalkerware and more. No installs, no accounts, no uploads.
Unofficial web port. WebMVT Scanner is PrivacyFirst's port of the open-source Mobile Verification Toolkit to the browser. It is not an official MVT or Amnesty International product, and is not affiliated with, endorsed by or supported by Amnesty International, its Security Lab or the MVT project.
This tool cannot confirm with 100% certainty whether your device is infected. It checks your device against thousands of known indicators of compromise (app names, file fingerprints, app signing certificates, domains and process names) from published investigations by Amnesty International, Citizen Lab and other researchers.
These are the checks of the Mobile Verification Toolkit (MVT), developed by Amnesty International's Security Lab and used by forensic investigators to detect mercenary spyware such as Pegasus and Predator, as well as commercial stalkerware. A clean result means none of these known traces were found; it cannot rule out new or unpublished spyware. Anything it finds should be confirmed by a forensic expert.
Everything runs locally in your browser. Your device's data, the scan and the report never leave this computer and are never sent to us or anyone else. There is no server behind this page. Once the page has loaded, you can switch off Wi-Fi and mobile data and run the whole scan offline.
Indicators last updated recently.
Published indicators for Pegasus (NSO Group), Predator (Intellexa), Candiru, Operation Triangulation, KingSpawn, NoviSpy and other government-grade spyware, from investigations by Amnesty International, Citizen Lab, Google, Kaspersky, Lookout and others.
Thousands of indicators for commercial monitoring apps sold to spy on partners and family, such as TheTruthSpy, from the Échap project's stalkerware list.
On Android: apps installed from outside the Play Store, Play Protect switched off, apps using accessibility services, rooting tools, files in suspicious places and unusual crashes.
Phone-cracking tools such as Cellebrite and Magnet Forensics' GrayKey copy data from a phone someone has taken, and rarely leave traces. The scan only catches published cases, such as the spyware Amnesty found installed after Cellebrite unlocks in Serbia. See the FAQ below.
Want the full background, including how to protect your phone? Read our guide: How to check your phone for spyware, and how to stop it getting on.
Yes. It's free, needs no account and installs nothing. It runs the Mobile Verification Toolkit (MVT) in your browser.
No. Everything happens inside your browser tab. The data read from your phone or backup, your backup password and the report never leave your computer, and are deleted when you close the tab unless you download them. The page's security policy stops it from contacting any other server, and once it has loaded you can run the scan with Wi-Fi and mobile data switched off.
It checks for the Pegasus indicators Amnesty International has published (domains, process names and other traces from its forensic investigations), along with indicators for Predator, Candiru, Operation Triangulation, NoviSpy and other mercenary spyware. Most Pegasus infections found so far were on iPhones, and an encrypted iPhone backup contains the most useful records. A clean result means none of those known traces were found; newer versions of Pegasus may leave traces that haven't been published yet.
Yes, for known stalkerware. It includes thousands of indicators for commercial stalkerware apps, such as TheTruthSpy, collected by the Échap project, and on Android it also flags apps installed from outside the Play Store, disabled Play Protect, apps using accessibility services, and signs of rooting.
Usually not, and no tool can promise this. Cellebrite and Magnet Forensics' GrayKey are forensic tools used on a phone someone has physically taken. They copy data off the phone rather than staying on it, and rarely leave traces that can be checked for. The scan only catches published cases: for example, Amnesty International found that police in Serbia used Cellebrite to unlock phones and then installed NoviSpy spyware, and the NoviSpy indicators are included. There are no published indicators for GrayKey. If your phone was taken from you and you think it was unlocked, ask an expert for help.
The Mobile Verification Toolkit is open-source forensic software released by Amnesty International's Security Lab in 2021, alongside its investigation into Pegasus. It compares records from a phone with published indicators of compromise. MVT is a command-line tool for investigators; this page is PrivacyFirst's unofficial web port of it, and is not an official MVT or Amnesty International product.
No tool can prove that. A clean result means none of the published indicators were found, which is reassuring, but spyware that hasn't been documented yet leaves no known traces. Keeping your phone updated, restarting it regularly and turning on Lockdown Mode (iPhone) or using GrapheneOS reduce your risk.
Don't factory reset or delete anything yet, because that destroys the evidence. Download the report and keep it somewhere safe. Journalists, activists, human rights defenders and others at risk can ask for a free expert review from Amnesty International's Security Lab or the Access Now Digital Security Helpline (help@accessnow.org). Until then, use a different device for sensitive conversations.
Browsers can't connect to an iPhone over USB, so you check a backup instead. Make a backup with Finder on a Mac or Apple Devices (or iTunes) on Windows, ideally with "Encrypt local backup" ticked, then choose the backup folder on this page. Encrypted backups are decrypted in your browser with your password.
Use Chrome, Edge or Brave on a computer. Turn on Developer options and USB debugging on the phone, connect it with a USB cable, and the page reads the same data as Amnesty's AndroidQF tool before checking it with MVT. It usually takes 5 to 10 minutes.
adb or Android Studio on this computer, close them first (adb kill-server), because only one program can talk to the phone at a time.Your browser will ask which device to use, then the phone will ask you to Allow USB debugging. There's no need to tick "Always allow": this page uses a new key on every visit.
Choose an AndroidQF acquisition zip (made by AndroidQF, or downloaded from this page). It is read in this browser only.
Don't close this tab.
These files are created in your browser. Store them somewhere safe: they contain information about the device.
Done with the phone? Turn USB debugging off again in Developer options.
Please wait a few minutes and do not leave this page.