BabyphoneCan a Baby Monitor Be Hacked? A Plain-English Security Guide
Yes. Internet-connected baby monitors have been hacked, and strangers have spoken to children through them. These incidents are rare compared with the number of monitors in use, but the causes are mostly preventable, so they're worth understanding.
How monitors actually get compromised
Default passwords. This is the most common weakness. Many cameras have shipped with a default login, and some manuals have printed it for anyone to read. In one widely reported case, a manufacturer said the parents had never changed the default password, while researchers had also found flaws in the camera's remote access.
Missing encryption. When the US Federal Trade Commission looked at connected baby monitors, it reported that several lacked basic protections such as strong passwords and encryption. Without encryption, anyone in a position to see the traffic can read it.
Outdated software. Security flaws get found over time. A monitor that never receives updates keeps every flaw it shipped with.
Being connected at all. A monitor that never touches the internet can't be reached from it. When security firm Rapid7 reviewed baby monitors, one model avoided the issues mainly because it doesn't connect to the internet.
What to look for
| Question | A good answer |
|---|---|
| How do I log in? | A unique password, or a key generated for your device |
| Is the stream encrypted? | Yes, end to end if possible |
| Does the video go through a company's cloud? | Only if you've chosen that and trust them |
| Can I remove someone's access? | Yes, individually |
| Does it get updates? | Yes, and it installs them |
A checklist for the monitor you already own
- Change any default password, using a long one. The UK's National Cyber Security Centre suggests three random words.
- Install firmware updates, and turn on automatic updates if available.
- Turn off remote viewing if you only use the monitor at home.
- Enable two-factor authentication if the app offers it.
- Secure your Wi-Fi with a strong password. A monitor is only as private as the network it's on.
- Remove old users and devices you no longer recognize.
- Wipe the monitor before you sell it or give it away.
How Babyphone handles this
We built Babyphone with these failures in mind:
- No default password. Each device generates its own random password, which is shared by QR code.
- Mutual proof. During connection, the two devices prove to each other that they know the secret without sending it. This proof is tied to the encrypted connection, so a tampering server would break it.
- End-to-end encryption. Sound and video are encrypted between your devices. If a direct connection isn't possible, traffic can pass through a relay, but it stays encrypted.
- No cloud recording. There's no account and no cloud storage of your audio or video.
- Individual removal. Removing a contact cuts off that device alone.
No system is perfect, and it's worth being clear about the limits. Anyone who photographs your QR code can link a device until you generate a new one. So treat it like a house key. And if one of your phones is itself compromised, no app running on it can protect you. Keep both devices updated and protected with a passcode.