Anti-Spy Tools
Eight free browser tools for anyone checking a rental, a meeting room, their own network or their own cameras for surveillance: sense the room with your phone, name the device you found, and check what is exposed. Each tool says what it measured and what it cannot see.
Sensor readings are taken in your browser and stay there. The camera probe and the CVE feed use the pwnsy API.
What this browser can sense
Feature checks only. A rear camera or a working magnetometer is confirmed when a screen asks for permission.
Start from your situation
Pick one for an ordered route.
Sense the room
Use the device in your hand.
Identify the device
Name what you found.
Check what is exposed
Public flaws and host checks.
Work the room
Follow a repeatable sequence.
No tool matches that word
Try camera, wifi, microphone or sensor, or clear the search to see all eight.
What these tools cannot do
- No radio. RF bugs, GSM listeners, analogue cameras and jammers need a spectrum analyser or SDR.
- No switched-off devices. Finding those takes a non-linear junction detector. Only the lens test sees an unpowered camera.
- No wifi or Bluetooth scan. No web API lists nearby devices.
- No view of your LAN. The camera probe runs from our server and reaches public addresses only.
- A quiet screen is one measurement from one sensor, in one spot, for a few seconds.
Recently exploited camera flaws
CISA KEV, filtered to cameras and recorders.
How the anti-spy tools work
A browser reaches four things: microphone, camera, motion and magnetic sensors, and HTTP to hosts it may reach. The three sensing tools use the first three on your own device. The MAC lookup downloads a vendor registry once and runs locally. The camera probe and the CVE watch call the pwnsy API, which probes a public host or reads the CISA Known Exploited Vulnerabilities catalogue.
Why each limit exists. NLJD floods a surface with RF and listens for harmonics from semiconductor junctions, which finds powered-off electronics. That needs a transmitter and tuned receiver. Web Bluetooth only reaches a device the user picks in a chooser that advertises a service the page asked for. There is no wifi scanning API at all. Microphones roll off steeply above 16 kHz, beacons can be directional or intermittent, and a device that records without transmitting emits nothing.
How to read this page
- Sensor tools in this browser counts the three sensing tools whose browser APIs exist here. "Not on this browser" on a card means a missing API, usually the magnetometer, which only Chrome and Edge on Android provide.
- Start from your situation gives an ordered route through the tools, with the reason each step comes where it does.
- Newest camera flaw and the table below come from the CISA KEV catalogue, filtered to cameras and recorders, with FIRST EPSS scores: the modelled chance of exploitation in the next 30 days.
- Your exit address is the IP address sites see when you connect, with its network and location as the API reports them.
Anti-spy FAQ
Can my phone find a hidden camera?
The lens finder uses your phone camera and light to hunt the glint a camera lens throws back. It is the only test here that can see a camera that is switched off. A quiet result is one measurement from one spot, so treat it as one check. It does not prove the room is clear.
Can these tools detect bugs that transmit by radio?
No. RF bugs, GSM listeners, analogue cameras and jammers need a spectrum analyser or SDR. Switched-off electronics need a non-linear junction detector.
Can a website scan for wifi or Bluetooth devices nearby?
No web API lists nearby devices. To see what is on a network you run, paste your router's client list into the MAC address lookup, which names the vendor behind each address.
Do my sensor readings leave my device?
No. Microphone, camera and magnetometer readings are taken in your browser and stay there, and the MAC lookup runs locally too. The camera probe and the camera CVE list call the pwnsy API at antispy.pwnsy.com.
Why does a tool say not on this browser?
The magnetic sweep needs the Generic Sensor Magnetometer API, which only Chrome and Edge on Android provide. The ultrasonic and lens tools need the camera and microphone API, which browsers only offer over HTTPS.
Vulnerability data from the CISA KEV catalogue with FIRST EPSS scores, MAC vendor data from the Wireshark manuf mirror of the IEEE registry. Sensor readings are taken in your browser and stay there. API at antispy.pwnsy.com.