Spyware check · October 2026
Check for known spyware traces
Compare a message, a link or an Android phone collection with published traces of mercenary spyware and of phone-monitoring apps. Everything is compared in your browser. Nothing you check is uploaded, stored or sent anywhere.
What the lists currently cover: infrastructure and app traces from Amnesty International's own investigations (NSO Group 2018 and Morocco 2019, FinFisher, Wintego Helios, NoviSpy, and a 2023 Android campaign), and 174 phone-monitoring apps listed by Echap. They do not currently include indicators for Pegasus after 2019, Predator, Graphite, Candiru or Cellebrite: those lists are held back until their reuse terms are clear. A check here cannot detect anything those lists would.
If you think you are being targeted right now, get expert help first. You do not need to run any check before asking.
Journalists, activists, human-rights defenders and civil society: the Access Now Digital Security Helpline (free, 24/7, many languages) or Amnesty International's Security Lab.
Worried that someone close to you is monitoring your phone? Read Is my phone being watched? first: changing settings or removing an app can be noticed by the person monitoring you.
01What this page can and cannot check
| What | Here | How |
|---|---|---|
| A message or a link you were sent | Yes, no installation | Paste it below. This checks the text, not your phone or computer. |
| An Android phone | Experimental, advanced | Needs a separate download (AndroidQF) and a collection made from a computer. Tested only with synthetic collections so far. |
| An iPhone | Not here | Use the offline toolkit or ask a helpline. |
| A computer | Not here | A web page cannot read your computer's records, and should not be able to. Use the offline toolkit. |
02Load the indicator lists
The comparison needs about 7 MB of published lists. Pressing the button downloads them from this site (savesavesavesave.xyz). Like any page visit, our hosting provider, Cloudflare, receives the request with your IP address and browser details. It does not receive anything you check: that never leaves this tab. No other site is contacted.
Lists, versions and licences
03Check a message or a link
Links in it are never opened or contacted.
04Advanced: check an Android phone collection Experimental
Experimental, with limited validation. This route has been tested only with synthetic collections, not yet with a real phone's collection. Results may be incomplete or fail on real collections. It needs a separate program, AndroidQF, run on a computer with the phone connected by USB.
Show the experimental Android route
This route needs a separate program, AndroidQF from the Mobile Verification Toolkit project, run on a computer with the phone connected by USB. It copies records from the phone into a collection on your computer. Only make a collection of a phone that is yours, or with its owner's agreement.
How to make a collection
- On the phone: Settings → About phone, tap Build number seven times, then turn on USB debugging in Developer options.
- Connect the phone to the computer and tap Allow on the phone.
- Download AndroidQF and run it. Answer: backup Only SMS; app copies Only non-system packages; remove trusted copies No; intrusion logs No; hash files No; browser history and Magisk No.
- Afterwards, turn USB debugging off, and in Developer options choose Revoke USB debugging authorisations. Delete the collection from the computer when you no longer need it.
A full AndroidQF collection holds much more than this page reads: system logs, settings, a bug report and, if you choose it, your SMS messages. This page reads only the app list, system properties, running processes and file list. To collect only the app list, run AndroidQF with -module packages -download none -backup none; the other checks will then be listed as not checked.
The collection is read in this tab only, and only the files the checks need. It holds private information about the phone: keep it on your computer.
05iPhones and computers: the offline toolkit
The lists and much of the checking logic come from Zero Breach Toolkit, a free, open-source tool that runs on your own computer with no network during the check. It also reads iPhone backups and the records of Windows, macOS and Linux computers. It needs Python and about 20 minutes.
06How to read a result
- Known indicator matched: something in what you checked is on a published list. It is a reason to look closer and ask for help, not proof of infection. Each match shows its evidence and source.
- No known indicators matched: nothing in what was checked is on the lists. It is not proof of safety: new spyware is on no list, and every result shows what was not checked.
- Could not complete this check: the input could not be checked, and the result says why.
- Results are not saved. "Save this result" downloads a copy only when you press it; "Clear" removes the result and the input from the page.
Indicators: Amnesty International's Security Lab (CC BY 2.0) and Echap (CC BY 4.0), copied unchanged from their published repositories. Checking logic ported in part from Zero Breach Toolkit (Apache License 2.0). Licences, file origins and credits. Every result is an automated comparison with published lists, not a forensic examination.