Phone Stalkerware Check: Scan an Android Over USB

Check an Android phone

If someone else may be watching your phone, read this first.

Turning on developer options changes your settings, and someone who checks your phone may notice. Removing a monitoring app can be noticed too, and it deletes evidence. Check on a computer the other person has never used, and talk to a domestic violence advocate before you remove anything. In the US, The Hotline is at thehotline.org. Our phone safety guide explains why.

You need: the Android phone to check, a USB data cable, and Chrome, Edge or Opera on a computer. Chrome on a second Android phone also works with a USB-C cable.

On the phone, open Settings › About phone and tap Build number seven times. (Samsung: About phone › Software information.)
Open Settings › System › Developer options and turn on USB debugging.
Plug the phone into this computer, then press the button below and pick the phone.
On the phone, tap Allow when it asks “Allow USB debugging?”.

Read-only: the check runs listing commands and changes nothing on the phone. Nothing is uploaded. It cannot see inside apps, messages or photos.

What does it check?

Known stalkerware and monitoring apps. Package names are matched against Echap’s indicator list: 149 stalkerware and 27 “watchware” apps Echap: stalkerware-indicators, CC BY 4.0 (retrieved 23 Oct 2026).
Renamed copies (optional). The signing certificate of each app installed outside an app store is compared with the 488 certificates on the list.
Hidden apps. Apps with no icon in the app list, especially ones not from an app store.
Powerful access. Accessibility services, notification readers, device admins and a device owner, plus apps allowed to install other apps.
Permissions for the apps above: texts, call log, microphone, camera, location and contacts.
Rooting. An “su” program or a test-keys system build.

The approach follows open-source tools such as spytrap-adb spytrap-adb: stalkerware checks over ADB (read 23 Oct 2026) and Amnesty’s Mobile Verification Toolkit Amnesty Mobile Verification Toolkit documentation, without installing anything.

What should I do if it finds something?

Do not rush to delete it. The Coalition Against Stalkerware says removal “may be detected by the abuser” and that deleting stalkerware also deletes evidence Coalition Against Stalkerware: information for survivors (checked 23 Oct 2026). NNEDV warns that some people escalate when stalkerware is removed NNEDV Safety Net: phone stalkerware (checked 10 Oct 2026).

Save the report somewhere only you can reach, and note the date.
Get support. In the US, The National Domestic Violence Hotline can help plan next steps The National Domestic Violence Hotline. If you are in immediate danger, call your local emergency number.
Use a safer device to research and contact help, one the other person has not had access to Coalition Against Stalkerware: information for survivors (checked 23 Oct 2026).
Check accounts too. Our phone tracking guide covers Google account devices, location sharing and trackers.

How do I turn on USB debugging?

Tap Build number seven times, then switch on USB debugging in Developer options. Google’s steps: open Settings › About phone › Build number (Samsung: About phone › Software information › Build number) and tap it seven times. Developer options then appears; on Android 9 and later it is under Settings › System Android Developers: Configure on-device developer options (read 23 Oct 2026).

Cable. Use a data cable. Some cables only charge, and the phone will not show up.
Windows. Windows lets only one program use the connection. Close Android Studio or run adb kill-server if you use ADB Tango ADB: WebUSB connection docs (read 23 Oct 2026).
Phone to phone. Chrome on Android supports WebUSB caniuse: WebUSB browser support (read 23 Oct 2026), so a second Android phone with a USB-C cable can do the check.
Afterwards. Unplug, tap Revoke USB debugging authorizations, and turn USB debugging off.

What can it not do?

It cannot read inside apps, messages or photos. It only lists apps and settings.
It is not a full forensic exam. Mercenary spyware such as Pegasus hides far better than commercial stalkerware. Our phone guide explains where to get expert help.
The list is not complete. It covers known products, and new ones appear.
Legitimate apps can trip the warnings. Password managers use accessibility, smartwatches read notifications, and work phones have device admins. A warning means look closer, not panic.

Sources

Frequently Asked Questions

How does the phone stalkerware check work?

Your browser connects to the phone over USB using Android’s debugging connection, the same one developer tools use. It runs read-only listing commands: installed apps and where they came from, apps with no icon, accessibility services, notification readers, device admins and signs of rooting. It compares the app names with Echap’s public list of 176 stalkerware and monitoring apps.

Does it change or upload anything?

No. The commands only list information, and the results stay in your browser. The optional certificate check copies some app files over the cable into this browser to read their signatures, then discards them. Your browser keeps a debugging key so the phone can recognise it; revoke it on the phone when you are done.

Which browsers and phones does it work with?

It needs WebUSB, which Chrome, Edge and Opera offer on computers, and Chrome offers on Android. Firefox and Safari do not support it, and no browser on an iPhone or iPad can do it. The phone being checked must run Android with USB debugging turned on.

If nothing is found, is my phone safe?

Not necessarily. The list covers known apps, and new or renamed ones may be missing. Echap’s own warning says no detection does not mean no stalkerware. Someone with your passwords can also watch your accounts without any app, so check your Google account’s devices and sharing too.

Should I delete stalkerware if I find it?

Think about your safety first. The Coalition Against Stalkerware warns that removal may be noticed by the abuser and could increase abuse, and that deleting it also deletes evidence. Make a safety plan with an advocate before you remove anything.

Can I use it to check someone else’s phone?

Only with their knowledge and permission. The phone must be unlocked and its owner must tap Allow on the debugging prompt. Checking someone’s phone behind their back can be illegal and is exactly the kind of harm this tool exists to find.

Does it work for iPhones?

No. iPhones do not offer this kind of debugging connection to web pages. For an iPhone, use Safety Check and the steps in our phone tracking guide.

Next step

Found something, or want to check accounts and trackers too? Read the phone tracking and stalkerware guide before you change anything.