Can Baby Monitors Be Hacked? How It Happens and How to Stay Safe

Yes, baby monitors can be hacked, but it is rare, and it almost always comes down to a few avoidable weaknesses: a default or reused password, out-of-date software, or a camera that can be reached from the internet. The UK's National Cyber Security Centre (NCSC) puts it plainly: live feeds from smart cameras can, in rare cases, be accessed by unauthorised users, mostly because they are set up to be viewed while you're away from home.

The safest monitor is one whose video never touches the internet at all. That's how we built Dozi, a baby monitor app that turns two iPhones or iPads into a private monitor: no cloud, no account, nothing recorded. This guide explains how hacking happens, which monitors are most exposed, how to tell if yours has been compromised, and how to keep your baby's camera private.

Has it really happened?

It has, and the best-known cases share the same causes.

• Houston, 2013. A couple heard a stranger's voice coming from their two-year-old daughter's internet-connected camera, calling her by name and shouting abuse. NBC News reported that the camera's maker had released security patches before, and pushed out a firmware update with stronger password options after the incident.
• A 2015 security study. Researchers at Rapid7 tested nine baby monitors from eight manufacturers. Eight scored an F and one a D, with problems such as built-in passwords that couldn't be changed and video sent without encryption.

Those were real failures, but they were also failures of their time. Manufacturers and governments have tightened the rules since (more on that below). The risk today is lower, but it hasn't gone away, and it still depends heavily on how a monitor connects and how it is set up.

How baby monitors get hacked

Almost every case comes down to one of these:

1. Default passwords. Some devices ship with a password like "admin" or "0000". Attackers try these first, and lists of them are public.
2. Reused passwords. If your monitor account uses the same password as another site that was breached, attackers can try that leaked password on your monitor account.
3. Out-of-date software. Security holes get fixed in updates. A camera that never updates keeps every hole it shipped with.
4. Remote access you don't use. Cameras that can be viewed from anywhere are reachable from anywhere. The NCSC recommends turning remote access off if you don't need it.
5. Router settings that open the door. Features called UPnP and port forwarding can make a device on your home network reachable from the internet.
6. An unprotected home Wi-Fi network. If someone gets onto your Wi-Fi, every device on it is easier to attack.
7. Unencrypted video. If a monitor sends its picture unencrypted, anyone who can intercept the traffic can watch it.

Which baby monitors are most at risk?

Type of monitor	How it connects	Hacking risk
Wi-Fi camera with a cloud account	Your Wi-Fi to the company's servers, viewable from anywhere	Highest exposure: reachable from the internet, and your account is only as safe as its password
App that streams only on your home network	Directly between your devices on your Wi-Fi	Lower: not reachable from the internet, but depends on your Wi-Fi security
Digital radio monitor (DECT or FHSS)	Its own radio link to a parent unit	Low: an attacker would need to be nearby with special equipment
Old analogue radio monitor	Unencrypted radio signal	Can be overheard by other receivers nearby, but not from the internet

The pattern is simple: the more a monitor is connected to the internet, the more ways there are to reach it. Remote viewing from work is convenient, but it is exactly the feature that makes a camera reachable by strangers.

The safest choice: a monitor that never goes online

Dozi takes the most common way monitors get hacked off the table: your baby's video is never on the internet.

• No cloud. Video and sound go directly from the nursery device to your phone over your home Wi-Fi, encrypted. There is no Dozi server that receives them.
• No account, no password to leak. You pair the two devices by scanning a QR code.
• Nothing recorded. There is no footage stored anywhere to be stolen later.
• Only your phone can connect. Each monitoring session creates a new one-time code inside the QR code, so only the phone that scanned it gets in. Any other device on your Wi-Fi is turned away.

You also get cry alerts on your locked phone, night vision and talk back, using iPhones or iPads you already own. Read how Dozi keeps your monitor private or how to set up an iPhone as a baby monitor.

Signs your baby monitor may have been hacked

• Voices, music or sounds coming from the monitor that you didn't make.
• The camera moving, tilting or zooming on its own.
• Settings, a password or the camera name changed without you.
• Logins or devices in the monitor's app that you don't recognize.
• The camera's status light coming on when nobody in your home is watching.
• An unexplained jump in your internet data use.

If you see any of these, unplug the monitor, reset it to factory settings, change your Wi-Fi and monitor passwords, update its software, and contact the manufacturer.

9 ways to protect your baby monitor

Most of these come straight from the NCSC's guidance for smart cameras, and they take a few minutes:

1. Change any default password on the monitor and its app as soon as you set it up. The NCSC suggests three random words as an easy password that's still strong.
2. Use a password you don't use anywhere else, so a breach on another site can't unlock your monitor.
3. Turn on two-step verification for the monitor's account, if it has one.
4. Update the software and switch on automatic updates if the app offers them.
5. Turn off remote access if you only watch from inside your home.
6. Check your router: give it a strong admin password, use WPA2 or WPA3 for your Wi-Fi, and consider turning off UPnP and port forwarding.
7. Buy from a brand that commits to updates. In the UK, makers must now say how long a device will get security updates.
8. Prefer monitors that encrypt video and don't need a cloud account.
9. Reset it before you sell or pass it on, so your account and settings go with you, not with the next owner.

Laws are getting stricter

• United Kingdom: since 29 April 2024, the Product Security and Telecommunications Infrastructure (PSTI) regime bans easy-to-guess default passwords on connectable products sold in the UK, including baby monitors. Makers must also give a way to report security problems and say how long they'll provide updates.
• United States: in January 2025 the government launched the U.S. Cyber Trust Mark, a voluntary label for smart devices, baby monitors among them, that meet set security standards.

These rules raise the floor, but they don't cover every device already in homes, and they don't stop a reused password. Your own setup still matters.

How to choose a baby monitor that keeps your video private

Ask these questions before you buy or download:

• Does the video leave my home? A monitor that streams only between devices on your home network can't be watched from the internet.
• Do I need an account? Every online account is something that can be breached. No account means no password to leak.
• Is anything recorded or stored? If no footage is saved, there is nothing to steal later.
• Is the video encrypted? It should be, every time.
• Who can connect? The best monitors only let a device you've paired in person connect.

Keep your baby's camera private

Whatever monitor you use, change default passwords, keep it updated and protect your Wi-Fi. If you'd rather not worry about any of it, choose a monitor whose video never leaves your home. Dozi is free to download and free to try for 3 days, with no payment and no sign-up to start.