Can someone really watch my baby monitor without hacking anything?

Often, yes — which is the uncomfortable part. In 2013 the FTC settled with TRENDnet after a flaw let outsiders view live feeds from about 700 customers' cameras, including babies in cribs, with no password needed at all; the company had been transmitting login credentials in plain, readable text. A June 2025 study by the security firm Bitsight found the same root problem still common today: over 40,000 internet-connected cameras worldwide (about 14,000 in the US) reachable just by typing their address into a browser — no login screen, no alert to the owner.

Is my camera listed somewhere a stranger could find it?

Possibly, via tools like Shodan that index devices answering on the public internet. This page intentionally doesn't walk through searching Shodan for other people's cameras — that is exactly the invasive behavior this site argues against. The useful, ethical version of this check is securing your own device so it never appears on a list like that in the first place (below), not browsing for other people's.

Does a more expensive camera protect me better?

Price isn't the signal. The signal is whether the brand forces you to set a real password during setup (rather than shipping with admin/admin), ships security patches, and doesn't need a port forwarded open on your router to work remotely. A cheap camera that does all three beats an expensive one that does none.

The camera you own, not one someone hid

Is your own camera visible to strangers right now?

Everything else on this site is about finding a device someone else planted. This is the opposite, more common problem: a baby monitor, pet cam, or home security camera you bought and installed yourself — that a stranger can reach anyway, because of how it shipped or how it's set up. Invasive, not malicious, same as the rest of this site: nobody targeted you, a default setting just never got changed.

How this actually happens

Three causes account for almost every exposed consumer camera:

A default password that was never changed. Many cheaper IP cameras ship with a factory login like admin/admin. If the setup process doesn't force a new password, a large share of buyers never set one.
Credentials sent or stored without encryption. This was the exact TRENDnet flaw — login details traveled across the internet in plain text, so anyone intercepting that traffic could watch the same feed the owner could.
Remote access left open at the router level (UPnP or manual port forwarding), so the camera answers to anyone on the public internet, not just your home network — the specific condition Bitsight's 2025 scan was measuring when it found 40,000+ of them.

The two-minute check

Log into the camera's own app or web portal and confirm the password is one you set — not the one printed on the box or in the manual. If you've never explicitly changed it, assume it's still the default.
Check the manufacturer's support or security page for your exact model — search "[brand] [model] security advisory." Reputable brands post these when a flaw is found; if yours has an open one, the fix is almost always a firmware update, not a new camera.
Open your router's connected-devices list (usually under a "clients" or "attached devices" page in the router's admin panel) and account for every camera on it. A device you don't recognize is worth investigating before anything else on this list.
Turn off UPnP on your router unless an app specifically requires it, and use the manufacturer's own cloud app for remote viewing instead of a manually forwarded port — the cloud app's company is handling the exposure risk so your router doesn't have to.

Fix it once, not every few months

Unlike the people-search opt-outs elsewhere on this site, this isn't a recurring chore. Four things, done once, close almost every real exposure: set a real password, turn on two-factor authentication if the app offers it, let the camera take its automatic firmware updates instead of disabling them, and confirm the live feed actually requires a login — not just that an app happens to show it to you already signed in.

The FBI has also warned about a different angle on the same weakness: stolen account passwords (reused from an unrelated data breach, not a flaw in the camera itself) being used to log into smart cameras and speakers for "swatting" pranks — calling in a fake emergency, then watching the response through the hijacked camera. A password that's both strong and unique to this one device closes that door too.

Free: The 90-Second Room Sweep Checklist

Checking a space you don’t control — a rental, a hotel room? That’s the other half of this site; the free checklist covers it.

Skip and download directly

Cover: The Traveler's Counter-Surveillance Field Manual

The Field Manual — PDF edition

The field manual covers finding a camera someone else hid. This page covers securing one you installed yourself — different problem, same calm approach. The complete system — every check on this site plus the ten-minute walkthrough, audio devices, your legal rights, and what to do if you find something. 47 printable pages, instant download, keep it on any device.

Skip and go straight to checkout

Keep going

The 90-second room sweepFour steps, no gear — the check to run when you arrive. Find hidden cameras in an AirbnbWhere devices actually hide, and the rules hosts must follow. Airbnb vs. Vrbo vs. Booking.comThree platforms, three different lines on indoor cameras — which one applies to your booking. The flashlight trickThe one free method that catches a camera even when it is off. The two-way mirror testWhy the fingernail trick doesn't work — and what does. Do detector apps work?What a controlled lab study found when 11 apps met real hidden cameras. Find a GPS tracker on a carThe 60-second check, plus the data your rental car keeps. Unknown AirTag alert?What the tracker warnings can and cannot do, and the manual check. Found something? Do thisThe order matters: don't touch it, cover your sightlines, document. Check a hotel room for hidden camerasDifferent risk than a rental, same 90 seconds — plus the housekeeping tell. Bugged? Here’s the honest answerAudio is a different problem than cameras — what actually finds a bug, and what can’t be found. Is a hidden camera illegal?The federal law, the state law, wiretap rules, and platform policy — in plain English. The Workplace Privacy ChecklistWhat your employer can actually see, and the 10-minute check that tells you where you stand. The Renter's Smart-Home Privacy ChecklistWhat landlord-installed smart locks and sensors can log, and the move-in check that tells you where you stand. Remove yourself from 30 people-search sitesDirect opt-out links, honestly rated — no paid removal service required. Is your smart TV spying on you?What ACR tracking actually does, and the one setting that turns it off. Is your own camera exposed online?The two-minute check for a baby monitor or home camera you own — not one someone hid. Neighbor's camera pointed at your house?What you can ask for, what the law actually protects, and when it crosses a line. Is an AI notetaker recording your meetings?Zoom AI Companion, Otter, Fireflies, Granola — the signs it’s on, and the lawsuits now testing whether that’s legal. Who else can see your doorbell camera?Police requests, employee access, and what actually changed in 2024 — your own camera, not a hidden one. Does your car report your driving to your insurer?GM's finalized FTC settlement, the data brokers involved, and how to check your own car's settings. Does your neighborhood have a license-plate camera?What Flock-style cameras at a gate or entrance actually keep, the August 2026 retention change, and how to ask your HOA or building. Does Alexa, Siri, or Google Assistant record you?The 2019 human-review stories for all three, what changed since, and the setting that actually limits it. Does your robot vacuum photograph your home?Where the images go, two documented cases, and the settings that actually limit it. Do smart toys record your child’s voice?Two documented breaches, and the four questions to ask before a connected toy goes in the toy box. Does your fitness tracker’s data belong to you?The insurance discount that wants it, and three real cases where it ended up in a courtroom instead.