Can a baby monitor be hacked?
Last updated: 2026-08-31
Yes, baby monitors have been compromised, and it keeps happening. Almost every published case has the same shape: the video was sitting on a company's server behind an account, and someone got into the account. The fix is not a longer password. It is not sending the video to a company in the first place.
How monitors actually get compromised
The failures are boring and repetitive, which is the useful part. They are properties of the design, not bad luck.
- A cloud account. If your stream is reachable by logging in, then anyone who obtains your password, reuses a breached one, or phishes you can watch. Two-factor authentication helps and is not a guarantee.
- Default or shared credentials. Cheap Wi-Fi cameras have shipped with fixed passwords that are published in the manual and indexed by search engines.
- Stored recordings. A monitor that keeps footage creates something worth stealing. A monitor that keeps nothing does not.
- Abandoned firmware. A camera is a small computer. When updates stop, known holes stay open for as long as the device is plugged in.
What end-to-end encryption means here
HushCam uses WebRTC with DTLS-SRTP, the same encryption your browser uses for video calls. The encryption keys are negotiated directly between your two devices and never leave them. We do not hold them, cannot request them, and cannot reconstruct them. That is what "end-to-end" has to mean to be worth anything: not that the link is encrypted, but that the people running the service are outside the conversation.
There is no login, so there is no account to break into. There is no recording, so there is no archive to leak. Sound and motion detection both run on the device itself, so nothing about your child is sent anywhere to be analyzed.
What each party can see
We do not claim to run no servers. Two exist, and here is exactly what they handle.
| Who | Can see your audio and video? | What they do see |
|---|---|---|
| Your two paired devices | Yes | This is the point of the app |
| HushCam signaling service | No | Connection setup only: network addresses and codec lists, labelled by a random pairing key rather than by you |
| HushCam relay, when it is used | No | Encrypted packets it has no key for. Used only when your two networks cannot reach each other directly |
| Your internet provider or Wi-Fi owner | No | That encrypted traffic exists |
| The developer | No | Nothing at all, unless you write to us from the feedback form |
The relay matters most on restrictive networks: office Wi-Fi, hotels, and some mobile carriers. It forwards bytes it cannot read. On most home and cellular connections it is never involved, because the two devices talk directly.
What HushCam deliberately does not have
- No account, no email address, no password.
- No cloud recording and no cloud storage of any kind.
- The HushCam app contains no analytics, no crash reporting, and no advertising or tracking SDKs.
- No subscription, and no paid tier holding a feature hostage.
- The App Store privacy label reads "Data Not Collected", and it stays accurate.
How pairing works
The receiving device shows a QR code carrying a one-time code. The watching device scans it, and the two connect. Once they have paired successfully, they rotate to a new key that only they hold and pin each other's identity, so the code you scanned cannot be used again by anyone who photographed the screen.
By default your devices then remember each other, so you are not rescanning a code every night. That is a setting you can switch off in the app if you would rather re-pair each time, and unpairing forgets the relationship on both ends.
A free, private baby monitor
Two devices, paired by a QR code. Audio and video travel end-to-end encrypted directly between them.
Download on the App Store