Can baby monitors be hacked?

This question usually gets answered in one of two useless ways: a list of frightening news stories, or a vendor insisting their product is secure. Neither tells you what to do.

So, plainly. Yes, internet-connected cameras get accessed by people who should not have access. The mechanism is almost always mundane — a password, or a remote-viewing service left reachable — rather than anyone breaking cryptography. Which means most of the risk is under your control.

The three places it can actually go wrong

1. The account

By a wide margin the most common route, and it barely deserves the word "hacking". If your monitor has a login, and that login uses a password you have used elsewhere, then any breach of any of those other services hands someone your camera. Automated tools try leaked email-and-password pairs against every popular service; the camera does not get singled out, it gets swept up.

Nothing about the camera's own security matters here. The credential was correct.

2. The remote-viewing path

If you can watch from your office, some route into your home exists, and its security is now part of your camera's security. That route is one of three: traffic relayed through the vendor's servers, a port forwarded through your router, or a hole the camera punched itself with UPnP.

The second and third are the dangerous ones, and they are what people mean when they talk about cameras found by search engines. A camera exposed directly to the internet gets found — not targeted, just found, by scanners that sweep the entire address space continuously. Relayed traffic through a vendor is far safer by comparison, though it does mean trusting the vendor.

3. Your home network

The least likely and the hardest to do anything about. Someone already on your Wi-Fi — a neighbour on a weak password, a guest, a compromised device — is inside the perimeter that most local devices assume is friendly.

This matters for a specific reason: it is the one a local-only monitor does not solve. Keeping video off the internet removes the remote attack surface entirely. It does not make your Wi-Fi trustworthy.

What removing internet access does and doesn't fix

A monitor whose video never leaves your network cannot be reached by a scanner in another country, because there is nothing to reach. That is a real and large reduction in exposure — it deletes the second surface rather than defending it.

It also means there is no server holding footage to be breached later, and no vendor account whose compromise hands over a live view.

What it does not do:

• It does not secure your Wi-Fi. Anyone on your network is still on your network.
• It does not remove every account. Most local products still have a login for settings and push notifications, which is still worth protecting.
• It does not make the software correct. Local software has bugs too. It just has a much smaller audience able to reach them.

Local-only is a smaller attack surface, not an absent one. Anyone telling you their product cannot be compromised is overselling.

What actually helps

In rough order of how much difference it makes per minute spent:

1. A unique password on the monitor account. Not a strong password you also use elsewhere — a unique one. This single change removes the most common route in. Use a password manager.
2. Two-factor authentication, if offered. Makes a leaked password insufficient on its own.
3. Turn off remote access if you do not use it. Free, instant, and closes the surface that scanners find.
4. Turn off UPnP on your router unless you know you need it. It exists so devices can open ports without asking you, which is exactly the behaviour you do not want from a camera.
5. Update the firmware — the router's as well as the camera's. Old router firmware is a more common weak point than old camera firmware.
6. Give guests a guest network. Every router made in the last decade can do this, and it keeps visitors' phones off the network your devices live on.
7. Delete the account when you stop using the product, and check what happens to stored footage when you do.

Notice that most of that list is about your network and your passwords rather than the camera. That is genuinely where the risk lives.

If you think someone has been watching

Usually it turns out to be something else — a second household account someone forgot about, a camera that pans on a schedule, an LED that always did that. But if you want to be sure, this is the order to do it in, and none of it needs technical knowledge.

1. Change the monitor password from a different device — your laptop rather than the phone with the app on it — and make it unique.
2. Look for a "devices" or "active sessions" list in the app and sign out everything you do not recognise. Then check the account's shared or family users, which is where an old invitation lingers.
3. Change your Wi-Fi password. Blunt, effective, and it disconnects everything that should not be there. You will have to reconnect your own devices, which is the point.
4. Check the router for port forwarding and UPnP entries, and remove any pointing at the camera. This closes the route a scanner would have used.
5. Update the router's firmware, then the camera's.
6. Tell the vendor. If a product was genuinely accessed without your credentials being reused, that is something they need to know, and you are unlikely to be the only one.

If you have reason to believe someone actually watched your child, that is a crime in most places and worth reporting to the police, not just to the manufacturer. Unplugging the camera first preserves the situation and costs you nothing.

How Bebrise is put together

Two phones on the same Wi-Fi, and no path in from outside — there is no relay server, no port to forward, and nothing for an internet-wide scan to find, because the app carries no relay infrastructure to route video through at all. The architecture behind that is its own guide. The video between the two phones is carried over WebRTC, which encrypts media in transit.

Pairing is a deliberate, time-boxed act rather than a standing invitation: the bedside phone only accepts a new caregiver during a short window you open, and afterwards the paired phone holds a token it has to present. A phone that wanders onto your Wi-Fi later cannot simply ask for the picture.

And the honest limit: on your own network, the assumptions are ordinary home-network assumptions. Everything in the list above still applies, and the two items that matter most for Bebrise specifically are a strong Wi-Fi password and a guest network for visitors.

What we hold is set out in the privacy policy — it is worth reading the retention section of any monitor you are considering, including this one.