How to Detect Keyloggers & Spyware on Android Without Root (Free)
You suspect someone is monitoring your phone. Maybe a partner knows things you only typed. Maybe an ex had your phone for an evening. Maybe you installed something months ago that you no longer recognise.
The honest starting point: no app can look at your phone and tell you “you are hacked” or “you are clean”. What you can do is check the handful of Android permissions that any keylogger or spyware has to hold in order to work. Spyware can hide its icon, but it cannot hide from the permission lists in Settings. This guide walks through them, using only what Android already ships with. No root, no paid tools.
Menu names below follow stock Android and Pixel phones. Samsung, Xiaomi, OnePlus and others move things around; if a path does not match, use the search bar at the top of Settings.
Can you track keystrokes on Android?
Not with a switch in Settings: Android keeps no log of what you type, and the system does not show a “keystroke history” for any app. What you can see is which apps hold the access needed to capture keystrokes. That is the practical way to track keystrokes on Android: you list the keyboards and accessibility services that could record typing, then decide which ones belong there. Steps 1 and 2 below do exactly that.
This guide is for checking your own phone. Installing a keylogger on someone else’s phone without their consent is illegal in many places, and the stalkerware that does it is the thing this page helps you find and remove.
What a keylogger needs on Android
On Android, an app cannot simply read what you type into another app. To capture keystrokes or the screen, it needs at least one of these:
- An accessibility service. Built for screen readers, it can see screen content and act on it. This is the permission stalkerware relies on most.
- A keyboard (input method). A third-party keyboard sees everything typed through it, by design.
- Notification access. An app with this can read the text of every notification — message previews, one-time codes, emails.
- Device admin rights. Used by work-management and anti-theft apps; it can make an app harder to uninstall.
- Display over other apps. Lets an app draw on top of other apps, which can be abused for fake login screens.
Monitoring tools sold as “parental control” or “employee monitoring” generally ask for several of these at once. That combination is the pattern to look for.
Step 1: Check accessibility services
Go to Settings → Accessibility and look under a heading like Downloaded apps or Installed services.
Anything turned on here can see your screen. Expect to find screen readers, password managers or automation tools you set up yourself. Be suspicious of anything you do not recognise, anything with a generic name (“System Service”, “Sync”, “Update”), or an app that has no obvious reason to need it, such as a calculator or a wallpaper app. Tap it to see what it says it does, and turn it off if you did not enable it.
Step 2: Check your keyboards
Go to Settings → System → Languages & input → On-screen keyboard (on some phones, Keyboard list and default).
You should see only the keyboards you chose — usually Gboard or your phone maker’s keyboard. Remove any keyboard you did not add yourself.
Step 3: Check special app access
Go to Settings → Apps → Special app access (on Samsung: Settings → Apps → ⋮ → Special access). Look through these lists:
- Device admin apps — normally only Find My Device and, on a work phone, your employer’s management app.
- Notification access (sometimes Device & app notifications) — expect smartwatch apps and similar.
- Display over other apps — many apps ask for this; question the ones you do not use.
- Install unknown apps — which apps are allowed to install other apps. A browser or file manager here is how most spyware gets sideloaded.
- Usage access — apps that can see which apps you use and when.
If an app shows up in several of these lists and you do not know what it is, that is the strongest sign you will find without specialist tools. A device admin app must be deactivated in this list before Android lets you uninstall it.
Step 4: Look at every installed app, including hidden ones
Go to Settings → Apps → See all apps. Some phones offer a ⋮ menu with Show system — turn it on. Spyware often removes its launcher icon, but it still appears here. Sort by name and look for anything you did not install. Tap an unfamiliar app, then Permissions, to see what it can access.
Step 5: Use Android’s own privacy tools
- Privacy indicators. On Android 12 and later, a green dot appears in the top corner of the screen while the mic or camera is in use. Swipe down to see which app is using it.
- Privacy dashboard. In Settings → Security & privacy → Privacy (path varies), the privacy dashboard shows which apps recently used the microphone, camera and location. This is the system’s own history; a regular app cannot see it.
- Google Play Protect. Open the Play Store, tap your profile picture, then Play Protect → Scan. It checks installed apps against Google’s list of known harmful apps.
- Trusted certificates. In Settings → Security → Encryption & credentials → User credentials (or Trusted credentials → User), look for certificates you did not install. A rogue certificate can let someone read encrypted traffic.
Step 6: Check battery and data use
Spyware has to send what it collects somewhere. Open Settings → Battery → Battery usage and Settings → Network & internet → Data usage (or SIM → App data usage). An app you barely open that sits near the top of either list deserves a closer look. On its own this proves nothing — plenty of normal apps sync in the background — but combined with the permissions above it is a useful second signal.
Step 7: Check your accounts, not just the phone
Some monitoring needs no app on the phone at all — someone who knows your Google password can read your email, location history and backups from any browser. Go to your Google Account → Security → Your devices and sign out any device you do not recognise, then change your password and turn on 2-Step Verification.
Related checks
- Suspect more than keystrokes? See how to know if someone is monitoring your phone.
- Worried someone handles your phone while it is locked? See how a phone motion detector works and what Android already offers instead.
- Worried about the network side, such as a tampered connection? Read how to check if your ISP is spying on you.
Where DeviceGPT fits
DeviceGPT can do Steps 1 to 4 in one pass. Its security audit lists the enabled keyboards and the accessibility services that could see what you type or what is on screen, apps holding microphone, camera or SMS permission, apps with access to your advertising ID, sideloaded apps, overlay and notification-listener permissions, and whether root, developer mode or USB debugging is on. It also checks the network for tampered DNS answers, a hijacked SSL certificate and transparent proxies. Findings are scored from 0 to 100 with a plain-English action for each. No root needed.
To be clear about the limits: DeviceGPT does not detect specific spyware packages by name, does not show mic or camera usage history (use Android’s privacy dashboard for that), and is not antivirus. It shows the signals; you decide what to revoke or uninstall. Scan scores and your phone model are uploaded to its global leaderboard. The source code is public on GitHub.
Quick reference
| What to check | Where in Android | Why it matters |
|---|---|---|
| Accessibility services | Settings → Accessibility | Can read the screen and what you type |
| Keyboards | Languages & input → On-screen keyboard | A keyboard sees every keystroke |
| Notification access | Special app access | Reads message previews and codes |
| Device admin apps | Special app access | Can block uninstalling |
| Install unknown apps | Special app access | How sideloaded spyware arrives |
| Recent mic/camera use | Privacy dashboard | The system’s own usage history |
| Known harmful apps | Play Store → Play Protect | Google’s malware scan |
| User certificates | Encryption & credentials | Can expose encrypted traffic |
If you find something
- Think about your safety first. If the person monitoring you is someone you live with, removing the app may alert them. Groups such as the Coalition Against Stalkerware and local domestic-abuse services can help you plan.
- Take screenshots of what you found before changing anything, in case you need evidence.
- Turn off the permission — accessibility, keyboard, notification access, device admin.
- Uninstall the app from Settings → Apps. If uninstall is greyed out, deactivate it under Device admin apps first.
- Try safe mode if an app keeps coming back: on most phones, press and hold Power, then long-press Power off to restart without third-party apps, and remove it from there.
- Change your passwords from a different device, starting with your Google account and email.
- Factory reset as a last resort. Do not restore apps from a backup you do not trust, or the problem can come straight back.
FAQ
Q: Can I find spyware without root? A: Yes. Every check in this guide uses standard Settings screens. Root is not needed to see which apps hold accessibility, keyboard, notification or device admin access.
Q: Can I detect monitoring installed by my employer? A: A managed work phone usually shows a notice such as “This device is managed by your organisation” and lists the management app under Device admin apps. On a work phone that is normal; on a personal phone you did not enrol, it is not.
Q: Will an antivirus app find stalkerware? A: Sometimes. Play Protect and security apps flag apps on their lists, but monitoring apps are often rebranded. Checking permissions by hand catches what a list misses.
Q: Does DeviceGPT tell me whether my phone is hacked? A: No. It gives a scored list of risk signals — keyboards, accessibility services, sensitive permissions, sideloaded apps, network checks — not a yes-or-no verdict.
Part of the DeviceGPT series. Built by Teamz Lab.
Have a project in mind?