As an Amazon Associate I earn from qualifying purchases. Links to Amazon on this page are affiliate links.
Wi-Fi baby monitor security: what to check before and after you buy
Updated
A local monitor keeps the picture between the camera and the parent unit. There is no account, no app and no cloud to secure. A Wi-Fi or hybrid monitor adds all three. That is the cost of looking in from work. The FTC's advice for home cameras, which names baby monitors, comes down to this: buy one that encrypts, use a strong password you have never used before, turn on two-factor authentication if it is offered, and keep the software and your router up to date.
What each listing states
| Model | Link | Security statements on the listing |
|---|---|---|
| Nanit | Wi-Fi app | 256-bit AES encryption and two-factor authentication. Multiple users with access permissions |
| eufy Baby Monitor E21 | Hybrid | RSA-1024 and AES-128 encryption. A switch on the camera that cuts Wi-Fi. Recordings saved to a local SD card |
| VTech VM901 | Hybrid | The listing we read names the app and says it can be shared with a partner or sitter. We did not see an encryption or two-factor statement on it |
| Infant Optics DXR-8 PRO, VTech VM819, HelloBaby HB6550 and Babysense 5 inch HD Split-Screen | Local | FHSS radio with no Wi-Fi. VTech and HelloBaby also state that the link is encrypted |
These are maker statements. We have not audited any of them. Several local listings use the phrase hack-proof. No radio link is beyond all attack, but a local monitor cannot be reached over the internet, because it is not on it. Someone would need to be within radio range of your home.
The FTC's checklist, applied to a baby monitor
- Encryption. The FTC says to look for a camera that encrypts your account information, livestreams and saved video.
- A new, strong password. Do not keep a default, and do not reuse one from another account. The FTC notes that default and reused passwords are easy for attackers to find.
- Two-factor authentication. The FTC says to set it up on the cloud account if it is available. Turn it on the day you create the account.
- Updates. Keep the camera's software current, and do the same for your router.
- Your router. Use WPA3 or WPA2, a strong router password and its firewall. The FTC also suggests putting cameras on a separate network from your computers.
Sharing with grandparents and sitters
Every person you add is another account. Nanit's help pages describe three account types, owner, admin and viewer, and say new viewers get local Wi-Fi only access by default, which means they can watch while they are in your home and are cut off when they leave. That is a sensible setting for a sitter. Remove accounts you no longer need.
Will there be a security label?
The FCC is setting up a voluntary label for wireless consumer devices called the U.S. Cyber Trust Mark, and it names baby monitors as an example of an eligible product. The program builds on NIST's recommended cybersecurity criteria for consumer connected products. We did not see the mark on any listing here when we read them. When it arrives, it will be one more thing to look for. It is voluntary, so a monitor without it is not proven unsafe.
If this all sounds like too much
Then a local monitor is the answer, and that is a fine choice. You give up looking in from away and you get nothing to manage. The link checker starts with that question.
Run your own home through the link checker, or compare all 7 picks on the roundup page.