Baby monitor app vs. video baby monitor: Wi-Fi or not?

The short answer

A video monitor with its own parent unit is simple and needs no Internet. Its range is limited, and vendors rarely say which encryption it uses.
A Wi-Fi camera with a vendor cloud reaches anywhere. But the video passes through someone else’s servers, and security researchers have repeatedly found serious flaws in such cameras since 2013.
An end-to-end encrypted app like Babyfino reaches anywhere too, and nobody in between can listen – not even the provider. In return it needs the Internet on both phones.

Three ways to hear your child

Comparison by kind of monitor, as of October 2026
	Babyfino (app, end-to-end encrypted)	Non-Wi-Fi video monitor (radio)	Wi-Fi camera with a vendor cloud
Devices	Two smartphones you most likely already have	Camera and a dedicated parent unit	Camera and an app on your phone
Range	No radio limit: over Wi-Fi and mobile data	Limited by the radio link; walls and floors shorten it	Over the Internet, so away from home too
Without Internet	No – both phones need Wi-Fi or mobile data	Yes, that is its strength	Depending on the model, only on your home network or not at all
Encryption	End to end with an open standard (WebRTC); your devices sign the keys themselves	Depends on the model; vendors rarely say which scheme. Frequency hopping (FHSS) is not encryption	Depends on the vendor; video usually passes through its servers
Who could listen in	Nobody but your paired devices – not even our server	Someone within radio range who exploits weak or missing encryption	The cloud operator; with security flaws, strangers too – documented several times
When the connection drops	An alarm on every parent phone after about ten seconds	Depending on the model, a warning tone on the parent unit	Depending on the vendor, a notification
Several parents	Any number of parent phones, iPhone and Android mixed	One parent unit, extendable on some models	Several phones, usually through one shared account
Light in the nursery	The screen stays black	Depends on the model	Depends on the model
For grandparents without a smartphone	Not suitable	Well suited	Not suitable

Is Wi-Fi less safe than radio?

Wi-Fi isn’t the question. Two others are: is the transmission encrypted – and who besides you holds the key? A look at each technology, with what is documented and what isn’t.

Analog radio monitors

They transmit unencrypted on public radio channels. Anyone within range with a suitable receiver – a walkie-talkie or a second baby monitor – can listen in. One vendor says so in the manual of its own analog model [1].

Digital radio monitors (DECT, frequency hopping)

DECT’s original encryption was optional, and its cipher was publicly broken by security researchers in 2010 [2]. The standard has since added stronger, AES-based protection; vendors rarely state which one a given monitor uses. Non-Wi-Fi video monitors often advertise frequency hopping (FHSS). It guards against interference but is not encryption – the US standards institute NIST calls the security it provides “minimal” [3]. We know of no documented case of a specific digital radio monitor being intercepted.

Wi-Fi cameras with a vendor cloud

Here the problems are well documented. In 2015 Rapid7 tested nine Wi-Fi baby monitors: eight got an F, one a D, and unencrypted video was a common finding [4]. In 2018 SEC Consult found a camera whose app let anyone view all connected devices – unfixed as of their report [5]. In 2020 and 2022 Bitdefender found flaws that let strangers retrieve videos; the vendors say they fixed them [6]. Germany’s federal security office BSI warned in 2021 about a flaw in widely used camera software that also affected baby monitors [7].

Apps

An app isn’t secure by default either. In 2023 the University of Münster examined four popular Android baby monitor apps: one sent video with no encryption at all, one had end-to-end encryption as an option that was off by default, and one used an unencrypted control channel. The study rated only one app as confidential – the one using WebRTC and verifying the other side’s key [8], the approach Babyfino is built on.

How Babyfino encrypts

Mandatory, not optional. Sound and picture travel over WebRTC, the standard behind video calls in the browser. Its encryption (DTLS-SRTP) is required and cannot be switched off [9].
Your devices sign for themselves. Each device signs its key’s fingerprint with its own device key, and the other side accepts only devices it trusted when you paired them. That is why not even our server can put itself in between.
No media server. Sound and picture go straight from phone to phone. Where the network doesn’t allow that, a relay (TURN) forwards the packets – encrypted, unable to read them [10].
Nothing is stored. No sound, no picture, no recording sits on a server. Your evening’s history stays on your phones.
What our server sees: when a monitor is listening, when an alarm happens and which devices belong to your family – without that it couldn’t alarm you. It receives your children’s names only encrypted.

Babyfino has not been independently audited yet. More on how baby monitors get attacked and how to tell: Can baby monitors be hacked?

When a video monitor is the better choice

When there is no reliable Internet – a holiday cottage, a dead spot, a garden out of Wi-Fi.
When grandparents or a babysitter without a smartphone are looking after your child.
When you want a dedicated device that does nothing else and doesn’t tie up a phone.

Then look for a digital model that names its encryption, warns when it goes out of range, and keeps the nursery dark.

Frequently asked questions

What is the most secure baby monitor?

No label tells you. What holds up is end-to-end encryption with an open standard, where only your own devices know the keys. Radio monitors rarely say which encryption they use; with a vendor cloud, the video sits with the vendor.

Can a non-Wi-Fi baby monitor be hacked?

Analog monitors can be overheard with a suitable receiver – vendors say so in their own manuals. For digital radio monitors using DECT or frequency hopping we know of no documented case of a specific model being intercepted. Either way, an eavesdropper has to be within radio range.

Is a Wi-Fi baby monitor unsafe by nature?

No. The risk lies in devices that send video unencrypted, keep default passwords or give a vendor’s servers access to the picture. A device that encrypts end to end and needs no cloud access rules those paths out.

Does Babyfino need Wi-Fi?

Babyfino needs an Internet connection on both phones – Wi-Fi or mobile data. Without it, no alarms arrive. If the baby’s phone loses its connection, Babyfino alarms the parent phones after about ten seconds.

Does Babyfino record?

No. Babyfino stores no sound and no picture – neither on a server nor on the phones. Your phones keep only the evening’s history: when your child was awake and how loud the room was.

Sources

Albrecht: operating manual Bambini 29870 (analog, 446 MHz) (in German, retrieved 21 October 2026)
Nohl, Tews, Weinmann: Cryptanalysis of the DECT Standard Cipher, FSE 2010
NIST: SP 800-121 Rev. 2, Guide to Bluetooth Security, 2017
Rapid7: FAQ on the baby monitor disclosure, 2 September 2015
SEC Consult: Hijacking of arbitrary miSafes Mi-Cam video baby monitors, 21 February 2018
Bitdefender: iBaby Monitor M6S, February 2020 (fixed), and Nooie baby monitor, February 2022 (fixed according to the vendor in April 2022)
BSI: Sicher • Informiert, 26 August 2021 (in German)
Schmidt, Hosseini, Hupperich (University of Münster): analysis of four Android baby monitor apps, Journal of Cybersecurity and Privacy 3(3), 29 June 2023
IETF: RFC 8827, WebRTC Security Architecture, 2021
IETF: RFC 8656, Traversal Using Relays around NAT (TURN), 2020