NSA
OFFLINE CHECK @nsa
$NSA CA NSA_CA_IS_STILL_CLASSIFIED buy
A clean result is not a clean phone. Here's why. →

No Spyware
Allowed.

Paste a link from a text you didn't expect, or plug in your phone. NSA checks it against every published trace of Pegasus, Predator, Graphite and 50+ other spyware families, right here in your browser.

One per line is fine. Got a suspicious file? or drop it anywhere on this page.

Try a known one:

Check a whole phone or computer →

indicators
loading
reports
..
uploads
none
nsa@browser: ~/checkoffline · sha-256

      

      
Sample check against the bundled record. How it checks →

    

  






  

    

      
Six things it checks

      
Every line you paste goes through the same steps. Each step reads only the record that ships with this page: indicators lifted from public forensic reports by Amnesty International, The Citizen Lab, Google, Microsoft, Kaspersky, Lookout and ESET.

      
Read-only. NSA never asks for a wallet, never sends what you paste anywhere, and never calls a result safe.

      
Domain matchParent walkFile SHA-256Android app ID

      Where the record comes from
    

    
    
      
  1. 01
    Parse required
    Each line is read as a link, domain, IP, email, file hash or Android package name. Defanged links like hxxp://evil[.]com work too.
    2. 
      
  2. 02
    Domain match required
    The host is compared to 6,700+ domains that served exploit links, redirects or command servers for known spyware.
    3. 
      
  3. 03
    Parent walk required
    A link on a.b.badsite.com is also checked as b.badsite.com and badsite.com, because operators rotate subdomains.
    4. 
      
  4. 04
    File hash local
    A dropped file is hashed with SHA-256 and SHA-1 by your own browser, then matched against 4,500+ known samples. The file is never read by anyone else.
    5. 
      
  5. 05
    App ID android
    Package names like com.androidservices.support are matched against spyware and stalkerware apps. Paste the output of adb shell pm list packages to check a whole phone at once.
    6. 
      
  6. 06
    Attribution always
    A match names the family, the vendor where known, the researchers who published it and the date. No match says only that: not found in the record.
    7. 
    

  






  

    

      
Field record

      
Ten years of documented cases, 2016 to now. Each dot is a country named in a published report as home to the people targeted. Hover a case to see where it landed.

      
Many cases never get a country. The record only shows what researchers could prove.

      

    

    

      

      
    
    
    
  
    

    


    
  
    
    
    
      
    Check the device
    
      
    Plug in an Android phone, open an iPhone backup, or hand over your browser history. NSA reads them in this tab and runs every app, process, link and file through the same record as the link check.
    
      
    No upload, no account, no install. The phone check needs Chrome or Edge on a computer; the rest works in any modern browser.
    
      
    Installed appsAPK hashesProcessesMessagesBrowser historyDownloads
    
      
    
    
    
    
      
    
        
        
        
      
    

      
    
        
      
          
    1. 01
      Turn on USB debugging once
      Settings, About phone, tap Build number seven times. Then Settings, System, Developer options, switch on USB debugging.
      2. 
          
    2. 02
      Plug it into this computer
      Use a data cable. Close Android Studio, scrcpy or any other adb tool first, they hold the connection.
      3. 
          
    3. 03
      Connect and allow
      Pick the phone in the browser window, then tap Allow on the phone. NSA reads apps, app files, running processes, accessibility and admin rights, the patch level and, where the phone allows it, links in texts.
      4. 
        
    
        
    Read-only. Switch USB debugging off again when you're done.
    
      
    

      

      

      
      
    
    
  
    

    


    
  
    
    
    
      
    Need a person?
    
      
    Pegasus-class spyware often needs no click and wipes its own tracks. A clean result here means none of the published traces were found in what a browser can read. It is not a clean bill of health.
    
      
    If you think you are being targeted right now, talk to a helpline first. You don't need to run anything before asking.
    
    
    
    
      
      
    1. 01
      Access Now Helpline free · 24/7
      For journalists, activists and civil society. Many languages. accessnow.org/help →
      2. 
      
    2. 02
      Zero Breach Toolkit computer · android · iphone backup
      The open-source app this record comes from. Reads encrypted backups and more of the computer than a browser can. Source on GitHub →
      3. 
      
    3. 03
      Mobile Verification Toolkit amnesty
      The forensic tool Amnesty's Security Lab used to confirm Pegasus infections. Command line. docs.mvt.re →
      4. 
      
    4. 04
      Lockdown Mode iphone
      Apple's hardened mode blocked the BLASTPASS exploit chain in 2023. Settings, Privacy & Security, Lockdown Mode. support.apple.com →
      5.