Can Someone See Your Texts if You Use Their Wi-Fi?

What the Wi-Fi owner can see, and what they can't

Every router keeps some record of the devices on it. Depending on the model and its app, the owner can see:

Your device: its name and its Wi-Fi (MAC) address. iPhones and Android phones use a different private address for each network by default (Android since version 10), so the address doesn’t reveal your phone’s real one. The device name often reveals you anyway.
When and how much: when your phone connected, for how long, and how much data it used.
Where it connects: on some routers and DNS filters, the names of the sites and services it reached. Our router history guide lists which brands keep such a log. Many don’t.

That last one is the closest a Wi-Fi owner gets to your messages. Before your phone connects to a server, it looks up the server’s name, and that lookup usually isn’t encrypted. The name also travels openly at the start of most connections (RFC 9849 explains why). So the owner could learn that your phone talked to WhatsApp’s servers at 11:40 pm for twenty minutes. Not who you wrote to, and not a word of what you wrote.

The messages themselves travel encrypted. Apps protect the connection to their servers with TLS, the encryption behind the padlock in your browser, which makes the content “unreadable to eavesdroppers on the network”, as the EFF puts it. That holds even for apps without end-to-end encryption. There, the company behind the app can read your messages on its servers, but the Wi-Fi owner still can’t.

A Wi-Fi owner watching your phone is a bit like someone watching you at the post office. They see which counter you go to and how long you stay there. The address on the envelope, and the letter inside, they don’t see.

Your messaging apps, one by one

End-to-end encryption means that only the phones at the two ends can unlock a message. Without it, the message is still encrypted on its way through the Wi-Fi, but the company in the middle can read it. For the Wi-Fi owner the result is the same. For your privacy it isn’t.

Two things changed in 2026. Instagram ended its optional encrypted chats on May 8, 2026, and Meta said very few people were turning them on. For a feature that was never switched on by default, this was not the biggest surprise of the year. In the other direction, iPhones and Android phones can now encrypt the RCS chats between them, in beta since iOS 26.5 in May.

The weak spot is rarely the encryption. It’s the copies: backups, and every other device where you’re signed in (chapter 5).

Texts that do travel over Wi-Fi

Plain SMS doesn’t use the Wi-Fi at all. It goes from your phone to the nearest cell tower, so the Wi-Fi owner has nothing to look at, not even an envelope. Two kinds of texts do use the Wi-Fi when you’re connected.

iMessage and RCS chats

These work like any messaging app, over Wi-Fi or mobile data. iMessage is end-to-end encrypted. RCS chats between two Google Messages users are too, and so are chats between an iPhone on iOS 26.5 or later and an Android phone with the latest Google Messages, if your carrier supports it. In the US, AT&T, T-Mobile and Verizon are on Apple’s carrier list, where the feature is still marked beta (September 2026). Encrypted chats show a lock icon.

Without the lock, an RCS message still travels encrypted with TLS to the RCS server, so the router sees nothing readable. Your carrier, or Google if it runs RCS for your carrier, can read it there.

Wi-Fi Calling

With Wi-Fi Calling on, your phone can send normal calls and SMS over the internet instead of the cell network. It doesn’t send them openly. The phone first builds an encrypted IPsec tunnel to a gateway in your carrier’s network (the ePDG in the GSMA’s specification), and everything travels inside it. Optus, for example, routes calls, SMS and MMS this way. To the router, it looks like one encrypted connection to your carrier. Out of the tunnel, an SMS is an ordinary SMS again, readable by the carrier.

The tunnel has had its own trouble. In 2024, researchers from the University of Vienna and SBA Research found 13 mobile operators, with about 140 million customers between them, using the same set of ten private keys for it. Those keys allowed the decryption of the tunnel keys of every Wi-Fi Calling user of those operators. Thirteen operators, one set of ten keys: somebody saved a lot of work there. It was a fault on the carriers’ side, though, and nothing a router’s settings page could show.

Work, school and public Wi-Fi

On your own phone, a work, school or hotel network sees what a home router sees: devices, times, data use and server names. It may log more of it, and keep it for longer. Your messages stay encrypted all the same. The same goes for someone’s personal hotspot. Their phone is simply the router.

It changes when the organisation owns or manages the device: a work phone, a work laptop, a school Chromebook. Then it can install its own root certificate, and its filter can open and inspect your web traffic. Microsoft and Google document how admins set this up. End-to-end encrypted apps still give them nothing to read, and apps that pin their own certificates, like Signal, refuse the inspected connection.

Even on a managed iPhone, Apple’s device management doesn’t let the organisation view iMessage or SMS, whichever type of enrollment it uses. On Android, a work profile keeps your personal apps and data out of the organisation’s view. A monitoring app that an employer installs on a phone it owns is another matter, so keep private chats on your own phone.

Public Wi-Fi is safer than its reputation. Because most sites and apps now encrypt their traffic, the FTC says that connecting through public Wi-Fi “is usually safe”. The one thing to refuse is a login page that asks you to install a profile or a certificate. A configuration profile may allow access to data on the device, and trusted root certificates are meant for an organisation’s own devices, not for a café’s guests. On an iPhone, Settings > General > VPN & Device Management lists any you have.

Who can actually see your texts

If the Wi-Fi isn’t the leak, these are the places that can be.

The person who pays the phone bill

On a family plan, the account holder can see the text logs of every line. AT&T shows the other number, the type of message and the time; Verizon shows the number, date and time. What the texts say isn’t in the logs, and AT&T states that “no one on your account can see the content of your text or video messages.” iMessages and RCS chats don’t appear in the logs at all, since they go over data. Verizon Cloud can back up texts from Android phones, but even the account owner can’t view them on the website or in My Verizon.

Your carrier

SMS isn’t end-to-end encrypted. “SMS messages are not encrypted,” CISA wrote in December 2024, so someone with access to a carrier’s network can read them. That includes your carrier. It doesn’t include the Wi-Fi owner or your home internet provider.

A device signed in to your account

This is the easiest way, and it needs no hacking. Messages appear on every device signed in to the account: a Mac or iPad on the same Apple Account (with Messages in iCloud and Text Message Forwarding, even your SMS and RCS chats), a computer paired with Google Messages, WhatsApp on up to four linked devices, Telegram on any logged-in device. An old family iPad still signed in to your Apple Account shows your iMessages to whoever picks it up.

Backups and passwords

Backups hold your messages too. With iCloud Backup on, the backup includes the key to your Messages in iCloud, unless you turn on Advanced Data Protection. WhatsApp backups are end-to-end encrypted only if you switch that on. The Coalition Against Stalkerware notes that some iPhone spying tools work from iCloud backups. So the password of your Apple or Google account protects your messages far more than any Wi-Fi password.

An app on your phone

Stalkerware apps forward messages, location and more to someone else. According to the Coalition Against Stalkerware, they usually need someone to have your phone in hand and to be able to unlock it. Joining their Wi-Fi gives nobody that. Spyware that gets in without touching the phone exists, but it’s rare and aimed at a few chosen targets. Apple describes them as “the very few individuals” picked out “because of who they are or what they do.”

Your phone number

In a SIM swap, a fraudster talks your carrier into moving your number to their SIM card. From then on they receive your text messages and calls, login codes included. It’s a tool of account thieves, like the bank account takeover ring we reported on in November 2026, rather than of nosy Wi-Fi owners.

Is it legal to read someone’s texts?

Usually not without their permission. In the US, intercepting someone’s communications is a federal crime under the Wiretap Act, with up to five years in prison. In the UK, the Investigatory Powers Act 2016 makes interception an offence. The person who controls a private network is exempt from that offence on their own network, but the sender or recipient can sue them. Our router guide covers what you may monitor on your own network.

How to check if someone is reading your messages

Start with your accounts, not your router. Each check takes a minute or two.

WhatsApp: Settings (iPhone) or the menu (Android) > Linked devices. Log out any device you don’t recognise, and turn on two-step verification.
Google Messages: tap your account picture > Device pairing, and remove computers you don’t use, or unpair all of them.
iPhone: Settings > [your name], scroll down to the device list and remove what isn’t yours. Then check Settings > Apps > Messages > Text Message Forwarding.
Google account: look at google.com/devices and run Security Checkup.
Telegram: Settings > Devices, and end any session you don’t know.
Instagram and Messenger: Accounts Center > Password and security > Where you’re logged in.
Profiles: on an iPhone you set up yourself, Settings > General > VPN & Device Management should show no profile you didn’t install.
Passwords: if anyone else might know your Apple or Google password, change it and turn on two-factor authentication.
Your number: ask your carrier for a port-out lock, such as Verizon’s Number Lock or T-Mobile’s Account Takeover Protection.

On an iPhone with iOS 16 or later, Safety Check (Settings > Privacy & Security > Safety Check) does the Apple part in one place. It shows who you share with and which devices are signed in to your Apple Account, and its Emergency Reset stops all sharing at once. Android has no single screen like it, so the Google steps above are the closest equivalent.

If you think a partner or ex is watching your phone, the order matters. The FTC and the Coalition Against Stalkerware both warn that removing stalkerware or suddenly cutting off access can alert the person and make things more dangerous, and deleting it also deletes evidence. That includes an Emergency Reset; Apple, too, asks you to plan for your safety before you change anything. Make a plan first with a domestic violence advocate, using a device the other person can’t reach. In the US, the National Domestic Violence Hotline answers at 1-800-799-7233, or text START to 88788. Signs the FTC lists include a battery that drains fast, unexpected data use, and someone knowing where you are or who you’re texting.

How to hide even which apps you use

The Wi-Fi owner can’t read your messages, but they may see that you use Signal at two in the morning. Which apps you use, and when, can say a lot on its own. If that bothers you, there are two ways around it.

Mobile data: switch off the Wi-Fi and the router sees nothing at all. Your carrier then sees what the router would have.
A VPN: the router sees one encrypted connection to the VPN server and none of the apps inside it. The VPN provider gets the router’s view instead, so it should be one you trust more than the Wi-Fi owner. Our beginner’s guide to VPNs explains how it works and how to set one up. On a work or school network, check the rules first, as some don’t allow VPNs.

Neither changes anything about the messages, which were encrypted already. They only hide the envelope.