Phone Checker for Android

Android Phone Checker for Windows, macOS and Linux

Run read-only security and privacy checks on your Android phone directly from your computer. Uses standard ADB over USB—no root or exploits required. Review permissions safely, and only apply changes with explicit confirmation.

  • No root, no exploits
  • Every check is read-only
  • Changes only with your confirmation

Free software · MIT · not sold

Runs on
Windows, macOS and Linux
Connects over
ADB, and nothing else
Built with
Electron, zero runtime dependencies
Network
No requests of its own

Complete permission audit across installed apps

Thirteen permission groups, each with a count, and every app that holds one listed underneath. The app says where a grant came from — whether the system handed it over or you did — and separates the ones that hold nothing right now.

  • Allowed, ask each time, and not allowed, as separate lists
  • Granted by the system, or your choice, marked per row
  • Apps currently asleep flagged as such
  • Undo permission changes, and export the audit

App provenance and installation origins

Every package on the phone with the record of how it arrived: a store, a sideload, an adb push, or the firmware itself. The detail view says who installed it, who owns its updates, where it lives on the phone, and which claims the phone cannot actually prove.

  • From a store, sideloaded, preloaded, or removed — as filters
  • Installer of record and who owns future updates
  • Location on the phone, state, and signing certificate id
  • Notes that say when a date is a firmware placeholder rather than an install

Guided debloat advisor with clear trade-offs

The debloat advisor matches what is on the phone against a knowledge base written in plain language. Each package says what it is and what disabling it costs, banded so the consequences are graded rather than uniform, and the ones known to break the camera, screenshots or Settings can never be selected at all.

  • Recommended, optional, caution and keep — with the trade-off written on the row
  • A Search web button, if you would rather look into it yourself first
  • Disabling uses Android’s ordinary user-level command, and is undone from inside the app
  • Audited phone settings compared against a hardened baseline, with each cost spelled out

Snapshot comparisons and system update diffs

A saved state is a labelled picture of the phone kept on your computer: build and patch level, every package with its version and installer, all system settings, sensitive permission grants and battery states. Save one before a system update and one after, and the app tells you exactly what moved — including the preloads the update switched back on.

  • Any two saved states, compared side by side
  • Health-check runs comparable the same way — “what changed?” between any two
  • A full report export: report.json plus the raw output of every command behind it
  • Accounts, app usage, system log and network history are left out unless you opt in

Transparent ADB command execution and live console

The Console shows every ADB command the app issued, in order, with how long it took and how much came back, and appends it to a daily log on your computer. The Terminal is a real prompt with about sixty ready-made commands beside it, each showing the exact line it will run before it runs it.

  • Read-only commands run on a click; anything else asks first
  • Destructive commands are confirmed twice, and an unknown command counts as a write
  • The app makes no network requests of its own — “Search web” opens your browser
  • Verify an app by pulling its APK, hashing it locally, and deleting the copy

Every feature, in full

A list of features you can find in the application.

Phone Checker feature categories
  • Ten named checks

    Boot and OS integrity, stalkerware and preload tripwires, spyware capability surfaces, new packages since the last run, install sources, masquerading package names, network and debug surfaces, enabled keyboards, privacy-hardening settings, and preinstalled store background activity.

  • Five results, not two

    Flagged, worth a look, information, clear, and could not be read — an unreadable check is never counted as a pass.

  • Each result opens

    Every row expands to the evidence behind it, listed line by line.

  • Device summary

    Boot verification, bootloader lock state and how old the security patch is, as chips beside the result.

  • Issue trend

    Past runs charted, so a new finding is visible against a clear baseline.

  • Export

    The check results leave the app as a file.

  • Software identity

    Android and SDK version, vendor skin, security patch, build, build date, baseband, bootloader, kernel, sales code and locale.

  • Package counts

    Installed, user-installed, system or preloaded, and disabled, counted separately.

  • Per-core clocks

    Every core’s current frequency, labelled efficiency or performance, with load averages and the scheduler governor.

  • Memory and storage

    RAM in use, swap, and the data partition, each against its total.

  • Battery detail

    Charge, state, health, temperature, voltage, current and charge counter.

  • Chip and display

    Chipset, board, CPU architecture, GPU and driver, screen resolution, density and refresh rate.

  • Every thermal sensor

    All of them, named, with the hottest surfaced at the top of the page.

  • Live readings

    A toggle that turns the page into a running graph of processor and memory use.

  • Export, including PNG

    The hardware page as data or as an image.

  • All, user, system, disabled

    The package list split four ways, with a namespace filter over the top.

  • How it arrived, per row

    Badges for a store install, a sideload, an adb or USB push, a firmware preload, and a preload that has since been updated.

  • Battery restriction

    Packages the phone has restricted in the background are marked in the same list.

  • Install origins, dated

    First installed and last updated per package, sortable, filterable by a date range.

  • Installer of record

    Who performed the install, and who owns its future updates — recorded separately.

  • Location and signature

    Which partition the APK sits on, whether it is enabled, and its signing certificate id.

  • Honest about install reasons

    A user-requested tag is set by the installer itself, and the app says so rather than treating it as proof.

  • Verify app package

    The APK is pulled to this computer, its SHA-256 computed locally, and the temporary copy deleted.

  • Search the checksum yourself

    A separate step that opens your own browser — nothing is sent anywhere by the app.

  • Thirteen audited groups

    Camera, microphone, location, contacts, SMS, phone and call log, calendar, photos and files, body and activity, install unknown apps, display over other apps, usage access, and all-files access.

  • Three holdings

    Allowed, ask each time, and not allowed, each with its own count and list.

  • Who granted it

    Granted by the system, or your choice — the distinction is on the row, not inferred later.

  • Currently asleep

    Apps the phone has put to sleep are marked, so an idle grant is not mistaken for an active one.

  • Select and revoke

    Tick rows individually or take the whole filtered list, and revoke together.

  • Undo permission changes

    A running count of what this session changed, revertible from the same bar.

  • Jump to the origin

    Every row carries a way through to where that package came from.

  • Export

    The permission audit as a file.

  • Debloat advisor

    Known packages sorted into unhandled and handled, each with what it is and what disabling it costs.

  • Banded by consequence

    Optional means it disables a feature some people use; caution means the trade-off is spelled out before you can act.

  • Audited phone settings

    A fixed set of settings compared against a hardened baseline, grouped into privacy, security and leanness.

  • Differs, or matches

    Each setting shows its current value and the recommended one, with a trade-off note where one exists.

  • Select all differing

    Take everything that departs from the baseline in one selection.

  • Saved states

    Labelled snapshots of packages and settings, taken on demand and kept in a folder you can open.

  • Compare two states

    Pick any two snapshots and see what moved between them.

  • Full report

    An export of everything, with accounts, app usage, system log and network history left out unless you opt in.

  • History

    Every check run, comparable against any other, alongside a log of the revokes, trust marks and reports this app made.

  • Every command, logged

    The Console shows each adb line the app ran, with how long it took and how much came back.

  • Today’s log, on disk

    Openable from the app, along with the folder holding the rest.

  • Device polling, hidden by default

    The background chatter is filtered out until you ask to see it.

  • A command library

    Grouped by topic, each entry showing the exact adb line it will run before you run it.

  • Reads run, writes ask

    Commands recognised as read-only run on a click; anything else asks, destructive ones ask twice, and an unknown command counts as a write.

  • Copy output, run again

    On every result, so a command can be repeated or pasted elsewhere without retyping.

  • A link to the reference

    The official adb documentation, rather than the app’s own paraphrase of it.

  • Ten named checks

    Boot and OS integrity, stalkerware and preload tripwires, spyware capability surfaces, new packages since the last run, install sources, masquerading package names, network and debug surfaces, enabled keyboards, privacy-hardening settings, and preinstalled store background activity.

  • Five results, not two

    Flagged, worth a look, information, clear, and could not be read — an unreadable check is never counted as a pass.

  • Each result opens

    Every row expands to the evidence behind it, listed line by line.

  • Device summary

    Boot verification, bootloader lock state and how old the security patch is, as chips beside the result.

  • Issue trend

    Past runs charted, so a new finding is visible against a clear baseline.

  • Export

    The check results leave the app as a file.

  • Software identity

    Android and SDK version, vendor skin, security patch, build, build date, baseband, bootloader, kernel, sales code and locale.

  • Package counts

    Installed, user-installed, system or preloaded, and disabled, counted separately.

  • Per-core clocks

    Every core’s current frequency, labelled efficiency or performance, with load averages and the scheduler governor.

  • Memory and storage

    RAM in use, swap, and the data partition, each against its total.

  • Battery detail

    Charge, state, health, temperature, voltage, current and charge counter.

  • Chip and display

    Chipset, board, CPU architecture, GPU and driver, screen resolution, density and refresh rate.

  • Every thermal sensor

    All of them, named, with the hottest surfaced at the top of the page.

  • Live readings

    A toggle that turns the page into a running graph of processor and memory use.

  • Export, including PNG

    The hardware page as data or as an image.

  • All, user, system, disabled

    The package list split four ways, with a namespace filter over the top.

  • How it arrived, per row

    Badges for a store install, a sideload, an adb or USB push, a firmware preload, and a preload that has since been updated.

  • Battery restriction

    Packages the phone has restricted in the background are marked in the same list.

  • Install origins, dated

    First installed and last updated per package, sortable, filterable by a date range.

  • Installer of record

    Who performed the install, and who owns its future updates — recorded separately.

  • Location and signature

    Which partition the APK sits on, whether it is enabled, and its signing certificate id.

  • Honest about install reasons

    A user-requested tag is set by the installer itself, and the app says so rather than treating it as proof.

  • Verify app package

    The APK is pulled to this computer, its SHA-256 computed locally, and the temporary copy deleted.

  • Search the checksum yourself

    A separate step that opens your own browser — nothing is sent anywhere by the app.

  • Thirteen audited groups

    Camera, microphone, location, contacts, SMS, phone and call log, calendar, photos and files, body and activity, install unknown apps, display over other apps, usage access, and all-files access.

  • Three holdings

    Allowed, ask each time, and not allowed, each with its own count and list.

  • Who granted it

    Granted by the system, or your choice — the distinction is on the row, not inferred later.

  • Currently asleep

    Apps the phone has put to sleep are marked, so an idle grant is not mistaken for an active one.

  • Select and revoke

    Tick rows individually or take the whole filtered list, and revoke together.

  • Undo permission changes

    A running count of what this session changed, revertible from the same bar.

  • Jump to the origin

    Every row carries a way through to where that package came from.

  • Export

    The permission audit as a file.

  • Debloat advisor

    Known packages sorted into unhandled and handled, each with what it is and what disabling it costs.

  • Banded by consequence

    Optional means it disables a feature some people use; caution means the trade-off is spelled out before you can act.

  • Audited phone settings

    A fixed set of settings compared against a hardened baseline, grouped into privacy, security and leanness.

  • Differs, or matches

    Each setting shows its current value and the recommended one, with a trade-off note where one exists.

  • Select all differing

    Take everything that departs from the baseline in one selection.

  • Saved states

    Labelled snapshots of packages and settings, taken on demand and kept in a folder you can open.

  • Compare two states

    Pick any two snapshots and see what moved between them.

  • Full report

    An export of everything, with accounts, app usage, system log and network history left out unless you opt in.

  • History

    Every check run, comparable against any other, alongside a log of the revokes, trust marks and reports this app made.

  • Every command, logged

    The Console shows each adb line the app ran, with how long it took and how much came back.

  • Today’s log, on disk

    Openable from the app, along with the folder holding the rest.

  • Device polling, hidden by default

    The background chatter is filtered out until you ask to see it.

  • A command library

    Grouped by topic, each entry showing the exact adb line it will run before you run it.

  • Reads run, writes ask

    Commands recognised as read-only run on a click; anything else asks, destructive ones ask twice, and an unknown command counts as a write.

  • Copy output, run again

    On every result, so a command can be repeated or pasted elsewhere without retyping.

  • A link to the reference

    The official adb documentation, rather than the app’s own paraphrase of it.

See it working

Take a look at the user interface of the application.

What this app does not do/mean

Here is exactly what Phone Checker does not do:

  • Not a malware scanner, not an antivirus, not a certification tool. It helps you look at your own phone, understand what is on it, and make reversible changes you agreed to.
  • The stalkerware tripwire compares against a small list of publicly documented package names, so a clean result there means “nothing on that list”.
  • No root, no unlocked bootloader, no exploit. It uses the documented debugging interface and nothing else, as the unprivileged shell user.
  • The app makes no network request of its own. The only things that reach the internet are the Search web buttons, which hand an https address to your own browser.
  • A failed read is never a pass. A check that could not see what it needed is reported as unreadable, in grey, and never counted as clear.
  • Published without support. Issues and pull requests may sit; the fix is in your own fork.

How every FlosForge app works

  • No telemetry

    No analytics, no crash reporting, no usage pings. Not configurable — simply absent.

  • Local storage only

    Your data stays on your own device, stored in private application sandboxes under your control.

  • Open exports

    Everything exports to standard formats you own (CSV, GPX, JSON, Markdown), with zero lock-in.

Getting it running

Download the code of the app on your computer and run it following the instructions. The app is based on Electron which is a technology that allows it to run in all three major platforms but it requires that you install a few depedencies as mentioned below. You can review the full code for security and know exactly what it does before you run it.

Before you start

Back up your phone before you approve anything. Every check is read-only, but the moment you want to disable a package, change a setting or move a permission, take a full backup first — use your phone maker’s own tool over USB, or your cloud backup, and check your photos and messages are included. Applied changes are recorded so you can undo them from the app, with one exception: turning USB debugging off removes the channel that would be needed to reverse it. Use it only on a phone you own or are authorised to manage.

What you need first

  • Node 20 or newer, on Windows, macOS or Linux
  • Google’s Android platform-tools (adb) — the app finds the copy you already have, and does not bundle it
  • A USB data cable, not a charge-only one. On Windows you may also need the manufacturer’s USB driver
Phone Checker on GitHub
  1. Clone it and start it

    Two commands. npm start works from any terminal, including the ones built into editors.

    git clone https://github.com/dimitriostzr/android-phone-checker.git
    cd android-phone-checker
    npm install
    npm start
  2. Turn on Developer options, then USB debugging

    Settings → About phone (sometimes → Software information), then tap Build number seven times. USB debugging is then under Settings → Developer options.

  3. Turn off any app-security guard that blocks USB commands

    Called Auto Blocker on some phones, usually under Settings → Security and privacy. While it is on, adb cannot reach the phone and the app will not see it. Turn it back on when you are done.

  4. Plug in, unlock, and accept the prompt

    The phone asks whether to allow USB debugging from this computer and shows the computer’s key fingerprint. Accept it, then read and tick the app’s own notice.

  5. Run the checks, then save a state

    Red cards are the ones to read. Save a state afterwards so the next run, or the next system update, has something to compare against.

  6. Turn USB debugging back off

    Quitting shows a checklist with a button that does it for the connected phone. Then turn Developer options off too — turning debugging off does not turn it off — and unplug. Leaving debugging on means any computer you have allowed can run the same commands this app runs.

Free software · MIT · not sold

Free and open source

Phone Checker is released under the MIT License. It is not sold — there is no paid version, no licence key and no tier — and the licence is the whole arrangement. In plain terms:

  • It is free software, and it is not sold: there is no paid version, no licence key and no tier behind any of it.
  • You may use it for any purpose, read every line of it, change it, and pass on copies — original or modified.
  • Whatever you pass on to others keeps the copyright notice and the licence text. That is the one condition.
  • It comes without warranty of any kind. You use it at your own risk, on devices you own or are authorised to manage.

Free, and the source is public

Phone Checker for Android is free software, published in full on GitHub. Clone it, audit it, or fork it. It is offered without a support commitment, so read the README first and try it on a machine you can afford to experiment with.

View on GitHub

No account, no telemetry, nothing reported back.

Trademarks and affiliation

FlosForge is an independent, one-person project. It is NOT affiliated with, endorsed by, sponsored by, certified by, approved by or connected in any way to any of the companies or organisations named below, or to any other company whose products, services or trademarks appear anywhere on this site or inside its screenshots. None of them has reviewed, approved or supported this software, and no such relationship is claimed or implied. Their names appear here for one reason only: to identify the software the pages are talking about.

Apple Inc.
Apple, macOS, Mac, the Mac App Store, Touch ID, Keychain and Apple Intelligence
Microsoft Corporation
Microsoft, Windows, Visual Studio, WinUI and .NET
Google LLC
Google, Android, Google Play, Google Drive, Health Connect and Gemini
Samsung Electronics Co., Ltd.
Samsung, Galaxy, Samsung Health and S Pen
the WordPress Foundation
WordPress
Linus Torvalds
Linux, registered in the U.S. and other countries
The MITRE Corporation
CVE (registered trademark) and CWE
Docker, Inc.
Docker
the OpenJS Foundation
Node.js and Electron
Cloudflare, Inc.
Cloudflare and R2
Amazon.com, Inc. or its affiliates
Amazon Web Services, AWS and Amazon S3
GitHub, Inc.
GitHub
the OpenStreetMap Foundation
OpenStreetMap
Yoast BV
Yoast
reMarkable AS
reMarkable, reMarkable 2 and reMarkable Paper Pro

cURL, Python, Ollama, Backblaze, Wasabi, MinIO, GeoNames, OpenTopoMap, NVD (National Vulnerability Database), the security advisory databases named on the project pages, and every other product, brand or company name shown on this site or inside its screenshots are the property of their respective owners. This product uses data from the NVD API but is not endorsed or certified by the NVD. Each mark is used nominatively — to identify the software, platforms or data sources concerned — and never as a badge of origin, quality or endorsement.