Support & FAQ

No, and it never will. There is no feature that guesses, brute-forces, or otherwise defeats a WiFi passphrase or WPS PIN, and none will be added.

Any app that claims to do this is either fabricating a result and showing you a random string, or requires a rooted device and is helping you commit an offence. We built neither.

No. Android provides no interface for an app to read a saved network's passphrase on a non-rooted device. This is an operating system limitation, not something we chose.

What you can do: Android's own Settings → WiFi → tap the network → Share produces a QR code containing the password. Scan that with WiFi Map's QR importer and it lands in your vault. That is the legitimate, working path.

Unlocking access to public and community-shared WiFi — venue passwords contributed by people entitled to share them, plus QR codes you scan yourself. It does not mean defeating anyone's security, and the app has no capability to do so.

Yes — scanning, measuring and diagnosing your own network is entirely legal, and so is finding public WiFi.

What is not legal, anywhere, is connecting to a network without authorisation. A network being visible, unsecured, or listed on our map is not permission. The full boundary is in the Acceptable Use Policy, which is worth two minutes of your time.

No. There is no sign-up, no email, no login. We have never known who you are and there is no profile to leak.

Android throttles WiFi scanning to four scans per two minutes in the foreground. Past that budget the OS silently returns cached results — every app hits this, most just hide it.

WiFi Map shows you the remaining budget and puts a countdown on the refresh button, so you can tell the difference between "nothing changed" and "the OS refused". Wait for the countdown and it will scan for real.

Two separate reasons, and which applies depends on your Android version:

• Android 13 and above: scanning does not need location. The app uses NEARBY_WIFI_DEVICES with the neverForLocation flag. Location is asked for only when you open the Map tab, for the "you are here" marker.
• Android 12 and below: the operating system returns no scan results at all unless the app holds location permission. That is Google's rule, not ours.

Either way, location is never collected in the background and never used to track you. See Privacy Policy §6.

On Android 13+, yes — everything works except the map's "my location" marker and contributing a hotspot.

On Android 12 and below, scanning features will return nothing, but Speed Test, Password Generator, Auditor, Vault, Router Access, History and Settings all still work.

Work through these in order:

1. Is WiFi turned on?
2. Is Location Services toggled on system-wide? On older Android, the permission alone is not enough — the location service must be on too.
3. Is the permission granted? Android Settings → Apps → WiFi Map → Permissions.
4. Are you within the scan throttle window? Wait for the countdown.
5. Some battery-saver and privacy modes block scanning outright. Check yours.

Because measurement choices differ, and ours are stated openly:

• We report the 90th percentile of throughput samples, not the mean. The mean is dragged down by TCP slow-start on every rung of the size ladder.
• Jitter is the mean absolute difference between consecutive latency samples — what Cloudflare's own component measures — not the standard deviation that many apps mislabel as jitter.
• Tests terminate at the nearest Cloudflare edge, so you are measuring your access link rather than the distance to a datacentre.

Neither result is "wrong". They are measuring slightly different things.

Because that is what we can actually measure. Real packet loss requires a WebRTC/TURN path we do not operate. So we report the ratio of failed HTTP requests to total requests and label it exactly that.

Showing a hardcoded "0.0% loss" would look better and be a lie. We would rather the label be slightly awkward and correct.

The measurement endpoint in use is download-only. Rather than invent a zero, the app shows --. Retry — the endpoint resolver caches its choice for ten minutes and will likely pick a different one after that.

Some ISPs and most captive portals block speed.cloudflare.com. The app automatically probes and fails over to our own endpoint when that happens, but a fully captive network will block both. Sign in to the portal first, then retry.

Yes — deliberately. A meaningful measurement has to move real data, up to a few hundred megabytes on a fast connection. The app reduces the ladder on mobile data, but if you are on a metered plan, be aware of it. This is true of every speed test, ours included.

The community layer only has what people have contributed. Early on, most areas are empty — and we deliberately ship no invented seed data, because sending you to a café that does not exist with a password that was never real is worse than showing nothing.

The Nearby now layer works immediately everywhere: it shows networks your own phone can hear, right now, with no contributions needed.

Below zoom level 9 the map deliberately loads nothing, and says so. A country-sized viewport spans thousands of data cells and individual pins are meaningless at that scale. Zoom in and data appears.

Because your phone knows an access point is in range, not where it physically sits. Placing a pin would be a guess presented as a fact. The Nearby layer is therefore a list, and only contributed entries — which carry real coordinates — get pins.

Contributions go to a local outbox first, because people add hotspots exactly where connectivity is worst. They upload when a connection is available.

If it stays queued indefinitely, the build you have may not be pointed at a backend. That is a supported state, not a broken one — the entry is saved and will upload once the backend is configured. The app never says "sent" when it means "queued".

Use the Network Owner Removal page. We action verified requests within 72 hours, we do not ask you to justify it, and we blocklist the network so it cannot be re-contributed.

Vote it down or tap Report on the hotspot. Both feed the moderation system, and entries that stop working decay out of the map automatically as their quality score falls.

Each passphrase is encrypted with AES-256 in counter mode under a per-entry nonce, then authenticated with an HMAC-SHA256 tag over nonce ‖ ciphertext. The key lives in Android's hardware-backed Keystore, never in the database.

Nothing in the vault is ever uploaded, synced or shared. We have never had a copy.

No. Clearing local data destroys the encryption key along with the entries. There is no cloud backup and no recovery path — by design, since a recovery path we control would mean we could read your passwords.

Export or note anything important before clearing.

Because Android requires it. Apps targeting Android 10 and above cannot add a network configuration silently — the OS shows its own confirmation sheet, which you accept or decline. The app sets that expectation before you tap, and treats a decline as your choice rather than a failure.

Yes — it uses the platform's cryptographically secure random number generator, not a seeded pseudo-random one. The strength meter estimates crack time from entropy and known-pattern rules, computed entirely on your device.

Discovery times TCP connections across your subnet. Devices that answer nothing on any probed port, are asleep, or sit behind client isolation will not appear. This is a limitation of what Android permits — unprivileged apps get no raw sockets, so true ICMP ping is unavailable. The screen says so rather than pretending otherwise.

A refused connection is a live host — something was there to refuse it. The tool counts it as up, and labels it accurately.

Correct, and deliberate. It detects your gateway and opens its admin interface in your browser. It never attempts a login and ships no default-credential list — that would be credential-attack tooling regardless of intent. Use your own router password.

The build has no Google Maps API key configured, so the app falls back to a distance-sorted list rather than showing the SDK's grey grid, which is indistinguishable from a broken app. Everything still works; only the visual map is missing.

A one-time Remove Ads purchase. No subscription, nothing renews. Pro includes it and also unlocks every optional depth feature permanently. Details on the Purchase & Refund Policy page.

No core feature ever is. Rewarded ads gate additional depth — the 5/6 GHz interference view, devices beyond the first five, extra vault slots, report export — and every one of them states the reward before it plays and offers a decline at equal weight. If a rewarded ad fails to load, the unlock is granted anyway.

Go to the Pro screen → Restore purchases. If that does not work, check you are signed in to the Google account that made the purchase, then email us the Play order number (GPA.xxxx-xxxx-xxxx-xxxxx).

Within 48 hours, refund yourself in the Play Store — profile icon → Payments & subscriptions → Budget & order history. After that, request through Google, and tell us too: we support refund requests where something did not work as described. Full detail in the Purchase & Refund Policy.

Sign in to the same Google account, install the app, and use the Pro screen → Restore purchases. It is free and unlimited — your entitlement is tied to the account, not the device.

Only: what you deliberately contribute to the community map; speed test traffic (which necessarily reveals your IP to the endpoint, as any request does); advertising data if you have not bought Remove Ads; and analytics if you leave it enabled.

Scans, network details, LAN device lists, heatmaps, vault entries and history never leave your device. Full detail in the Privacy Policy.

Settings → Privacy → Delete everything wipes the device side instantly. For server records, email us your install ID from Settings → About this app. Step-by-step on the Data Deletion page.

Analytics is tied to your advertising consent choice rather than sitting behind its own switch: decline consent in the Google form and analytics is disabled along with ads, with the app instance ID reset. Change your choice at Settings → Privacy → Ad privacy options, which appears wherever privacy law entitles you to change it. A standalone analytics toggle is planned.

Mostly, yes. Scanning, channel analysis, signal metering, heatmaps, device discovery, the vault, the generator and the auditor all work with no connection. Speed test, map tiles and contribution uploads need one — contributions queue locally until they have it.