Skip to main content

📱 Mobile

PlatformVersion
Android12 or above
iOS16 or above
Last review date
2026-02-24

General users​

Basic Level

Recommendations for all.

System hardening​

  • Setup an unlock passcode with at least 8 random digits
  • Setup SIM card pin code
  • Setup timeout auto-lock (duration as short as possible)
  • Turn on find my phone & remote wipe service
  • Turn on auto system update, use the latest system's version as always
  • Not allow to change phone setting when the phone is locked
  • Don't root or jailbreak if you don't know why you have to do so
  • Setup auto backup

App​

  • Check app permission regularly
  • Delete unused apps
  • Use web-apps instead of mobile apps 1
  • Consider to use open source app alternatives 2

Network​

  • Turn off wireless connections (Wi-Fi, Bluetooth...) and GPS location service when not in use

Information​

  • Hide notification content when phone is locked

  • Ads

    • turn off ads personalization
    • turn off sharing of usage and diagnostic

Android Only​

  • setup multi-user profile (e.g. one for personal account, one for work/others)
  • encrypt sd card
  • check app use access
  • check whether there are any Device admin apps or Trust agents pre-installed (without your acknowledgement)
  • Chrome and Android System Webview auto update
  • Disable 2G (Settings > Network & Internet > SIMs > Allow 2G → off). Note: 3G has also been phased out in many regions 3

iOS Only​

  • Erase data after 10 failed passcode attempts
  • allow access when locked
    • Control centre off
    • usb accessories (default off)
  • Location service
    • Significant locations - off
  • don't allow apps to track (App Tracking Transparency)
  • Privacy
    • Local network (for general audience, should be off) - will scan devices under the same wifi
    • Bluetooth

Third party apps​

  • Use open source Password manager, 2FA manager
  • Use encrypted messaging app (Signal)
  • Think twice before downloading a new app
  • Download an app with the developer/company that you trust with
  • Use the system's original keyboard apps, avoid to use third parties keyboard apps
  • Enable passkeys where available — phishing-resistant, no password to steal

Android

  • Password Manager: Bitwarden / KeePassDX
  • 2FA Manager: Aegis

iOS

  • Password Manager: Bitwarden / iOS Keychain
  • 2FA Manager: iOS built-in (Settings > Passwords)

Advance​

Advance Level

Recommendations for anyone who would like to have more control.

System Hardening​

  • learn quick steps to disable biometric authentication temporarily
  • setup emergency display (to proof that the device is yours without unlocking it)
  • reboot/restart the phone once a week 4
  • disable the accelerometer at the browsers 5

Android only​

  • download apps from F-droid, replace Play store if possible
  • location > Wi-Fi and bluetooth scanning off
    • Google location accuracy off
  • Don't login to Google, Disable google apps
  • Keyboard (Use offline AOSP version)
  • turn off NFC

Ninja​

Expert Level

Recommendations for anyone who would like to seek privacy.

System Hardening​

  • Disable fingerprint/TouchID, facial/FaceID

Network​

  • Encrypted DNS
  • Use a VPN service that you can trust with
  • Turn on Airplane mode when not in use, turn off the phone completely if leaving it at home
  • DNS ad-blocker

Information​

  • Image
    • remove exif before sharing
  • Turn off location and cellular, use trustable Wi-Fi with VPN only

Cloud​

  • avoid using any "Cloud" services/storage 6

Spy​

God Level

May be you should not use a mobile at all.

Reference​

LinkByDescription
Privacy Breakdown of Mobile PhonesELECTRONIC FRONTIER FOUNDATION - EFFDescribes how phones can aid surveillance and undermine users' privacy.
Data Security on Mobile DevicesMaximilian Zinkus, Tushar Jois, and Matthew Green (Johns Hopkins University)Answers: (1) What security measures prevent unauthorized access to user data? (2) How do unauthorized parties access devices? (3) How can devices be improved?
Secure an Android DeviceAndroid Open Source Project - AOSPDescribes Android’s security model, development practices, and its role in maintaining a secure platform and ecosystem.
Apple Platform SecurityAppleCovers Apple’s security architecture and how it’s embedded into all their platforms: mobile, desktop, watch, and home.
Android Security BulletinsAndroid Open Source Project - AOSPMonthly updates that fix security issues affecting Android devices.
Apple Security UpdatesAppleLists recent patches/releases and outlines Apple’s security update policy.
Personal Safety User Guide for Apple DevicesAppleGuide on keeping yourself and your data safe with Apple devices.

Footnotes​

  1. Web apps have much less phone's permissions than a mobile app ↩

  2. why recommending open source apps over closed source apps? Open source doesn't means safe/secure, it means that their codebase is open for professional to audit. use open source apps which are - updated recently - and with a large user base (app reviews/downloads/github stars) ↩

  3. VICTORY: Google Releases “disable 2g” Feature for New Android Smartphones ↩

  4. Operating systems benefit from a clean boot/startup, RAM will be cleared and some malicious stuffs will be removed when the device is powered off. ↩

  5. Ref: https://www.mysk.blog/2021/10/24/accelerometer-ios/ Chrome: Settings > Site Settings > Motion sensors > Turn Off. ↩

  6. The Cloud is a vague term, generally, The Cloud means someone else's computer or someone else's server. If you would like to avoid any risks of cloud data breach. You should avoid using The Cloud. Ref: 6 Reasons to Avoid Cloud Services and Keep Your Feet on the Ground - Make Use Of ↩