The network check

Join the Wi-Fi in a hotel, a rental or a café and Clearsweep can look at the network itself: how it is set up, what the router shows a guest, and what other devices answer. It reports what it saw. It cannot tell you the building is fine, and it never says so.

Who it is for

Someone in a hotel room or a short-let who wants a first look at the network in two minutes (the order and the time each step gets), and someone at home who wants to see what is on their own network and what their router offers (the router settings worth knowing).

The checks

Network cameras

Lists the devices that answer on the Wi-Fi this device is joined to, with what each one says about itself (its name, its open ports, what it announces). The laptop tool also matches each one's hardware address against known camera makers; a phone is not allowed to read those.

It cannot find: A camera on a different network, including one on its own hidden Wi-Fi All of what it misses.

Wi-Fi mode

Asks the operating system how the joined Wi-Fi network is encrypted: open, WEP, WPA/WPA2/WPA3 personal, enterprise or OWE. It reads what the OS reports and sends nothing.

It cannot find: Whether anyone else on this network knows the password, which at a hotel is every guest All of what it misses.

Sign-in page check

Asks the operating system whether this network is holding you at a captive sign-in page before it lets you online. On a phone it reads the platform's own flag; the laptop tool makes one plain web request to a public test address.

It cannot find: Whether the sign-in page is the hotel's or a copy of it All of what it misses.

DNS answers

Looks up a few well-known names through this network's own resolver and through a public resolver (Quad9, over HTTPS), then compares the answers. This is the one check that sends a request to the internet: it carries the test name, and nothing about you or your network.

It cannot find: A hijack of names this check did not ask for All of what it misses.

Router admin page

Connects to the router (the default gateway) on its usual administration ports and notes which answer. It never logs in and never tries a password.

It cannot find: Whether the admin page accepts the factory password: this check never tries one All of what it misses.

Can other guests reach me

Compares what the device list found: if the router answers but nothing else does, the network looks isolated; if many other devices answer, it does not. This is an inference from the list, because no system call reports isolation.

It cannot find: Hosts that exist but do not answer the ports tried All of what it misses.

Smart-home exposure

Looks, from the device list and one UPnP search, for devices speaking local protocols that old firmware leaves unprotected (TP-Link Kasa's legacy port) and for a router that offers UPnP port mapping.

It cannot find: Whether the firmware is old: an open port does not say All of what it misses.

ARP spoof signal

Reads the computer's ARP table (which hardware address each local address belongs to) before and after a 20-second window and compares the router's row. Laptop tool only: a phone is not allowed to read this table.

It cannot find: A spoof that starts after the check ends All of what it misses.

A phone and a laptop see different things

The Android app reads how the Wi-Fi is set up, connects to the router and to each address on the network and closes at once, sends discovery questions that devices exist to answer, listens for devices announcing themselves, and asks the router's own name list what each device called itself. It cannot read other devices' hardware addresses, so it cannot name their makers from them. This phone cannot read hardware addresses, so it names fewer makers than the Clearsweep laptop tool. On Android 11 and older it cannot read the Wi-Fi mode at all, and says so.
The laptop tool (clearsweep network) does the same and can also read the computer's ARP table, so it names makers from the public IEEE registry and can watch for the router's hardware address changing. It is built and tested, but it has not been published to npm yet, so npx clearsweep network will not run it until it is.
This website checks nothing about your network. It has no script, and a page cannot see your Wi-Fi.

The one request to the internet

One check, the DNS comparison, uses the internet, and only when you ask. It looks up dns.google, one.one.one.one, dns.quad9.net through the network you are on and through Quad9 (https://dns.quad9.net/dns-query), and compares. Quad9 sees those three names and your internet address, as any website would; it is told nothing about your network or your devices. Everything else stays on the Wi-Fi you are joined to. See the privacy page.

How to read a count of devices

A count of devices is never the whole network. Devices that did not answer are not counted. Devices on a separate network, a phone asleep, and a camera that speaks only to its maker's cloud are all absent. A device the check could not name is listed as UNKNOWN: that means unknown, not suspicious and not fine.

Hotels often isolate guests from each other, so a scan shows the router and almost nothing else. That tells you the network is set up that way. It does not tell you the building has no camera.