Wyze

Is Wyze safe?

Wyze is acceptable for low-stakes spots like a driveway, a garage or a pet camera, but it has the weakest security record of the camera apps we score. Three times since 2019, Wyze's own systems have exposed customer data, and twice that meant people seeing images from cameras that were not theirs. It requires two-step login and runs a bug bounty, and live streams run directly between camera and phone, but there is no end-to-end encryptionEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary for recorded events. We score Wyze 55/100, below Ring at 57 and eufy at 60.

How did Wyze users see other people's cameras?

The largest incident came on Friday 16 February 2024. After an outage that Wyze traced to its cloud provider AWS, cameras came back online and some users found thumbnails from strangers' cameras in the Events tab of the app. Wyze shut the tab, logged out everyone who had used the app that day and investigated. Wyze's co-founder wrote on its forum three days later that about 13,000 users had received thumbnails from other accounts and 1,504 had tapped on them. Most taps only enlarged a still image, but in a few cases involving Cam Plus Lite and sound events, a video played. Live streams were not affected. Wyze blamed a third-party caching library it had recently added, removed it and added another check between users and event videos.

It was not the first time. Around 8 September 2023, users who logged into the Wyze web viewer saw other people's cameras for about 30 minutes; Wyze told reporters roughly ten users were affected and blamed a web caching issue. In December 2019 an employee removed the protections on a copy of a database, leaving customer emails, camera nicknames, Wi-Fi network names, device details and some beta testers' body measurements exposed from 4 to 26 December. Wyze said every account created before 26 December 2019 was affected but no passwords, payment details or videos were in it. It forced everyone to log in again, later added authenticator-app login and in 2022 made two-step login mandatory.

Why did one camera flaw take three years to fix?

Bitdefender researchers found three flaws in Wyze Cams: a way to bypass login, a bug that let an attacker run code on the camera, and unauthenticated access to the contents of the microSD card. Their timeline says they first contacted Wyze on 6 March 2019 and got no reply. Wyze fixed the login bypass on the Cam v2 in September 2019 and the code bug in November 2020. The fix for SD card access came on 29 January 2022, almost three years after first contact. The original Wyze Cam v1 had been discontinued and never received the fixes.

Wyze now runs a bug bounty on Bugcrowd. The US vulnerability database still lists several serious Cam v3 flaws published in 2024, including ones that let a nearby attacker run code over Wi-Fi.

What does Wyze do with your data?

Wyze says live streams travel directly from camera to phone with AES-128 encryption, so staff cannot watch them, and that event videos stored on AWS can be opened only by executive-level managers in cases like a subpoena. That is a policy, not a technical lock.

Apple's App Store label shows no tracking but lists a lot as linked to you: photos or videos, audio, precise location, name, address, email, phone number, health data and sensitive info. The privacy statement, effective May 2026, goes further. Wyze lets advertising partners collect data through cookies, pixels and SDKs, and some partners turn your email address or phone number into an identifier to show you ads elsewhere, which Wyze says may count as selling or sharing under some state laws. Its AI features, such as Descriptive Alerts, use generative models on your clips, but Wyze says your videos train its models only if you agree.

How to use Wyze cameras more safely

1. Switch two-step verificationTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary to an authenticator app rather than email or text messages.
2. Record to a microSD card where you can, and keep cloud event recording for outdoor cameras.
3. Do not point Wyze cameras at bedrooms, bathrooms or children's rooms.
4. Use the opt-out choices in the privacy statement to refuse targeted advertising, and decline AI training prompts.
5. Update firmware promptly, retire cameras Wyze no longer supports, and put cameras on a guest network.

How we scored it

The regulatory record (86) is Wyze's strongest factor, because no regulator has fined or ordered it. Security (43) is the weakest, after repeated incidents in which customers saw data from other accounts and a flaw left open for almost three years. Privacy (48) follows the privacy statement's ad sharing rather than the cleaner App Store tracking section.