How to see what your apps are actually doing

Every app on your phone holds conversations you never see. There are four honest ways to listen in, they range from free-but-hard to five-minutes-easy, and none of them requires jailbreaking anything.

Option 1: On-device packet capture (free, hard)

Tools like rvictl on Mac or a local VPN-based capture app record everything the phone sends. Maximum detail, but you're reading TLS handshakes in Wireshark, most payloads are encrypted anyway, and running it continuously is impractical. Good for a one-off investigation of a single suspicious app.

Option 2: A man-in-the-middle proxy (free, harder)

mitmproxy or Charles can decrypt an app's HTTPS if you install a trusted root certificate. This is the deepest view available — actual request contents — but certificate pinning breaks it for exactly the apps you're most curious about, and leaving an interception root installed on a daily-driver phone is a real security trade.

Option 3: The phone's own privacy reports (free, shallow)

iOS App Privacy Report and Android's privacy dashboard are genuinely worth turning on. They show which sensors an app touched and some contacted domains. But they sample rather than log, keep little history, and present a flat list with no timeline — you learn an app has contacted an ad network, not when or how much.

Option 4: DNS logging (easy, continuous)

Every connection starts with a name lookup, and unlike payloads, lookups can be logged cleanly and continuously. Point the device at its own encrypted DNS endpoint and you get a permanent record of every service every app contacted, timestamped, with no software on the device beyond a configuration profile.

The raw form is still hostnames — rupload.facebook.com at 21:04. DNSight's engine turns that into the readable form: Opened Instagram — posted something. Sequence matters more than any single lookup: a first-ever app domain followed by a phone-verification service reads as a signup, and that inference is exactly what a flat log can't give you.

Which one should you use?

• Investigating one app once: mitmproxy, an afternoon, and patience
• A quick sensor-access audit: the built-in privacy reports, today
• Continuously understanding your devices: DNS logging — it's the only approach that runs forever, everywhere the device goes, including cellular

DNSight is the fourth option as a product: per-device encrypted endpoints, a timeline you can read, search across 30 days of history, and per-device blocking packs on Pro and Expert once you've seen what deserves blocking. Setup is a configuration profile and takes about five minutes — here's what one night of it looks like.

Common questions

Do I need to jailbreak or root my phone?

No. All four approaches work on stock devices. DNS logging in particular is just a configuration profile on iOS/Mac or a private DNS setting on Android.

Can any tool show me the actual content apps send?

Only an interception proxy with a trusted root certificate (option 2), and only for apps without certificate pinning. Nothing reads encrypted payloads from the outside — claims otherwise are marketing.

Does DNS logging work on cellular data?

Yes. The encrypted endpoint is a device setting, not a network setting, so logging continues on 5G, hotel Wi-Fi and roaming.

What about my smart TV or console?

Same mechanism. TVs are among the chattiest devices in a home, and a DNS timeline is usually the first time anyone sees it.