How to Know If Someone Is Stealing Your WiFi (5-Min Check)

Short answer: Open your router's connected-devices list, switch off WiFi on every device you own, and refresh. Anything still listed is a device you haven't identified. Look up its MAC address to find the manufacturer, and if you can't account for it, change your WiFi password and disable WPS. The whole check takes about five minutes.

"Stealing your WiFi" usually means a neighbor, a former roommate, or someone who got your password once and kept using it. The cost isn't only bandwidth. Anyone on your network can reach other devices on it, which is why this is worth five minutes to verify instead of guessing from how fast your internet feels.

Signs someone may be on your WiFi

None of these prove anything alone. They're reasons to run the check below, ranked by how reliable they are.

Devices you don't recognize in the router's list. The only strong evidence. Everything else is circumstantial.
Router activity lights stay busy when everything of yours is off. Useful, but modems and routers also light up for background updates and smart devices you forgot about.
Unexplained data usage. Many routers and ISP portals show usage per device or per day. A spike while you're away is worth investigating.
Slower speeds or lag. The weakest signal. Congestion, distance from the router, and ISP issues cause this far more often than a stranger does.
Your WiFi password was shared widely or never changed. Ex-roommates, past guests, and contractors who still have it count as unauthorized in practice.

How to check who is on your WiFi (5 minutes)

Log in to your router. Open 192.168.1.1 or 192.168.0.1 in a browser. On Android, Settings → WiFi → your network → Advanced shows the gateway address. The default login is often on a sticker on the router. If it still uses it, see our list of default router passwords and change it today.
Open the device list. Look for "Connected Devices," "Attached Devices," "Client List," or "DHCP Clients." Note the name, IP address, and MAC address of each entry.
Do the elimination test. Turn off WiFi on every phone, tablet, laptop, console, and TV you own, or unplug smart devices. Refresh the list. Whatever remains is unaccounted for.
Identify what's left. Paste the MAC address into our free MAC address vendor lookup. "Espressif" is usually a smart plug or bulb, "Apple" or "Samsung" is a phone or TV. A vendor match tells you what kind of device it is, not who owns it.
Cross-check with a scan. Router lists come from DHCP leases and can miss static-IP devices. A scanner that combines ARP, mDNS, and ping sweeps finds more. We cover that in how to find every device on your network.

Phones now randomize their MAC address. Android and iOS use a private MAC per network by default, so your own phone can appear as an unfamiliar device with an unknown vendor. Before assuming a stranger, check each phone's WiFi settings: the "private" or "randomized" address shown there will match the router's entry.

What to do if there's an intruder

Change the WiFi password. Use a unique passphrase of 14+ characters. This disconnects every device, so unauthorized ones can't rejoin without the new password.
Use WPA3, or WPA2 with AES. Avoid WEP, WPA, and TKIP. If your router offers only those, it's time to replace it.
Turn off WPS. The PIN-based setup has known weaknesses on many routers and gives a way in that doesn't need your password.
Change the router admin password. This is separate from the WiFi password. If an intruder could log in, they could have changed settings.
Disable remote management and update the router firmware.
Reconnect your devices, then recheck the device list to confirm nothing unexpected returns.
Set up a guest network for visitors and smart-home devices so the main network stays small and known.

Can you kick someone off WiFi without changing your password?

Changing your WiFi passphrase disconnects every single device in your home — meaning you have to reconnect your smart TVs, tablets, streaming sticks, and light bulbs one by one. If you want to kick an unauthorized device off without changing your password, here are the three methods and their limitations:

Router access control (Device Block / Pause): Most modern mesh routers (Eero, Google Nest WiFi, TP-Link Deco, Asus, Netgear) include a mobile app where you can select the unwanted device and tap "Block" or "Pause Internet." This instantly cuts off their internet connection without disturbing your other devices.
MAC address blacklisting: In your router's admin dashboard (usually under Advanced → Security → Access Control or MAC Filtering), you can add the intruder's MAC address to the blocklist. While effective for casual users, be aware that modern smartphones can bypass this by toggling "Private MAC address" or MAC randomization to get a new virtual address.
DHCP lease revocation: In your router's DHCP table, delete the intruder's active lease and reboot the router. If you turn off WPS and the user connected via a temporary WPS session or guest pin, they won't be able to re-authenticate.

The bottom line: If someone knows your actual WiFi password, blocking a single MAC address is a temporary band-aid. The permanent fix that saves your smart home sanity is to create a separate Guest WiFi network for friends, neighbors, and contractors, keeping your primary network password completely private.

How people get onto a WiFi network

A password that was shared and never changed. By far the most common cause.
A weak or guessable password, including the factory default printed on the router.
WPS enabled on a router with a vulnerable implementation.
Outdated encryption such as WEP, which can be broken in minutes.
A compromised router admin panel via default or reused credentials.

Is WiFi theft illegal?

In many jurisdictions, yes. Using a network without authorization can fall under computer misuse laws, regardless of intent. If you identify who it is and it's someone you know, a password change usually ends it. If you suspect something more serious, such as access to your devices or accounts, document what you found and contact your ISP or local authorities. Laws differ by country, so this is general information, not legal advice.

Make it a habit, not a one-time check

A clean list today says nothing about next month. ProbeShield scans your network on-device, labels each device by manufacturer, and keeps a local history, so you can compare today against last time and see exactly what changed. It also checks each device for open ports and risky services, which tells you whether a device on your network is a problem even when you do recognize it. For the full hardening routine, use the home network security checklist.

Frequently asked questions

How can I tell if someone is using my WiFi without the app? Log in to your router admin page (usually 192.168.1.1 or 192.168.0.1) and open the connected devices or DHCP client list. Turn off WiFi on every phone, laptop, and TV you own, refresh the list, and any device still listed is one you need to identify. Look up unfamiliar MAC addresses with a vendor lookup to see the manufacturer.

Can I see who is on my WiFi from my phone? Yes. Open your router's app or admin page in a mobile browser, or run a network scanner such as ProbeShield on Android. A scanner finds devices with ARP, mDNS, and ping sweeps, so it catches devices a router's lease table can miss.

Is it illegal to use someone else's WiFi without permission? In many countries, yes. Accessing a network without authorization can violate computer misuse laws such as the US Computer Fraud and Abuse Act or the UK Computer Misuse Act, even if the person only uses it to browse. Laws vary by jurisdiction.

Does a slow internet connection mean someone is stealing my WiFi? Not necessarily. Slow speeds are far more often caused by router placement, channel congestion, an overloaded ISP line, or your own devices running updates and backups. Treat slowness as a reason to check the device list, not as proof of theft.

How do I kick someone off my WiFi for good? Change your WiFi password to a long, unique passphrase using WPA3 or WPA2-AES, disable WPS, change the router admin password, and turn off remote management. Changing the WiFi password disconnects every device, and unauthorized devices cannot rejoin without the new one.

Will hiding my WiFi name or filtering MAC addresses stop WiFi theft? No. Hidden SSIDs are still visible to scanning tools, and MAC addresses can be spoofed by copying one from a legitimate device. A strong WiFi password with WPA3 or WPA2-AES is the control that actually works.

Can a guest or neighbor see my files if they are on my WiFi? It depends on what you share. A device on your network can reach other devices on the same network, so open file shares, unprotected cameras, NAS boxes, and printers are exposed. This is why a guest network and a strong password matter beyond the bandwidth loss.

How do I kick someone off my WiFi without changing the password? You can block a device without changing your WiFi password by using your router app's "Block" or "Pause" feature (Access Control) or by adding their MAC address to the router's MAC Filtering blacklist. Note that if the user enables MAC address randomization, they can bypass the filter, so setting up an isolated Guest Network or changing the password remains the most reliable permanent fix.