Midwatch: Network Scan

Is the Wi-Fi you're on reading your traffic? Midwatch finds out in one tap.

Hotel, airport, café, office or campus — some networks quietly decrypt HTTPS, rewrite DNS answers, block secure messengers or push you through a hidden proxy. Midwatch runs six independent checks at once and gives the network a trust score out of 100, a plain-language verdict, and the evidence behind every finding.

SIX CHECKS, ONE SCAN
• TLS interception — spots certificates re-signed by an installed or untrusted root, missing Certificate Transparency proofs, downgraded handshakes, blocked TLS 1.3 and more than 50 known inspection products.
• DNS integrity — detects redirected DNS, forged answers, NXDOMAIN hijacking, missing DNSSEC validation and blocked encrypted DNS (DoH and DoT).
• HTTP path — finds captive portals, transparent proxies, substituted pages, split TLS and SSL stripping.
• Egress policy — shows which ports leave the network, whether UDP and QUIC get out, and gaps in IPv6.
• Communication — checks whether Signal, WhatsApp, Telegram, iMessage, FaceTime, Zoom, Discord and others are reachable, and which layer stopped them: DNS, IP address, SNI filtering, reset injection or a certificate that isn't the service's own.
• Time sources — measures clock skew against independent NTP servers and catches NTP redirection.

Firewall rules are reported as posture, never as penalties, so a strict network is not mistaken for a compromised one. When a VPN is active, Midwatch attributes what it finds to the tunnel rather than the network.

NETWORK TOOLS
• Ping with a live latency chart, packet loss and jitter
• Traceroute with reverse DNS and timings for every hop
• Port checker that tells open, refused and silently filtered apart
• DNS lookup for any record type over UDP, TCP, DNS over TLS or DNS over HTTPS
• TLS / SSL certificate inspector for any host
• HTTP inspector for status, headers and timing — no redirects, no proxy, no cache
• Public IP address and NAT type

DEVICE INFO
Interfaces, default route, DNS servers and VPN status; battery, storage and thermal state; and a security posture summary covering passcode, biometrics, jailbreak indicators, debugger and proxy settings.

PRIVATE BY DESIGN
• No account, no ads, no analytics, no tracking
• Your last report stays on your device, encrypted, until you choose to share it
• Midwatch only talks to well-known public services — DNS resolvers, NTP and STUN servers and major websites — exactly as a browser would
• Built entirely on Apple's networking and security frameworks, with no third-party code

FOR ANYONE WHO NEEDS TO KNOW
Travelers on hotel and airport Wi-Fi, journalists and activists, remote workers, IT and security teams. Midwatch is a native port of the open-source midwatch command-line tool, so your iPhone, iPad and laptop reach the same verdict on the same network.

Midwatch detects interception that leaves evidence. A clean result is strong reassurance, not a guarantee.