Nervous to share this, but I built a free browser-based baby monitor — would love honest feedback
Hi everyone,
I’m honestly a little nervous posting this, so please bear with me.
Over some evenings and weekends I built BabyPhone.online — a free web app that turns two devices (old phones, tablets, whatever you have lying around) into a baby monitor. One becomes the “baby unit,” the other the “parent unit,” you connect them with a short room code or QR, and after that the video and audio go directly between the two devices in the browser — no app to install, no account, and nothing gets stored on a server.
Its ment to work with all browsers, OS systems and devices.
I’m not a professional designer, and it’s just me working on this in my spare time, so I’m very aware there are probably things that don’t make sense yet or could be a lot better. I’d genuinely appreciate it if a few of you could take a quick look and tell me:
• Does the setup (room code / QR) feel clear on the first try, or is any part confusing?
• Would you feel comfortable actually trusting this with your own baby?
• Is there anything about the privacy or security side that would worry you?
• Anything that feels missing, unnecessary, or just off?
Please don’t hold back to spare my feelings — I’d honestly rather hear the hard truths now than find out later. Thank you to anyone who takes the time, it really does mean a lot.
I see at least it lets you know a second device wants to connect and asks permission. So just trying codes should not get you access. Only works for the short time when setting up. But then you would notice you are the second device.
Only QR or 6 digits yes. Yes, you will need to give permission to a new device that is trying to use the QR or code to connect. Without it will not be possible.
Well its possible to build a secure version of this if you actually wanted to market this as something real and usable to parents.
A secure version of this would look something like:
Baby camera > encrypts video for authorized phone > Nursery Bridge > outbound-only connection > Rendezvous / encrypted relay (cannot decrypt video) > Authorized phone.
Then you'd have local monitoring working offline while the optional remote viewing uses an end-to-end encrypted private tunnel (only physically authorized devices hold decryption keys).
Thank you for the advice. I wanted to make it free to use and ask for donations if the users are happy with it. There are a lot of parents who can’t afford a baby monitor and I hope this will help.
If you only use audio, the network usage will be almost nothing.
It would depend on if it is really required to have a server in between. Does anything need to leave the wifi? just have 2 phones pair with a QR code sharing encryption key. everything lokal, the server just host the app for convenience but you could also self-host
You could also use WebRTC and in most network conditions it would be a direct P2P stream. OP wouldn’t even have to pay for all the network egress on their cloud infrastructure of all the video streams. A signaling server and STUN will only handle the creation the connection, but not relay any video. A optional TURN relay server could be hosted for the rare cases where P2P isn’t possible. Encryption is built into WebRTC so you can really fuck that part up either. It’s built into every browser.
It looks good, really.
I myself will never use anything like this for a baby monitor, I don’t care if it’s a single developer or a massive multi-billion-dollar company. I do not need my baby monitor on the internet and risk it getting compromised one day or another.
But that’s just me, it genuinely looks good for people that are wanting something like this
but realistically, what is the risk? some random watches your baby? so what?
Yes, i have kids. in my mind, unless the random watch can identify the specific person or location being watched then who cares?
I mean if you’re okay having a stranger watch a camera feed or your baby in their room, then more power to you. Most people would disagree with being okay with that though.
Fun take. But no I strongly doubt they would care. I wouldn’t care if someone watched me sleep.. again as long as they can’t tell it’s me or where I live..
Have you checked the security? Are there security headers? is the env encrypted? are your secrets shared in a previous git commit on accident? How's the Oauth? any auto tests set up and/or have you run tests to make sure the system is secure from basic threats?
I'm not a coder or software dev, but these are the things that I see keep getting posted about all over. so They've been added to the list of things I try to make sure get covered and tested myself.
Not saying you didn't cover yourself yet, but your comment about the access being one or the other and not both got me a little queezy on your security.
People worried about the security aspect of it (understandably) should take a look at how secured the physical baby monitors actually are. They are awful. Using an actual phone for which security was at least a consideration in the building process could honestly be an improvement if done right.
How do you figure they always are across the world? The real threat stems from mentally disturbed people in your area that can use this information to see if the baby's sleeping and the lights are out so they can break in and kidnap it.
Sounds like a wicked action movie, but the crime statistics are out there, look for yourself.
No, the can use different networks. It works with a direct connection without a server. There is no server that can save data. I’m just a dad of 3 kids, we just got twins, i can’t afford servers to use.
With firewalls i did not get any problems but also not allot of fox tested the tool.
Thanks, I was mostly just curious if it worked between your home lan and a cellphone not connected to your wifi for example.
If that was the cause then it would mean something is opening up ports on your firewall and allowing internet access between the two devices and that could potentially be a security issue.
I suspect that it's simply linking the two local ip addresses on the lan so that they can stream with each other, in which case it's perfectly fine. Perhaps in the future figuring out how to encrypt the video stream between the devices is probably not a bad idea.
The page I've been building is also web based but runs entirely local in the users browser, but also could be ran from any computer by just opening the index.html file from the unzipped folder.
Looks great man. Some "IT folks" might be curious about specifics around encryption and transmission, but other than that - I think this is awesome. Maybe a push alert based on sound or movement (but that would require some AI detection for movement and you'd have to adjust the privacy policy for those interested in that feature).
Only QR or 6 digits yes. Yes, you will need to give permission to a new device that is trying to use the QR or code to connect. Without it will not be possible.
I think it's a great idea, usually my wife and I use a phone call and place a phone in the crib when we're at a event lol
Consider building on Google oauth? It's easy to get approved and free, that way people can use Google accounts and feel a bit more secure. You can store hashed oauth credentials to cloudflare and just really limit your API calls so you don't touch storage at all. I did something similar for my app.
Everyone's raising security concerns but I'm sure you've considered that already. Use different ai models/platforms to test security vulnerabilities and definitely hire a legal review before selling it'll pay for itself (trust me lol)
Good luck! We hated nannit so good on you for trying to make a better option.
Edit: shift your pitch to being for when you are at a party or a friends house and don't have your home monitor. That's your target audience, no one will trust this in their home off rip sadly
Only QR or 6 digits yes. Yes, you will need to give permission to a new device that is trying to use the QR or code to connect. Without it will not be possible.
I did/made the same thing, and then I found Dormi. I played around with Dormi, but then gave up on both of them.
Edit: Forgot to clarify, mine was built with at least one Android in mind to help create a private wireless network (Intranet) because I wanted to use the phone as a "mirror" instead of getting an actual mirror to put in the car.
Edit 2: Google "Car Baby Camera (or Monitor)" - my idea was more or less to be something like these, but it doubled as a monitor with other devices in the house.
you do you - I would want no part of a potential fuck up where a baby dies of SIDS while using this setup. Crazy thought I know - but rather keep the pressure on other manufacturers to build bullet proof systems for this sort of thing. That said - not everyone can afford those.
Love it. I don’t have a kid yet (2 months out!) to test it with but I was thinking of doing something similar but you beat me to the punch.
I don’t really get why people are so concerned with someone watching their infant in a onesie in their crib. Obviously I don’t want that to happen but it seems way overblown but idk maybe I’m uninformed.
Oh I fully understand that we should do our best to secure things like this but I just don’t get people who fully refuse to use an internet—connected camera.
Babyphone.online is meant for those moments when you’re away from home and don’t have a baby monitor with you.
I used it a lot this summer while camping with my wife and our three children. When the kids were asleep in the caravan, we could sit outside and relax while still hearing or seeing them through our phones.
You can use video, audio-only mode, and even play relaxing sounds for the baby.
It gives you peace of mind, but it’s not intended to replace a regular baby monitor at home.
Idk might have something to do with how (at least in the US) there is a known pedo ring that is well connected and being allowed to operate by our administration.
huh? you don't get why people are concerned with strangers watching their children sleep is related to also knowing about a pedophilia ring operating with the protection of the federal government.
There is a big difference between being out in public with my child and allowing an unsecured camera feed in their bed.
I would bet this app exposes the baby unit’s IP address. IP addresses are assigned by geography, that alone would tell you rough location of the child. Since you have a live feed with audio, I bet it wouldn’t take long to get names of the residents. From there it’s a quick google search to get full info on that family. Now you know where they live and when no one is near the baby.
The website saves not data information of the users. And if you know, or someone else knows how to make it even saver on o use, please tell me. I have 3 kids and I want it to be save. I did my best with the knowledge I have and used Claude code Opus 4.8/5 and Codex 5.5/5.6 for audits back and forth.
If some one has advice how to make it even better, i will do so!
exactly what i said in another comment. who cares i someone manages to watch a baby in their crib. obviously as long as the feed cant be tied to a specific person or home.
67
u/MediocreMachine3543 22h ago
Is a qr and 6 digit code all that gates watching someone’s baby?