Android Screen Mirroring Security

In short

Internet	Never used. The app makes no connections to the internet. It only talks to your phone, over the cable or your own Wi-Fi.
Account	None. No sign-up, no login, no email address.
Tracking	None in the app. No analytics, no crash reports, no usage counting. The app never contacts this website or anyone else.
This website	Counts page visits with Vercel Web Analytics: the page, the site you came from, the country and city, and the kind of device and browser. No third-party cookies and nothing that identifies you. The anonymous value that tells one visitor from another is thrown away after a day.
Your screen	Goes from the phone to your Mac and is shown in a window. It is not recorded, saved or sent anywhere.
Saved on your Mac	Your menu choices and your phone's address on your home network, so it can reconnect. Files you accept go to your Downloads folder. Nothing else.
Left on your phone	Nothing. While you mirror, a small helper sits in the phone's temporary folder; it is removed when mirroring ends. No app is installed.
Your files	Copied only when you drag them, or when you click Accept on a Quick Share from your phone. Phone Mirror never replaces or deletes a file on either side.
Listening on your network	Only while you have ticked “Receive with Quick Share”, and only for devices on the same Wi-Fi. It is off until you switch it on.

Why macOS warns you the first time

When you open an app from the internet, macOS checks whether Apple has examined it. Apple offers that check to developers who pay for its yearly developer programme. I make Phone Mirror on my own, and it has not been through that programme.

So macOS says it “could not verify” the app. That sentence means Apple has not looked at it. It does not mean something was found. macOS then leaves the decision to you, in System Settings → Privacy & Security. The download page shows the steps.

You shouldn't have to take my word for any of this, so the next part is what you can check yourself.

Check your download

Every file has a fingerprint, a long code that changes completely if even one byte of the file changes. If the fingerprint of your download matches the one below, you have exactly the file that was published here.

Open Terminal (press ⌘ and Space, type Terminal, press Return).
Paste this line and press Return:
shasum -a 256 ~/Downloads/Phone-Mirror.dmg
Compare the code it prints with this one. They must be the same from the first character to the last.

7b55d1ba9c3333b2015e1f52a3213745fe12678802a5b118fd1d23a8f6f95706

This is the fingerprint of version 1.3.

What is inside the app

Phone Mirror is a small Mac app that starts two well-known programs for you and gives them a friendly menu:

scrcpy, by Genymobile. It shows and controls the phone's screen. It is open source: anyone can read its code.
adb, Android's own tool for connecting a phone to a computer, from the Android Open Source Project. The copy inside the app is the one built and signed by Google.

Each time it starts, Phone Mirror asks macOS to check that nothing inside the app has been swapped or edited since it was built. If that check fails, it refuses to run those two programs.

About USB debugging

USB debugging is the Android setting that makes all of this possible. It is powerful, so it is worth knowing what it does.

It lets a computer that you have approved see the screen, send clicks and keys, and copy files. A computer you have not approved gets nothing.
The phone asks you before it trusts a computer. Only tap Allow for your own Mac. Never for a computer you don't know, and never at a public charging point.
To take the trust back: Developer options → Revoke USB debugging authorisations.
When you stop using Phone Mirror for good, switch USB debugging off again.

About wireless mode

While wireless mode is on, the phone listens for your Mac on the network it is connected to. Use it on your home Wi-Fi or your own hotspot, not on public Wi-Fi.
Phone Mirror only connects to addresses on a private home or office network. It refuses anything else.
The menu shows a warning for as long as wireless mode is on. Disconnect Wireless switches it off, and by default the app also switches it off when you quit.
Restarting the phone switches wireless mode off by itself.

About receiving with Quick Share

It is off until you tick it in the menu. While it is off, Phone Mirror does not listen on the network at all.
While it is on, your Mac's name is visible to devices on the same Wi-Fi, and they can ask to send you something. This is like AirDrop set to Everyone. Untick it on Wi-Fi you don't trust.
Only devices on the same local network can connect. Connections from the internet are refused.
Nothing is saved until you click Accept, for every single share. The card shows who is sending, what, and a four-digit code. If your phone shows a code too, the two should match.
The transfer is encrypted between the phone and the Mac.
Files go to your Downloads folder. A file that is already there is never replaced, and a transfer that breaks off leaves no half file behind.
Received files are marked as downloads, so macOS checks an app or a script before it runs for the first time, the same way it does for a download from a browser.

What macOS may ask you

Phone Mirror does not need screen recording, accessibility, camera or microphone access, and never asks for them. You may see these questions, each only when you use that feature:

Find devices on your local network: when you go wireless or switch on Quick Share. That is how the Mac and the phone reach each other.
Accept incoming network connections: only if your Mac's firewall is on and you switch on Quick Share.
Access your Desktop, Documents or Downloads folder: when you copy a file to or from one of them.
Open at login: if you turn on “Launch at login” in the menu.

Privacy and security