Skip to content
James Tannahill
Insights (opens in new tab) The Agency (opens in new tab) RDLB (opens in new tab) Thoughts Contact

SigScan

The air is full of signals. Now you can see them.

RF environment scannerAugmented realityiPhone

SigScan is a signal radar for the iPhone. Point the phone around a room and every Bluetooth device nearby appears as a floating bubble in augmented reality: named, attributed to a manufacturer, ranged by path loss, and flagged when it looks like something that should not be there.

A room reads as empty because the things filling it broadcast on frequencies people cannot hear. The average living room holds a dozen radios announcing themselves continuously, and the one that matters, a tracker in a coat lining or a bag, is indistinguishable from the eleven that are simply headphones and a television. The existing answer is a list of hex strings, which tells you a signal exists without telling you what or where it is.

Putting the signal in space is the whole argument. A bubble anchored where the device actually sits, hidden by the wall it is actually behind, turns a scan into something a person can act on: walk toward it, look at it, decide. The same instinct runs through the rest of the app, where NFC tags, the network you are joined to, and every HomeKit accessory with its firmware version are all read and shown plainly rather than summarised.

Naming the thing turned out to be harder than finding it. Most scanners carry a shortlist of manufacturers and label the rest Unknown, and the ones that do better tend to report the radio rather than the product, so a doorbell built on an Espressif module reads as an Espressif device. SigScan ships the complete industry registries instead, treats the brand and the chip as the separate facts they are, and where a manufacturer publishes its advertising format it reads the product code out of the packet and names the model. Sensors that broadcast a temperature or a battery level are read as the packets pass, without connecting to anything. What kind of device it is comes from the packet too, and a brand that makes phones, televisions and earbuds under one identifier is never guessed at, so a television is not reported as a phone.

What the app does not do is the other half. There are no accounts, no advertising, no analytics, and no upload: scans and locations are held on the phone in SwiftData and go nowhere. The one exception is the assistant, which sends a typed question and a short summary of device names to be answered, carrying no location and no identifier. An instrument for seeing who is listening should not itself be listening. What leaves the phone does so only when you send it: any device can be shared to Messages or AirDrop as plain text, and a home screen widget shows what the last scan found without opening the app.

How it is built

Position is inferred rather than reported, because a Bluetooth advertisement carries signal strength and nothing else. Each RSSI sample is recorded with the camera position and forward vector that observed it, and those vectors are weighted exponentially by strength and averaged, so a device resolves in direction from rotation alone with no need to walk around. Gradient-descent trilateration runs alongside it and is blended in proportion to how far you have actually moved, which is the only condition under which trilateration is worth anything.

LiDAR does the rest. A mesh raycast clamps each bubble to the real surface in front of it, occlusion hides bubbles behind real walls, and a bubble whose LiDAR surface sits closer than its RSSI estimate is tinted to say so, which is what a device behind a wall looks like.

Identity is a data problem and is solved as one. Nothing in the app names a company: a build step pulls the assigned-numbers registries, cross-checks them against an independent mirror, resolves ownership and restricted-vendor listings, and packs 22,888 entities and 44,975 identifiers into a single file the phone memory-maps and binary-searches. An advertisement is decomposed into signals, each signal is looked up in that one index, and the claims that come back are folded into an answer that keeps both its evidence and its runners-up. Decoders read bytes and emit further signals; they never decide who made anything, which is why adding a vendor is a row in a table rather than a branch in a function.

Radios
CoreBluetooth, CoreNFC, HomeKit, CoreTelephony
Spatial
ARKit and RealityKit, LiDAR mesh and depth
Ranging
RSSI beam-forming blended with trilateration
Identity
22,888 manufacturers, 44,975 identifiers, generated
Decoders
SwitchBot, Xiaomi MiBeacon, BTHome, Apple
Storage
SwiftData on device, GPS-stamped, CSV export
Assistant
Claude via a Cloudflare Worker proxy
Surfaces
Home screen widget, share sheet, custom tab bar
SigScan app icon
On iPhone

See the Bluetooth, NFC, WiFi, and HomeKit traffic around you, mapped in augmented reality and kept on your phone.

Download on the App Store
jtannahill.github.io/sigscan-site