Safeguard
Supply Chain Security•

Is an Android or Samsung Phone Findable When It Is Off?

Mostly no. Find Hub shows a stored last location, but Pixel 8, 9 and 10 can be found for hours after power off. Galaxy phones show only the last location.

Safeguard Security Team
38 min read

Mostly no. On most Android phones, Find Hub (the service Google used to call Find My Device) stops reporting once the phone is off, and what you see is the last encrypted location the phone stored while it was still on. The exception is a short list of supported phones, which Google names as the Pixel 8, Pixel 9 and Pixel 10 series: with offline finding set to use the network, the Find Hub network "can locate your phone for several hours" after it powers off or the battery dies. Samsung states plainly that if a Galaxy phone or tablet is powered off, Samsung Find shows only the last known location.

So nothing is running on a switched off Samsung, but two things can still help: a last location saved shortly before shutdown and, on supported Pixels, a few hours of Bluetooth based finding through other people's Android phones. Below: how each piece works, which settings control it, what Google and Samsung say about encryption, how to turn each part off, and how the anti theft features added since 2024 deal with a thief who switches the phone off. Every Google, Android and Samsung fact comes from those companies' own pages; the iPhone comparison comes from Apple's.

Key takeaways

  • Google's service is now called Find Hub. Google launched the crowdsourced Find My Device network on 8 April 2024, starting in the U.S. and Canada.
  • On most Android phones, Find Hub cannot locate a phone that is off. With Find your offline devices on (the default), it still shows the location stored when the phone was last online.
  • Pixel 8, Pixel 9 and Pixel 10 series phones can be located by the Find Hub network for several hours after they turn off or run out of battery. Google's 2024 launch post credited "specialized Pixel hardware". It needs offline finding set to With network in busy places only or With network everywhere, and Bluetooth and Location switched on at shutdown.
  • Find Hub has four offline finding settings: Off, Without network, With network in busy places only and With network everywhere. Google says network locations are end to end encrypted with a key you unlock with your screen lock.
  • Galaxy phones carry two finders: Google's Find Hub and Samsung Find (plus the older SmartThings Find). Samsung's switches are Allow this phone to be found, Send last location and Offline finding.
  • Samsung says that with Send last location on, the last known location is saved before the phone shuts down, and that Lost mode can stop the phone being turned off by whoever has it.
  • The real defence against a thief switching the phone off is theft protection: Theft Detection Lock, Offline Device Lock, Remote Lock at android.com/lock and Identity Check. Samsung's One UI 7 adds a one hour Security delay for the most sensitive changes.
  • An iPhone with the Find My network turned on can be located for up to 24 hours after it is turned off, according to Apple.

The short answer, device by device

Before the detail, here is the answer in one table. "Off" means fully powered down, not airplane mode, not a dead SIM, not a locked screen.

Your phoneWhat works after it is powered offWhat you see in the finderSource
Pixel 8, 9 or 10 series with offline finding on a network settingThe Find Hub network can locate it for several hoursFresh crowdsourced locations for a few hours, then the last stored locationGoogle Pixel Help
Other Android phones with Find Hub and offline finding onNothing runs; Google says the device may be unlocatable when it has no power or is turned offThe last encrypted location stored while it was onlineGoogle Android Help
Samsung Galaxy phone or tablet in Samsung FindNothing runsOnly the last known location, saved before shutdown if Send last location is onSamsung US and UK support
iPhone on a supported model with the Find My network onThe Find My network can locate it for up to 24 hours after it is turned off, or up to 5 hours in power reserve modeNetwork locations within that windowApple iPhone User Guide

The second row covers most Android phones in use. Google's troubleshooting page lists "It doesn't have power or has been turned off" as the first reason Find Hub may be unable to locate a device. The stored last location usually tells you where the phone was when it died, but it will not follow a phone that was switched off and carried away.

What the names mean

Find Hub is Google's finder, built into Android through Google Play services, with an app and a web page at android.com/find. It covers phones, tablets, Wear OS watches, Android XR devices, headphones and tracker tags. Google launched its crowdsourced network under the Find My Device name in April 2024; Google's current help pages and its security blog post on the network now use the Find Hub name, and so does Samsung's US support page. Samsung's instructions for One UI 6.1 and earlier still say Find my device.

Samsung Find is Samsung's finder app and website (samsungfind.samsung.com). Samsung's UK page says it is a different app from SmartThings Find, the older finder inside the SmartThings app, and Samsung's support pages describe both working side by side. Find My Mobile is the name Samsung still uses for the settings screen on the phone, and Samsung says Allow this phone to be found must be on there for either Samsung finder to work.

A Galaxy signed in to both a Google Account and a Samsung account therefore has two independent finders, each with its own network, settings, remote lock and erase.

How Find Hub finds a phone: online, offline and off

Google describes three situations, and the difference between them is the whole answer.

When the phone is on and connected

With power and a Wi-Fi or mobile data connection, Find Hub talks to the phone directly and shows its current location, battery level, Wi-Fi network and signal strength. Location comes from GPS (Google says up to around 20 meters), nearby Wi-Fi networks and cell towers. You can play a sound for 5 minutes at full volume even on silent, mark the device as lost or factory reset it.

To secure or erase a phone remotely, Google lists five conditions: the device has power, is connected to mobile data or Wi-Fi, is signed in to a Google Account, has Find Hub on and is visible on Google Play. The first condition rules out a phone that is off; you act when it comes back.

When the phone is on but offline

A phone in airplane mode, without a SIM or in a dead zone can still be found two ways:

  1. Its own stored location. By default your Android device stores encrypted recent locations with Google, so Find Hub can show where it was when it was last online.
  2. Other people's phones. Devices in the Find Hub network use Bluetooth to scan for nearby items. If one detects your phone, it sends the encrypted location to Find Hub, and your phone does the same for others.

The second path only helps you if you have set a screen lock. Google says the network uses your device to help others either way, but you only get help in return once you set a PIN, pattern or password, because that lock unlocks the encryption key.

When the phone is off

On most Android phones, Google's troubleshooting page treats a phone without power as one Find Hub may be unable to locate, and what remains is the last stored location.

Supported devices are the exception. The Pixel help page says supported devices include the Pixel 8, Pixel 9 and Pixel 10 series, and that the Find Hub network can locate them for several hours even if the battery runs out or the device is powered off. The general Android help page says "supported devices, like the Pixel 8 series", which leaves room for other models without naming any. Google's April 2024 launch post credited specialized Pixel hardware.

Google does not publish the exact number of hours, the mechanism used while the phone is off, or any non Pixel model that supports it. We found no Google or Samsung page confirming powered off Find Hub finding on a Samsung Galaxy, so this post does not claim it.

The four offline finding settings, side by side

Everything about offline and powered off finding on Android hangs off one screen. On a Pixel the path is Settings, Security, Find Hub, Find your offline devices. Google's general Android page gives Settings, Google, All services (if tabs exist), Find Hub, Find your offline devices. Paths vary by manufacturer and Android version, so if neither works, search Settings for "offline devices".

Google's data page describes the four choices like this:

SettingStores your phone's own encrypted recent locationYour phone helps others find their itemsThe network helps you find yours (needs a screen lock)Powered off finding on supported PixelsLocation aggregation
OffNoNoNoNoNot applicable
Without networkYes, only the most recent locationNoNoNoNot applicable
With network in busy places onlyYesYes, in busy areasYes, in busy areasYesYour report is combined with reports from other devices before the owner sees it
With network everywhereYesYes, in busy and remote areasYes, in busy and remote areasYesYour device can be the only reporter for an item

A few details from Google's pages that the table cannot carry:

  • The default. Google says your Android device stores encrypted recent locations and takes part in the Find Hub network by default. The help pages describe the busy places mode as the setting the network uses with aggregation by default.
  • Without network still has a key. With this option, only the most recent encrypted location is stored. If you have a screen lock, it is encrypted with a key you unlock with that PIN, pattern or password. If you do not have a screen lock, Google says it is encrypted with a key you unlock with your Google Account password.
  • Tracker tags need the network. With Off or Without network, you cannot use tracker tags to find items like a wallet or keys.
  • Old Android. Android 8.0 and lower cannot join the crowdsourced network. Those phones have a single Store recent location switch instead.
  • Remote areas. Google's troubleshooting page says aggregation can make Bluetooth trackers harder to find in remote areas and suggests With network everywhere if that matters to you.

For the powered off case specifically, Google's instructions are short: set the option to With network in busy places only or With network everywhere, and make sure Bluetooth and Location are on when the phone shuts down.

What Google says about encryption and privacy in Find Hub

On its data page, Google says the network encrypts your items' locations with a unique key that only you can access by entering your device's PIN, pattern or password, backed by the same technology as Google Password Manager, so locations stay private from Google and visible only to you and people you share items with.

The Google Security Blog post on the network's protections adds these design points:

  • End to end encrypted reports. A nearby device's report is encrypted with a key only the owner, and people they shared the item with, can access. Google says it "cannot decrypt, see, or otherwise use the location data."
  • Anonymous finders. Google cannot identify the owners of reporting devices, and the item's owner sees only a location and timestamp.
  • Minimal buffering. Encrypted reports are minimally buffered and frequently overwritten, and discarded if the owner's own devices can see the item.
  • Aggregation by default. The network waits until several devices have detected an item before showing its location, to make tracking a person to a private place harder.
  • At home protection and rate limits. If you saved a home address in your Google Account, your device does not contribute reports near home. Report and request rates are limited to make real time tracking harder.
  • Unknown tracker alerts. The network follows the joint industry standard for unwanted tracking, so Android and iOS users get alerts about compatible tags travelling with them.

The network still processes temporary device identifiers, timestamps and information about your Fast Pair accessories, Google says, and a shared location link adds a key that anyone signed in to a Google Account who opens the link can use.

Two consequences follow. The encryption is only as strong as your screen lock. And without any screen lock, Google says the stored recent location is encrypted with a key tied to your Google Account password, which makes account security part of your location privacy.

Samsung Find: offline finding, Send last location and Lost mode

The three Find My Mobile switches

Samsung's US support page says remote controls are on by default when you add a Samsung account, and tells you to confirm three switches under Settings, Security and privacy, Lost device protection (Samsung UK adds a Find My Mobile tap):

  • Allow this phone to be found (or Allow this tablet to be found). The master switch for Samsung Find and SmartThings Find.
  • Send last location. Samsung's Singapore page says this sends the location when remaining battery is below 5 percent. Samsung's UK page says that even if the device is turned off, with this on, its last known address is saved on the server before it powers off.
  • Offline finding. Samsung says this sends a location, with the help of other nearby Samsung devices, if your device stays disconnected from its cellular or Wi-Fi network. Samsung calls this the Galaxy Find Network, and its Canada support page says Offline finding is on by default but worth checking.

What Samsung says about a powered off Galaxy

Samsung's US article is direct: the phone or tablet must be turned on, and "If the device is powered off, only the last known location will be available." Offline finding covers a Galaxy that is on but disconnected. Samsung documents no powered off finding for Galaxy phones, and we found no Samsung page claiming it.

Samsung's footnotes say offline finding works on Galaxy smartphones and tablets with Android 8 or later, plus listed watches, Buds, S Pen models, Galaxy Ring and SmartTags, and that Samsung Find works in all countries except China, with Hong Kong and Taiwan supported.

Samsung's encryption and privacy statements

Samsung says less than Google here. Its UK Samsung Find page says that with the Galaxy Find Network your device stays anonymous and encrypted. Its footnotes add that to register a phone as a Find Node (one that helps find others' devices) you must agree to the use of your location information and to Samsung's Privacy Notice, and that Find Node devices do not indicate the exact location of the lost device. We found no current Samsung page explaining the key design or who can decrypt offline locations, so this post makes no further claim.

Lost mode, Track location and Extend battery life

  • Lost mode. Samsung's UK page says Lost mode locks your screen, shows your contact info or a message, restricts Samsung Pay and Samsung Pass, and can "prevent your phone from being turned off". It only reaches a phone that is still on and online when you trigger it.
  • Track location. From the Samsung Find website, the phone reports its location every 15 minutes until you stop it.
  • Extend battery life. Samsung can remotely switch the phone to Maximum power saving mode, which Samsung says can make the battery last for days.

Erase, and what happens next

Samsung's US page says a remote Erase data also wipes SD card data, and that Google device protection then requires the registered Google account to unlock the phone. Samsung's Singapore page adds that Find My Mobile stops working after an erase because the Samsung account is removed. Google's erase instructions say a factory reset "may not delete SD cards" and removes the device from Find Hub. The two pages differ on SD cards, so check the card yourself if you recover the phone.

Can a thief just turn it off? Theft protection on Android and Galaxy

The stored location handles a phone lost under a sofa. The harder case is a phone snatched in the street and switched off or put into airplane mode, which is what Android's theft protection targets. Google announced the suite on 15 October 2024, with the core features reaching most Android 10 and later devices through a Google Play services update and more arriving in Android 15.

Google's theft protection features

You find them under Settings, Google, All services, Personal and device safety, Theft protection. Google says they are not supported on Android Go devices, tablets or wearables, and that support varies by model. All of them need a screen lock.

FeatureWhat Google says it doesLimits Google documents
Theft Detection LockUses AI, motion sensors, Wi-Fi and Bluetooth to spot someone grabbing the phone and running, biking or driving away, then locks the screenNot active while the screen is already locked; may not trigger with a stable Wi-Fi or Bluetooth connection or after repeated locks; greyed out if unsupported
Offline Device LockLocks the screen after the phone has been used offline for a short period, for example when a thief turns off the internet to block Find HubThe phone must be unlocked when it loses connectivity; can lock twice in 24 hours
Failed Authentication LockLocks the device after repeated failed authentication attemptsOn by default where supported, with a screen lock
Remote LockLets you lock the screen from android.com/lock with a verified phone number and a CAPTCHA, plus an optional security questionNeeds a screen lock, an active SIM, a verified number, Find Hub on and an internet connection; if the phone is offline it locks when it next comes online; twice in 24 hours
Identity CheckOutside trusted places, requires biometrics (no PIN fallback) for sensitive actionsOnly on certain devices; needs biometrics and trusted places set up
Protect sensitive settingsRequires PIN, password or biometrics for actions like turning off Find Hub or extending screen timeoutOn by default with a screen lock on supported versions

Identity Check puts exactly what a thief does next behind biometrics outside trusted places: a factory reset, turning off Find Hub or theft protection, changing the screen lock or biometrics, adding or removing a Google Account, setting up a new device from this one and opening Developer options. It also covers Google Account password and recovery changes.

Google's 2024 announcement also described enhanced factory reset protection in Android 15. Android's theft protection page explains that factory reset protection requires your Google Account credentials to set the phone up again, which undercuts resale.

No page we fetched documents a general Android setting that blocks the power button for whoever holds an unlocked phone. Google's design instead locks the screen fast, guards the important settings and makes a reset phone hard to reuse.

Samsung's equivalents on One UI 7

Samsung surfaces the same Theft protection menu under Settings, Security and privacy, Lost device protection, Theft protection. Samsung's UK and India support pages list Theft detection lock, Offline device lock and Remote lock, and the India page says Remote lock works by entering your phone number at android.com/lock, which is Google's Remote Lock. On top of that, Samsung documents two One UI 7 additions:

  • Identity check (Samsung). Outside the Safe Places you designate, the phone requires biometric authentication for changes to sensitive security settings. Samsung says you must set up biometrics and be signed in to a Samsung Account.
  • Security delay. Outside your Safe Places, Samsung adds a one hour wait before changes to turning off Identity check, changing biometrics, changing other lock screen settings, turning off Find My Mobile and editing Safe Places. Samsung says this gives you time to lock the stolen phone from another device first.

Samsung's UK newsroom said on 2 June 2025 that these features launched with the Galaxy S25 series in February and were reaching earlier flagships, starting with the Galaxy S24 series, Z Fold6, Z Flip6, Z Fold5, Z Flip5, S23 and S22 series. Availability still varies by model and One UI version. On One UI 6.1 or earlier, Samsung points you to Google's theft protection and Find my device settings plus Allow this phone to be found.

Android, Samsung and iPhone compared

This table compares the documented behaviour of each finder. It describes features, not a ranking, and each row cites the vendor's own page.

QuestionGoogle Find Hub (Android)Samsung Find (Galaxy)Apple Find My (iPhone)
Is anything running when the phone is fully off?Only on supported devices, named as Pixel 8, 9 and 10 seriesNot documented; Samsung says only the last known location is availableYes on supported iPhones with the Find My network on
How long after power offSeveral hours on supported PixelsNot applicableUp to 24 hours, or up to 5 hours in power reserve mode
Last location before the battery diesEncrypted recent location stored by defaultSend last location, below 5 percent battery per SamsungSend Last Location when the battery is critically low
Crowdsourced finding while on but offlineFind Hub network, Android 9 and later at launchGalaxy Find Network, Galaxy phones and tablets on Android 8 and laterFind My network
Encryption claimEnd to end encrypted with a key unlocked by your screen lock; Google says it cannot see locationsSamsung says the device stays anonymous and encryptedEnd to end encrypted with keys generated on device; Apple says it does not know who the finder is
Privacy control on reportsAggregation by default, home exclusion, rate limitsFind Node consent; nodes do not show exact locationAnonymous finders per Apple's security guide
Settings pathSettings, Security (or Google), Find Hub, Find your offline devicesSettings, Security and privacy, Lost device protection, Find My MobileSettings, your name, Find My
Stops a thief switching it offNot directly; screen locks and Identity Check guard settings and resetLost mode can prevent power off on a phone that is still onlineNot covered in the pages we fetched
Reuse after a wipeFactory reset protection needs the Google AccountGoogle device protection if a Google account was registeredActivation Lock

Our companion post on whether an iPhone is really off is not yet live, so the Apple column here uses Apple's own iPhone User Guide, Apple Support and Apple Platform Security Guide.

Step by step: set up a phone so you can still find it

Do these before you need them; almost none can be done after the phone is gone.

1. Confirm the basics on any Android phone

On the phone:

  1. Settings, Passwords, passkeys and accounts: confirm the Google Account you expect is listed.
  2. Settings, Location: turn on Use location.
  3. Settings, Security (or Google, All services), Find Hub: confirm Allow device to be located is on.
  4. Settings, Security (or Google, All services), Find Hub, Find your offline devices: choose With network in busy places only or With network everywhere.
  5. Set a PIN, pattern or password if you do not have one. Without it, the network will not help you find your own phone.
  6. Open play.google.com/library/devices and make sure the phone is not hidden. Google says a device hidden on Google Play will not show up in Find Hub.

2. Check the build from a computer (optional)

If you manage several phones, Android's debugging bridge can record what each one runs. It needs USB debugging in Developer options. These commands only read values.

# List attached devices and confirm the right one is connected
adb devices -l

# Model, Android version and security patch level
adb shell getprop ro.product.model
adb shell getprop ro.build.version.release
adb shell getprop ro.build.version.security_patch

# Google Play services version, which delivers Find Hub and theft protection updates
adb shell dumpsys package com.google.android.gms | grep -m1 versionName

Turn USB debugging back off afterwards; it is a needless extra door on a stolen, unlocked phone.

3. Turn on theft protection

Settings, Google, All services, Personal and device safety, Theft protection (on Samsung: Settings, Security and privacy, Lost device protection, Theft protection):

  1. Turn on Theft Detection Lock.
  2. Turn on Offline Device Lock.
  3. Open Remote Lock, turn it on and verify your phone number. Add the optional security question.
  4. Open Identity Check, add biometrics and set your trusted places. On Samsung, sign in to your Samsung Account first.

4. Set up Samsung Find on a Galaxy

  1. Settings, Security and privacy, Lost device protection, Find My Mobile.
  2. Turn on Allow this phone to be found, Send last location and Offline finding.
  3. Install or open the Samsung Find app and complete onboarding.
  4. Share the device's location with family in Samsung Find now if you want their app to be able to locate it; Samsung says it must be shared beforehand.

5. Prepare your accounts

  1. Turn on 2-Step Verification and keep backup codes off the phone. Google says you need it to lock or erase your primary device remotely, and that without backup codes or a security key you may need a new SIM.
  2. Consider a physical security key, which Google says can sign you in to android.com/find if the phone is gone. Our post on offline storage for recovery codes and security keys covers where to keep them.
  3. Turn on device backup so a remote wipe does not cost you data you cannot replace.

6. Test it

Sign in at android.com/find (and samsungfind.samsung.com on a Galaxy), confirm the phone shows a location and play a sound. If Find Hub shows Sync recent location, Google's troubleshooting page explains how to resync.

If your phone is lost or stolen right now

  1. Open Find Hub from another device: the app, guest mode on a friend's phone, or android.com/find. You get a live location if the phone is online, otherwise the last stored location or, on a supported Pixel, recent network reports.
  2. Lock it from android.com/lock if you cannot sign in, using your phone number. An offline phone locks when it reconnects.
  3. Mark it as lost in Find Hub to lock it and show a message. Google says on Android 17 and later with fingerprint or face unlock, it can require both your lock and biometrics.
  4. On a Galaxy, use Samsung Find too: Lost mode, Track location and Extend battery life.
  5. Do not go to a stolen phone's location yourself. Samsung's guidance is to let the authorities retrieve it.
  6. Erase only when recovery is unlikely, because the phone then drops out of Find Hub and Find My Mobile.
  7. Change account passwords and ask your carrier to block the IMEI, which Find Hub shows in the device's settings.

Our post on what a factory reset removes and what it leaves behind explains what a remote wipe does and does not clear.

How to turn each part off

Some people reasonably do not want their phone reporting Bluetooth sightings of other people's items, or storing its own location with Google or Samsung. Each piece can be switched off on its own.

GoalWhereWhat you lose
Stop your phone helping others, keep your own last locationFind Hub, Find your offline devices, Without networkNetwork help finding your phone, tracker tag finding, powered off finding on Pixel
Stop all Find Hub offline featuresFind Hub, Find your offline devices, OffAny location for a phone that is offline or off; you can still locate, lock and erase it while online
Turn Find Hub off completelySettings, Google, All services, Personal and device safety, Find Hub, Allow device to be located offLocate, lock and erase through Google
Stop Samsung's crowdsourced findingLost device protection, Find My Mobile, Offline finding offSamsung finding while the phone is offline
Stop the final Samsung uploadLost device protection, Find My Mobile, Send last location offThe last known location when the battery dies
Turn Samsung Find offLost device protection, Allow this phone to be found offSamsung Find and SmartThings Find for this device
Delete stored historyFind Hub appGoogle says you can delete all devices and their locations at any time

Expect friction. With Android 15's sensitive settings protection, turning off Find Hub asks for your PIN, password or biometrics, and with Identity Check on, it requires biometrics outside trusted places. On Samsung, turning off Find My Mobile outside your Safe Places triggers the one hour Security delay. That friction is the point: the same steps stop a thief.

The privacy trade-offs, plainly

What you give. With a network setting on, your phone scans for nearby Bluetooth items and sends encrypted sightings to Google or Samsung, and both store a recent encrypted location of your own phone. Google says it cannot identify you when your device reports an item, but it still processes temporary identifiers and timestamps. Samsung asks for consent before your phone acts as a Find Node.

What protects you. Aggregation by default, rate limits, home exclusion and cross platform unknown tracker alerts. With network everywhere deliberately relaxes aggregation for better remote coverage, so choose it knowingly.

What it does not protect. Encryption keeps locations from the provider, not from someone who has your screen lock or, with no lock, your Google Account password. Everyone you share an item with, or who opens a shared link while signed in, can see it.

Who should consider Off. People at risk of targeted surveillance may prefer Off or Without network plus theft protection and remote lock. That gives up most of the ability to find a phone that is offline or off, so make that choice deliberately.

Where Safeguard fits

Safeguard does not locate phones, run on phones as a finder, manage mobile devices or protect phones from theft, and nothing in this post depends on it. The honest connection is narrower. If your team builds Android apps, the dependencies inside them are software supply chain components that Safeguard can scan and track. And if you use the Safeguard mobile app to approve commands that the Safeguard CLI runs on your computer, your phone becomes an approval device, which is one more reason to turn on screen lock, Theft Detection Lock and Identity Check before you need them. Android's own security bulletins regularly patch components like the Bluetooth stack that finding networks depend on; our post on the October 2026 Android security bulletin covers one recent example.

Fix it without waiting for upstream

Finding a lost phone is about settings and accounts, but the apps on that phone and the services behind them are built from open source dependencies, and an Android app you ship pulls those dependencies again on every build. The fixes for the phone's own system software still have to come from Google, Samsung or your carrier; the steps below apply to the code you build and ship.

Whatever the vulnerability, most of the risk sits in two gaps. The first is the time between a fix being published and that fix actually running in your production builds. The second, and worse, is the time before any fix exists at all, while a maintainer works out a patch and a release schedule. Waiting through both gaps is a habit, not a requirement. Safeguard gives teams three ways to close them.

1. Autonomous remediation: pull requests, not tickets

When a fixed version exists, Safeguard's Griffin models open a tested, policy gated pull request that moves the affected dependency to the safe version. You can run it on one repository or in bulk across every project that carries the vulnerable version. Remediation covers eight categories, including dependencies, licenses, security posture and findings. Reachability analysis ranks the vulnerable code paths your application actually calls first, so the first pull requests you merge are the ones that matter most. Autonomous remediation ships switched off, with every category set to Manual, so your team decides how much runs on its own and what still needs a human approval.

2. Gold Open Source: the safe version in seconds, free

gold.safeguard.sh is free and needs no login. Search any CVE or package to see affected and fixed versions, CVSS, EPSS, CISA KEV status and a recommended safe version, or use the "Am I affected?" checker. The same data is available through a free read API, README status badges and RSS threat feeds. The safeguard-sh/gold-scan-action GitHub Action can fail a build on a known exploited vulnerability, on any known vulnerability, or never, so a version you have just removed cannot quietly come back in next week's merge.

3. Gold Registry: start from components that are already fixed

registry.safeguard.sh provides hardened, drop in replacements for upstream packages and container images. Every Gold artifact is held continuously to zero exploitable critical or high CVEs, zero malware and a completed license check, with SLSA L3 or higher provenance, a Sigstore signature and a public evidence page you can hand to an auditor. An artifact loses its Gold badge if it regresses. Teams can point their own package directory at the registry so hardened equivalents resolve without changing how developers install anything.

When upstream has no fix yet, or will not ship one, Safeguard first works to get the fix accepted upstream. If the issue is severe or upstream will not move, Safeguard builds a fork, fixes the vulnerability there and publishes a hardened Gold build, so you are not stuck on a maintainer's release schedule. You can also request a hardened, compatibility tested build of a specific package. This fork and patch flow is in early access today, so ask which packages it covers before you plan around it.

Your situationWhat to use
A fixed version existsAutonomous remediation opens the upgrade pull request; Gold Open Source confirms the safe version
You need to know today whether you are affectedGold Open Source lookup and "Am I affected?" checker, free and without login
You want vulnerable versions to stop shippingThe Gold scan GitHub Action in CI, plus Safeguard policies and gates
Upstream has no fix yet, or will not ship oneA custom Gold request; fork and patch (early access)
You want to start clean on new projectsPull hardened components and images from Gold Registry

One honest limit: when the vulnerable code lives in a vendor appliance, a hosted service or an operating system runtime you do not build yourself, the fix still has to come from that vendor or distribution. The steps above apply to the open source dependencies and container images you build and ship, which is where most teams carry the largest and least tracked share of their exposure.

Common mistakes

  • Assuming "Find My Device is on" means "findable when off". On most Android phones, power off ends reporting. Only supported Pixels get hours of network finding after shutdown.
  • Skipping the screen lock. Without a PIN, pattern or password, your phone helps others through the Find Hub network but the network will not help you, and Theft protection features will not turn on.
  • Using Without network, or switching off Bluetooth or Location, and expecting powered off finding. Google requires a network option plus Bluetooth and Location on at shutdown.
  • Configuring only one finder on a Galaxy. Samsung Find and Google's Find Hub are separate. Set up both, or deliberately choose one and turn the other off.
  • Hiding the phone on Google Play. Google says a hidden device will not appear in Find Hub.
  • Keeping 2-Step Verification codes only on the phone. Then you cannot sign in to lock or erase it.
  • Erasing too early. After a factory reset, the phone leaves Find Hub and Samsung's Find My Mobile. Lock and track first; erase when recovery is unlikely.
  • Going to a stolen phone's location alone. Samsung advises contacting the authorities instead.

FAQ

Can I find my Android phone if it is turned off?

Usually you can only see its last stored location. The exception is supported phones, which Google names as the Pixel 8, 9 and 10 series: the Find Hub network can locate them for several hours after power off if offline finding uses a network option.

Does Find My Device work when a Samsung phone is off?

No. Samsung says the phone must be turned on to use Samsung Find and SmartThings Find, and that a powered off device shows only its last known location. We found no Google or Samsung page listing a Galaxy with powered off Find Hub finding.

Is Find My Device now called Find Hub?

Yes. Google launched the Find My Device network in April 2024, and Google's current help pages, its security blog and Samsung's US support page now call the service Find Hub.

How long can a Pixel be found after it turns off?

Google says several hours without giving a number. Apple, for comparison, documents up to 24 hours for supported iPhones.

Is the Find Hub network end to end encrypted?

Google says yes: locations are encrypted with a key you unlock with your screen lock, and Google says it cannot see them. It still processes temporary identifiers and timestamps.

How do I stop my Android phone from taking part in the Find Hub network?

In Find Hub, Find your offline devices, choose Without network to stop helping others but keep your own last location, or Off to stop all offline finding. To disable Find Hub entirely, switch off Allow device to be located; Android 15 and later asks for your PIN or biometrics.

Can a thief turn off a stolen Android phone to stop tracking?

On most phones, yes. Theft Detection Lock and Offline Device Lock lock the screen quickly, Identity Check puts turning off Find Hub and factory reset behind biometrics away from trusted places, and factory reset protection makes a wiped phone hard to reuse. Samsung's Lost mode can prevent power off on a phone that is still online.

What is the Samsung Security delay?

On One UI 7 and later, outside your Safe Places, Samsung adds a one hour wait before changes such as turning off Identity check or Find My Mobile, changing biometrics or editing Safe Places, giving you time to lock the phone remotely.

Should I use Samsung Find or Google Find Hub on a Galaxy?

Both work on Galaxy phones. Samsung Find adds Lost mode, Track location and Extend battery life; Find Hub adds Remote Lock at android.com/lock and works from any Android phone or browser. Setting up both gives you two independent ways back to the phone.

See how Safeguard would help

None of these demos find a phone. They show how Safeguard works on code and dependencies, and where a phone fits into that workflow. You can download Safeguard and follow the CLI docs to try them yourself.

This demo is a real Android session: you send work from the phone to a computer running the Safeguard CLI, then approve each command on the phone with Allow once, Allow for turn or Deny. It is the clearest reason this post matters to Safeguard users: once a phone can approve commands, its screen lock, Theft Detection Lock and Identity Check settings protect more than your photos.

Click through it at your own pace, or open it full screen.

This demo is a real CLI session: install, open the interactive terminal, ask it to fix the lodash CVE in a repository, and watch it read the finding and advisory, ask before each command, move lodash to 4.17.21, run npm install and npm test with approval, and print a summary without pushing anything. The same approve each step flow applies to a dependency bump in an Android app's build files that you own.

Click through it at your own pace, or open it full screen.

This demo connects Claude to the Safeguard MCP server with OAuth and lets you choose which tools Claude can use. Once connected, you can ask in plain language which of your mobile app projects carry a given vulnerable component, and get the answer from your own data.

Click through it at your own pace, or open it full screen.

Quick check

Your Galaxy S24 is stolen and the thief switches it off. What can Samsung Find show you?

Only the last known location, which Samsung says is saved before shutdown if Send last location was on. Samsung documents no powered off finding for Galaxy phones. Lock it from android.com/lock and Samsung Find so it locks as soon as it reconnects, and contact the authorities rather than going to the location yourself.

Your Pixel 9 has offline finding set to Without network. Can the Find Hub network find it after the battery dies?

No. Google's instructions for powered off finding require With network in busy places only or With network everywhere, plus Bluetooth and Location on at shutdown. Without network keeps only the most recent encrypted location the phone stored while it was online.

Sources

Last reviewed: 23 October 2026. Google and Samsung change menu names and supported models often; check the linked help pages for your device and software version.

Never miss an update

Weekly insights on software supply chain security, delivered to your inbox.

Self-healing security runs on Safeguard.

Your first fix PR is minutes away.

No sales call required, even your agent can complete the purchase over MCP.