Hiding text on the lock screen is not the same as revoking other apps’ access to notifications.
Notification access on Android can let another app access the information a messaging app includes in its notifications. That app might be a trusted smartwatch companion or a tool that has been granted more access than it needs. End-to-end encryption does not control the permissions on the device that decrypts the message.
But two common generalizations are wrong: not every app automatically has access to other apps’ notifications, and not every notification listener can read all one-time codes on every version of Android.
What exactly is Notification access?
NotificationListenerService is Android’s official interface for receiving notification events. An app with the relevant access can receive information from accessible notifications, subject to operating-system restrictions. This mechanism is not inherently malware; the risk depends on the notification’s content, how much you trust the app, and how it uses the data.
Do not confuse this access with the usual Allow notifications setting:
| Setting | What does it do? | What does it mean for privacy? |
|---|---|---|
| Permission for an app to send notifications | The app displays its own notifications | This does not necessarily allow it to read other apps’ notifications |
| Notification access | The app can act as a notification listener | It may receive information from other apps’ notifications |
| Showing sensitive content on the lock screen | Determines what someone looking at the screen can see | This alone is not equivalent to revoking listeners’ access |
| Previews within the messaging app itself | Determines what content the messaging app includes in notifications | It can prevent sensitive text from entering notifications; this needs to be tested |
A music player does not necessarily need to read every app’s notifications to display its own playback notification. If an app asks for such broad access, check its specific purpose; the app’s name or category is not enough to justify it.
What information might end up outside the chat?
A notification may display the sender’s name, part of a message, or a group’s title. Even when the message text is hidden, the time a notification arrives or the app’s name can reveal information about your activity. Content passed to another app in this way is no longer solely within the original messaging app’s security boundary.
This risk should not be equated with breaking the encryption algorithm. The message first reaches an authorized device; the app may then hand a copy of the information to the operating system for a notification. For an explanation of other layers, see Livara’s security boundaries. A local notification on the phone is also not the same as the data a push service carries over the network; the two need to be assessed separately.
What did Android 15 change for one-time codes?
According to the official Android 15 documentation, the content of notifications in which the system detects an OTP is redacted for untrusted listeners. There are exceptions, including some companion-device apps.
Do not take this protection to mean that all notifications are confidential, that code detection is 100% accurate, or that every installed app is safe. The operating-system version, content detection, and the app’s trust level matter. Updating is useful, but it does not replace reviewing access permissions.
A practical access review, without installing extra tools
1. Find the list of listeners
Search your phone’s settings for Notification access or the corresponding term in your phone’s language. On many phones, this section is under Apps and Special app access; manufacturers use different names and paths.
For each enabled app, ask: Did I install it myself? Exactly which feature needs this access? Do I still use it? Revoke unnecessary access. If a watch or assistive tool depends on it, consider the impact of revoking it and check the app and its publisher.
2. Limit previews in the messaging app itself
If the app offers an option to show “New message” instead of the text and name, configure it according to your needs. Do not assume that disabling display on the lock screen is enough: the full notification text may still be available in other situations.
3. Check the lock screen and companion devices separately
Google’s guide to notification settings explains options for hiding sensitive content or not displaying notifications on the lock screen. Include your watch, car display, connected computer, and notification history in your test plan too.
4. Test with a harmless message
Ask someone you trust to send a nonsensitive text. Lock the phone and see what appears on the phone and connected devices. Then compare the result with the phone unlocked. This test checks observable behavior; the absence of text on the screen does not prove that the phone is free of malware.
What if I previously granted access to a suspicious app?
Revoking access limits future access through that same route, but it does not retrieve data that has already been copied. Investigate unfamiliar apps and remove them if they are unnecessary, keep the operating system up to date, and review sessions on important accounts. If you suspect account theft, check that account’s security settings from a trusted device.
Battery drain or a strange notification alone is not a definitive diagnosis of malware. For a serious or targeted threat, specialist help is more appropriate than installing several unknown “cleaner” apps.
Frequently asked questions
Is disabling lock-screen previews enough?
It helps hide text from people near the phone, but it does not necessarily remove the content available to a notification listener. Review other apps’ access and the messaging app’s own preview settings separately.
Does E2EE protect group messages from notification listeners?
E2EE protects the message’s journey. If the recipient’s device includes group information in a notification, that copy is subject to the phone’s settings and permissions.
Is every watch companion app unsafe?
No. The access can serve a genuine purpose. The goal is to minimize access and make informed choices, not to label all companion apps as unsafe.
