Open your router's client list or run a network scan, then match every connected device against the hardware you actually own. Anything left over that isn't one of your own randomized-MAC phones is a candidate for an unauthorized user. If one turns out to be real, change your Wi-Fi password to disconnect everyone at once.
Start by listing every device on the network
Two ways in. Log into your router (usually 192.168.0.1 or 192.168.1.1) and open the DHCP client list or "connected devices" page. That shows everything holding a current lease. The router view has a blind spot, though: it can miss devices sitting on a second access point or a mesh node, and it rarely tells you what each device is beyond a MAC address and maybe a hostname.
The second way is an active scan from a computer on the same network. nmap -sn 192.168.1.0/24 sweeps the subnet and lists the live hosts. A tool like DeviceShelf runs the same sweep and then identifies each device: vendor from the MAC's OUI prefix, hostname over DNS/mDNS/NetBIOS, an OS guess, and any open ports. That identification is what turns a wall of IP addresses into a list you can reason about.
Match every device against hardware you own
Now the tedious but decisive part. Walk through the place and count: phones, laptops, tablets, the TV, a streaming stick, the console, printer, robot vacuum, smart plugs, thermostat, doorbell, speakers, the router itself, and any range extenders. Write them down, then cross each one off the scan.
The MAC vendor is your best clue here. A prefix that resolves to Amazon is probably an Echo or Fire TV. Espressif or Tuya usually means a cheap smart-home gadget. Apple, Samsung, and Google cover most phones and laptops. Line up hostnames where you can. Once you have accounted for everything you own, whatever is left over is the entry to investigate.
Rule out your own phone before you panic
One modern wrinkle can fake an intruder. Phones use a randomized MAC address per Wi-Fi network by default, and iPhones can rotate theirs over time. So a device that looks unfamiliar might just be your own tablet showing a hardware address you have never seen before.
Test it directly: turn Wi-Fi off on a phone you suspect and watch whether the mystery entry disappears. Look at the vendor too. A randomized MAC often reads as "locally administered" or an unknown vendor rather than a clean Apple or Samsung block. And if an entry only shows up when one particular family member is home, it is theirs.
What to do if someone really is on your Wi-Fi
If a device survives all of that and you are confident it isn't yours, the fastest fix is to lock everyone out and let your own gear back in.
- Change the Wi-Fi password. This kicks every device off instantly, the intruder included, and they can't rejoin without the new key. Reconnect your own hardware afterward.
- Switch to WPA3, or at least WPA2-AES. Never run WEP or an open network. WPA3 makes offline password guessing far harder.
- Disable WPS. Its 8-digit PIN is brute-forceable and a well-known way in.
- Move IoT gadgets to a guest network. A cheap camera with weak firmware has no business sharing a subnet with your laptop.
Changing the password is the step that actually disconnects someone. The rest stops them from coming back.
Why a one-time check isn't enough
A manual sweep only catches whoever is connected the moment you look. It says nothing about last night or next week. Someone who joins at 2am and is gone by morning never appears in a check you run at noon.
Continuous monitoring closes that gap. The network gets watched around the clock, you approve the devices you own once, and an alert fires only when a genuinely new one shows up. DeviceShelf does this on the desktop while your computer is awake, or 24/7 on a Raspberry Pi or NAS with the server edition. That always-on watch is one of the main things separating it from a pull-to-refresh phone app. The comparison with other scanners and the Fing alternative writeup lay out where those lines fall.
You can try the monitoring on your own network with the free 7-day trial, no account needed.