Try to remember the last time your phone was all the way off. Not asleep on the nightstand, not sitting dark on a charger with the screen blacked out. Off, as in you had to sit through the logo when it came back.
For most of us the honest answer is “whenever the battery died” or “whenever an update forced it.” The National Security Agency wants you to do it on purpose, once a week. Its short mobile device best practices sheet tells people to power the device off and back on weekly.
It takes about two minutes and costs nothing. It also does less than the headlines suggest, which is an argument for doing it correctly rather than an excuse to skip it.
What A Weekly Power-Down Actually Does
Some phone malware never writes itself to storage. It lives in the phone’s memory while the device is running, and when the phone goes fully dark, that memory clears and the intruder’s foothold goes with it. That is the entire trick.
The attacks this is aimed at are called zero-click exploits. They abuse flaws in parts of the phone that run on their own, like the photo viewer, messaging services and media preview tools, so there is nothing for you to tap and nothing obvious to notice. A lot of modern attacks also string several flaws together in sequence. Powering off sends the attacker back to step one.
Mobile malware is not a shrinking problem. Security firm Zimperium reported a 51% rise in unique mobile malware samples between 2021 and 2022. The NSA’s own framing is blunt: threats to mobile devices are “more prevalent and increasing in scope and complexity,” and many of the features people love “provide convenience and capability but sacrifice security.”
Restarting Counts, Sleeping Does Not
On a modern iPhone or Android phone, a restart is a full shutdown followed by a fresh boot, so it clears what was sitting in memory just as powering off does. What does not count is the screen going dark. A phone asleep on the charger is still running, and so is whatever is living in its memory.
On the last few generations of Apple phones, the full power cycle takes two buttons: hold the side button and either volume button until the power-off slider appears, drag it, wait 30 seconds, then hold the side button until the Apple logo comes back. Android depends on the manufacturer. On many phones it is the power button held down, but newer Pixel and Samsung models open the assistant that way, so pull down the quick settings panel and tap the power icon instead. Neither one deletes your photos, apps or settings.
Pick One Night And Stop Thinking About It
Sunday night, when the phone goes on the charger, is the easiest slot. Attach it to something you already do and you will not have to remember it. A repeating weekly reminder in your calendar works too, and it is the only setup step this habit needs.
You get something out of it even on a week when nobody is trying to hack you. A regular restart is also the standard first fix for a phone that is slowing down or freezing. A power cycle clears out background apps, sorts out memory problems, helps with a phone that is running hot and can clean up a bad call signal. Older phones feel the difference the most.
What The Reboot Will Not Fix
Powering off does nothing about spyware that is already installed, a malicious app you granted full permissions to, a sketchy configuration profile buried in your settings, or malware written to relaunch every time the phone boots. Data that was already copied off your device stays copied.
Stolen passwords are the clearest example. If your bank login was grabbed last Tuesday, shutting the phone down on Sunday does not claw it back. The only fix there is changing the password to something you do not use anywhere else. Weekly power-offs are useful against opportunistic, short-lived stuff, and that is the honest size of the win.
The Lock Screen Settings With Real Numbers Attached
Most security advice is vague. This part is not. The NSA guidance calls for a six-digit PIN at minimum, and says six digits is enough as long as the phone is set to wipe itself after 10 incorrect attempts. It also says the screen should lock automatically after 5 minutes of sitting idle.
Both of those are buried in your settings and both are probably set wrong on your phone. Go check the auto-lock timer first; a lot of people stretch it out to save themselves a thumbprint and never change it back. Swipe patterns are a weaker choice than a PIN, because a simple shape is easy for someone standing behind you to read and repeat.
Clean Out App Permissions Once A Month
The apps already on your phone are the part people never audit. A flashlight app with microphone access, a shopping app tracking location all day, a game that asked for your camera once and kept it. You tapped Allow in a hurry and it stuck.
Both iPhone and Android keep a privacy menu in Settings that lists every app holding your microphone, camera and location. Walk the list once a month and revoke anything that does not need it to work. While you are in there, delete apps you have not opened in six months. Every extra app is another door. Reinstalling takes thirty seconds if you miss one.
Updates Do More Work Than Reboots Do
If you only change one habit, make it this one. New flaws in phone software turn up constantly, and installing updates to your operating system and your apps as soon as they land is what closes them. A reboot without an update is a hallway sweep with the front door still unlocked.
Turn on automatic updates for apps so you are not approving them one at a time. For the operating system itself, stop pressing “Remind Me Tomorrow” for three weeks straight. The update usually restarts the phone anyway, which means a well-timed Sunday update can double as your weekly power cycle.
The Wi-Fi And Bluetooth Habits Worth Copying
Public Wi-Fi is the one the government is loudest about. The advice is not to connect to public networks at all, to switch Wi-Fi off when you are not using it, and to delete saved networks you will never use again. Your phone is probably holding onto the password for a hotel you stayed at in 2019.
Same thinking applies to Bluetooth and location services: leave them off when you are not actively using them. And treat urgent text messages from your “bank” or a “delivery service” as junk. Do not open attachments or tap links you were not expecting, no matter how official the sender looks.
Two More Toggles That Take Ten Minutes
Turn on two-factor authentication everywhere it is offered, starting with email and your bank. It means a stolen password alone is not enough to get in, because the second code still has to come from your phone.
Then deal with the password you have been reusing since college. A password manager generates and stores long random ones so you only have to remember a single master password, and most have a free tier that covers a phone and a laptop. Changing a reused password is the one move that instantly makes an old stolen one worthless.
If You Genuinely Think Someone Is After You
Commercial spyware is a real thing and it is nastier than anything a weekly reboot handles. Pegasus, built by the Israeli company NSO Group, can install through zero-click exploits, then reads messages, records calls, tracks location and switches on the camera or microphone without any alert on the screen. It has been used against journalists, activists and political figures.
Regular antivirus apps will not catch it. Confirming that kind of infection takes a forensic check of a device backup, ideally encrypted, using Amnesty International’s Mobile Verification Toolkit, which is not a Saturday afternoon project for most people. If you have a reason to believe you are a target, Apple’s Lockdown Mode is the built-in setting designed for exactly that situation. Everyone else can file this under good to know.
The Honest Verdict On Sunday Night Reboots
Do it. A full weekly power-off costs you nothing, needs no app, no subscription and no trip to the store, and it clears out the category of problem that only exists in memory. A phone that has been running for four months straight is also just a worse phone, slower and hotter and quicker to drop calls.
What it is not is a cure. The weekly reboot line gets recycled every few months while the rest of the list, the part that does the heavy lifting, gets ignored. Updates installed the day they arrive, a six-digit PIN with auto-lock at 5 minutes, permissions trimmed, junk apps deleted, public Wi-Fi left alone. Power the thing off on Sunday night, then spend ten minutes on the boring settings. That combination is worth more than the reboot by itself will ever be.
