Download the PHP package codingwithrk/no-screenshot without Composer

NoScreenshot plugin for NativePHP Mobile

A NativePHP Mobile plugin that prevents screenshots, blocks screen recording, and protects the App Switcher thumbnail — on both Android and iOS.

Mainly useful for apps that handle sensitive data such as financial, healthcare, or enterprise applications where protecting user privacy and data security is paramount.

Platform Support

How It Works

Android uses WindowManager.LayoutParams.FLAG_SECURE — an OS-level window flag that prevents the system from capturing the screen by any means: the screenshot button, the built-in screen recorder, ADB, and third-party capture apps all receive a blank frame. The flag also prevents the App Switcher / Recents thumbnail from showing real content.

A ContentProvider (NoScreenshotInitProvider) registers Application.ActivityLifecycleCallbacks before any Activity is created. On every Activity.onCreate() it reads the persisted protection state from SharedPreferences and re-applies FLAG_SECURE — so the flag is active from the very first frame, even before the WebView or any PHP controller has run.

iOS uses two complementary techniques:

1. UITextField isSecureTextEntry screenshot prevention — when protection is active, all main-window content is moved inside the first subview of a UITextField with isSecureTextEntry = true. iOS routes that subtree through its system DRM compositing path, which is excluded from the screenshot pipeline. The protected area appears blank/white in any screenshot taken while protection is active.

2. Overlay windows — a full-screen black UIWindow (above the status bar) is shown:
   • When UIScreen.main.isCaptured is true (screen recording / AirPlay mirroring active)
   • When UIApplication.willResignActiveNotification fires (user pressed Home — prevents the OS from capturing a real frame for the App Switcher thumbnail)

Protection state is persisted in UserDefaults. The plugin exports a NativePHPNoScreenshotInit function (registered as init_function in the manifest) that restores the saved state at app startup, re-arming all observers before the first bridge call.

Requirements

FLAG_SECURE is available from Android API 1. API 21 is set to match NativePHP Mobile's own minimum. The iOS 13 minimum is required because the recording overlay uses UIWindowScene, introduced in iOS 13.

Installation

The service provider and NoScreenshot facade are auto-discovered by Laravel — no manual registration needed.

Quick Start

Call disableGlobally() once — from a service provider, middleware, or any controller. The choice is saved to SharedPreferences (Android) / UserDefaults (iOS) and automatically restored the next time the app launches.

PHP API

All methods are available via the NoScreenshot facade or by resolving Codingwithrk\NoScreenshot\NoScreenshot from the container.

disableGlobally(): bool

Activates protection for the entire app and persists the state so it survives app restarts.

• Android — adds FLAG_SECURE to the activity window; all capture attempts receive a blank frame. On the next launch, FLAG_SECURE is applied at Activity.onCreate() before the WebView loads.
• iOS — moves window content into the UITextField secure container (screenshot content appears blank), starts the UIScreen.capturedDidChangeNotification observer, and registers willResignActiveNotification to protect the App Switcher thumbnail.

Returns true on success, false if running outside NativePHP.

enableGlobally(): bool

Removes global protection and clears the persisted state.

toggle(): bool

Toggles global protection on/off. Returns the new isGloballyProtected state.

getStatus(): ?ScreenProtectionStatus

Returns the current protection state as a typed DTO, or null outside NativePHP.

startScreenshotDetection(): bool

Registers a native observer that fires ScreenshotAttempted whenever the user takes a screenshot.

• Android — uses Activity.registerScreenCaptureCallback() (API 34+). On older devices the call succeeds but supported is false and no events fire.
• iOS — uses UIApplication.userDidTakeScreenshotNotification (all iOS versions).

stopScreenshotDetection(): bool

Unregisters the screenshot observer.

Events

Three events cover the full lifecycle of capture activity. Listen to them in Livewire components with the native: prefix.

Android note: FLAG_SECURE prevents capture at the OS level rather than detecting it. ScreenshotAttempted requires API 34+ and startScreenshotDetection() to be called first. ScreenRecordingStarted / ScreenRecordingStopped are iOS-only.

Listening in a Livewire component

Manual dispatch (polling pattern)

ScreenProtectionStatus Reference

Platform Notes

Android

• Startup protection — NoScreenshotInitProvider (a ContentProvider) runs before MainActivity.onCreate(). It reads SharedPreferences and registers ActivityLifecycleCallbacks. On every Activity.onCreate() and onResume(), FLAG_SECURE is re-applied if protection is active. This means the App Switcher thumbnail is always black on cold launches — not just after the first bridge call.
• Scope — FLAG_SECURE covers the entire activity window. All capture methods (screenshot button, built-in recorder, ADB, third-party apps, Recents thumbnail) receive a blank frame.
• Screenshot detection — registerScreenCaptureCallback() requires API 34 (Android 14+). On earlier devices startScreenshotDetection() returns supported: false and ScreenshotAttempted never fires.

iOS

• Screenshot content prevention — when protection is active, the main window's subviews are moved inside a UITextField with isSecureTextEntry = true. iOS's secure compositing path excludes this subtree from screenshot capture — the screenshot shows blank/white instead of real content. If Apple changes the internal UITextField structure in a future OS release, the plugin falls back gracefully to overlay-only protection.
• App Switcher protection — willResignActiveNotification fires before the OS captures the Recents thumbnail. The plugin shows the black overlay at that moment and hides it again on didBecomeActiveNotification.
• Screen recording overlay — UIScreen.main.isCaptured is true during screen recording and AirPlay mirroring. The black UIWindow overlay (level statusBar + 1) appears immediately when either starts and disappears when both stop.
• Startup restoration — NativePHPNoScreenshotInit (the init_function) reads UserDefaults at app launch and calls apply() if protection was previously enabled. The didBecomeActiveNotification observer retries applyScreenshotPrevention() if the window was not yet ready at init time.
• iOS 13 minimum — required for UIWindowScene used by the overlay window.

Testing

Unit tests

Device scenarios

Changelog

1.1.0

• Android fix — FLAG_SECURE is now applied at Activity.onCreate() via NoScreenshotInitProvider (a ContentProvider), fixing the App Switcher thumbnail leak that occurred before the first bridge call (#1)
• Android — protection state persisted to SharedPreferences; restored automatically on cold launch
• iOS — added UITextField isSecureTextEntry screenshot prevention; screenshot content now appears blank instead of showing real app content
• iOS — added willResignActiveNotification observer to protect the App Switcher thumbnail
• iOS — added NativePHPNoScreenshotInit (init_function) to restore persisted protection state at app startup
• iOS — protection state persisted to UserDefaults

1.0.0

• Initial release

Support

For questions or issues, email [email protected]

License

The MIT License (MIT). Please see License File for more information.