Loading page
Sync incoming SMS from your Android to your laptop dashboard, email, Telegram, another phone, or your own webhook. Automate what happens to each message with rules you set.
How it works
An SMS hits your phone — through Android's standard broadcast, no default-app takeover required.
Your rules (sender / keyword / SIM / schedule) match it and shape the text via template placeholders.
The message lands at every destination you picked — webhook, email, Telegram, another phone, dashboard.
Why Smshawk
Smshawk runs alongside your normal Messages app — never the default SMS handler.
Match by sender, keyword, regex, SIM slot, or time-of-day. Fan out to multiple destinations.
SQLCipher on-device, hardware-backed secrets, HMAC-signed webhooks, TLS in transit.
Exponential backoff retries with dead-letter alerts so a critical OTP isn't silently lost.
Destinations
You control every destination. Nothing is sent anywhere you didn't configure.
HTTPS POST as JSON to a URL you own — HMAC-signed with your secret so your server can verify it.
Delivered through Smshawk's relay so your phone never holds email provider keys.
Pushed to your chat through Smshawk's Telegram relay — set it up once, hands-off after.
Forward as a normal SMS from your own SIM — keep a secondary number in sync with your main.
Messages appear on your laptop in real time. View stats, search logs, send outbound SMS.
What's inside
Pin down exactly which texts forward. Exact match, wildcard, or full regex — your call.
Match by SIM slot so a gateway SIM and your personal SIM can route to different destinations.
Quiet hours, business hours, or weekends-only — every rule has its own active window.
Shape the outgoing text with {from}, {body}, {time}, {sim}, {rule}. Same SMS, perfect-fit format for each destination.
Trigger a send from your laptop — the dashboard pushes a command to the phone, which dispatches the SMS from your SIM.
Forwards over time, top senders, per-SIM split, time-range filters. See what's actually flowing through.
Every sync attempt with status, full-message expand, search, day-wise filter, and pagination.
If retries run out, you hear about it — no silent failures on a critical OTP or alert.
Every webhook payload is signed with your shared secret so your server can verify authenticity.
Built for builders
Pipe matching SMS into Zapier, n8n, or your own API. Every payload carries an HMAC-SHA256 signature so your server can verify it came from your device — not someone replaying a request.
X-Smshawk-Signature: t=1718450000,
v1=8f2c…d3a1
{
"from": "+8801XXXXXXXXX",
"body": "Your OTP is 481923",
"sim": 1,
"rule": "bank-otp",
"ts": "2026-06-14T09:13:20Z"
}Smshawk transmits the full message text and sender number off the device — to the destinations you configure. Message bodies are not retained on Smshawk servers after delivery. No ad SDKs, no analytics on message content, no selling data, ever. The in-app disclosure spells it out before you ever grant SMS access.
SQLCipher database + Google Tink AEAD for device secrets, hardware-backed where available.
Each phone authenticates to the backend with its own token — no shared secrets in the app.
Opt-in cloud rule sync uses XChaCha20-Poly1305 + Argon2id; backend only sees ciphertext.
Questions
No. Smshawk only syncs SMS that arrive on the device it's installed on, configured by the device owner. It is not stalkerware. Before reading any SMS, the app shows an in-app disclosure and asks for explicit consent. Declining means no SMS permission is requested at all.
No. You keep using your normal Messages app. Smshawk reads incoming SMS via Android's standard broadcast permission. There is an optional MMS-sync mode (off by default, user-initiated) that does require the default-handler role, because Android only delivers MMS to the default app — but you have to turn that on yourself.
No. Message bodies are not retained on Smshawk's servers after delivery. They transit through the relay only for the destinations that need it (your configured email/Telegram). For your own webhook or another phone, the body goes straight to the destination you chose. We do keep a short-lived source hash for de-duplication, and delivery status / metadata for about 30 days.
Yes — at multiple layers. The on-device database is encrypted with SQLCipher, device secrets use hardware-backed key storage (Google Tink AEAD), and webhook payloads are HMAC-signed. If you enable cloud rule sync, your forwarding rules are encrypted on-device with XChaCha20-Poly1305 + Argon2id before upload — the backend only sees ciphertext. All transport is TLS.
Yes. Smshawk restarts on boot and stays resilient against aggressive OEM battery managers — with an optional, user-granted battery-optimization exemption for setups where reliability matters most.
Android 8.0 (API 26) and above. Built for and tested against current Android up to API 36.
Android · v1.0.0 · By Shakvaro
Smshawk launches soon on Google Play. Reach out and we'll let you know.