Once a week. That is the number in the National Security Agency’s Mobile Device Best Practices sheet, a one-page guide dated October 2020 and written for people whose phones carry government work. Under a heading that just says “Power,” the advice is a single line: “Power the device off and on weekly.”

Most of the page asks for more effort than that. It tells readers not to connect to public Wi-Fi, to switch Bluetooth off when they aren’t using it, to update software “as soon as possible,” and to be wary of email attachments even from people they know, because “even legitimate senders can pass on malicious content.” The weekly power cycle takes about a minute and changes nothing about how the phone gets used the rest of the time.

What switching off actually clears

The sheet includes a chart that matches each habit against ten threats, from malicious apps and untrusted cellular networks to supply chain attacks. Turning the device off and on weekly is listed against two of them: spearphishing messages designed to install malware, and zero-click exploits.

Zero-click exploits are the reason the advice exists. They need nothing from the owner, no link to tap and no file to open. A specially built message arrives, a flaw in the software that processes it is triggered, and spyware is on the phone before anyone has looked at the screen.

Switching off works because of a change in how phones are built. As the Associated Press reported in 2021, Apple and Google have hardened the core of their operating systems to the point where planting malware that survives a reboot has become difficult.

That doesn’t make the phone immune. An attacker who got in once with a zero-click exploit can send the same thing again. The AP’s framing was that a reboot raises the cost of an attack rather than ending it, because the attacker has to keep breaking back in.

Powering down also does nothing about an app the owner installed. A malicious app is stored on the phone like any other, and it simply loads again when the phone comes back on. That is why the weekly habit sits alongside the sheet’s advice on updates rather than replacing it. Clearing an implant from memory is one job. Installing the update fixes the flaw it came in through.

Your phone may already reboot itself, but not for this

Apple and Google have both since built automatic restarts into their phones. In late 2024, iPhones running iOS 18.1 began rebooting on their own, and security researcher Jiska Classen reverse-engineered the feature, confirming a 72-hour timer that fires when a phone hasn’t been unlocked for three days. In April 2025, Google added an equivalent to Android through a Google Play services update, restarting phones that have stayed locked for three consecutive days.

Those features solve a different problem. After a restart, a phone sits in a state called Before First Unlock, in which its files stay encrypted until the passcode goes in. Once it has been unlocked even once, it moves to After First Unlock, which The Register describes as “the preferred state for attackers and law enforcement agencies because the barriers to access are lower.” The automatic reboots exist to protect a phone that has been lost, stolen or seized and left sitting untouched.

A phone that gets unlocked every day never reaches the three-day timer. For anyone using their phone normally, the automatic feature never runs, and the weekly power cycle the NSA describes is still a manual job.

How to follow the advice

The NSA’s wording is off and on. On most current phones, holding the side or power button together with a volume button brings up the power menu. Choosing Power Off, waiting a few seconds and switching back on follows the instruction to the letter. Which day matters less than doing it every week.

The sheet doesn’t claim any single habit makes a phone safe. Its chart separates habits that “almost always” prevent a threat from those that “sometimes” do, and leaves a blank where a habit doesn’t help at all. A weekly power cycle is the cheapest line on that chart. Prompt updates, care with links and staying off public Wi-Fi cover the threats it can’t reach.