Apple Continuity Protocol

Continuity messages

Each Continuity advertisement packet contains one or more Continuity messages. To test the decoding, use the Beacons sample application from the Bluetooth Framework package. The framework can decode the following messages.

Why decode Continuity messages

Apple devices broadcast Continuity messages continuously and without authentication. Any BLE scanner within radio range receives them. This has two consequences: it makes the messages trivially observable, and it makes them a rich source of information about the physical environment that no other signal provides so easily on Windows.

Once the raw packets are decoded into structured messages, an application can reason about what Apple hardware is nearby, what it is doing, and how it is configured. That is useful well beyond Apple's own ecosystem.

Device presence and proximity

Every Apple device periodically emits Continuity advertisements. Decoding them turns any Windows machine into a passive detector of nearby Apple hardware. Combined with RSSI, an application can estimate proximity without asking the user to install anything or to grant permissions. This is the foundation for room-level presence detection, occupancy analytics for meeting rooms, retail footfall counters, or triggering automations when a specific person approaches a workstation.

Because the advertisements carry identifying information, the same signal can be used to distinguish between device classes. An AirPods case, an iPhone, an Apple Watch, and a MacBook all broadcast with different message types, which means an application can count devices per category without identifying individual users.

Device state and activity

Continuity messages leak device state. Nearby Info in particular reports whether the phone is locked, whether the screen is on, whether the user is actively interacting with it, and even whether the user is currently driving. Handoff indicates whether a user is currently working on a specific application on a specific device. Hey Siri indicates that a voice command has just been issued.

For UX designers and product teams, this information is normally invisible. It enables context-aware behavior: pausing a desktop notification when the user's phone is already unlocked, delaying a phone call when the user is driving, or showing a different interface when the user has just transitioned a task between devices. Because decoding happens passively on the Windows side, no code runs on the Apple device, and no permission needs to be requested from the user.

AirDrop and privacy analysis

AirDrop advertisements contain a truncated hash derived from the user's Apple ID and email addresses. The hash rotates periodically, and it cannot be reversed, but its presence and rotation patterns are themselves informative. Security researchers use AirDrop advertisements to study how Apple devices expose identifying information in public spaces, how reliably the hash rotation works across iOS versions, and what can be inferred about a device owner from the broadcast alone.

For enterprise deployments, the same techniques support compliance and audit tasks. A managed Windows machine can detect which Apple devices are broadcasting in a controlled area and produce evidence for internal security reviews without requiring cooperation from the device owners.

Audio device discovery

Proximity Pairing messages contain unencrypted details about nearby AirPods and Beats headphones: model identifier, color, current battery level of each earbud and the case, and charging state. Most Windows utilities ignore these messages entirely because the standard Bluetooth stack treats AirPods as generic A2DP devices.

Decoding the Proximity Pairing message closes that gap. A Windows application can display the battery level of AirPods with the same accuracy as macOS does, warn the user before the battery dies mid-call, or automatically switch audio endpoints when a specific pair of headphones is detected nearby. The same applies to other audio devices that use the Proximity Pairing protocol.

Security research and forensics

Continuity is a large, undocumented attack surface. It is used by every modern Apple device, it runs continuously, and its contents vary between iOS and macOS versions. Security researchers use decoded Continuity traffic to study how Apple devices behave on the radio level: when they transmit, what they transmit, how the addresses rotate, and how much of the payload is predictable.

On the defensive side, decoding allows building detection systems that recognize specific Apple device classes in a physical space. Airports, hospitals, and government buildings can passively inventory which Apple devices are operating in restricted areas, correlate that with access control logs, and produce forensic evidence after an incident, all without touching any of the devices.

Integration with non-Apple software

Apple does not provide a public API for reading Continuity advertisements. This means that on Windows, the only way to consume the information is to capture and decode the raw BLE traffic directly. The Bluetooth Framework fills that gap by exposing a decoded, structured representation of Continuity messages to any application that uses the framework.

The practical effect is that non-Apple software can participate in environments dominated by Apple hardware. A Windows-based conference room system can react to a user's iPhone arriving. A retail Windows application can distinguish a customer who just opened AirDrop from one who is simply walking past. An access control system can use Proximity Pairing as a soft factor in authentication. None of this requires Apple cooperation, an Apple developer account, or an iOS application.