What Is IoT? How Everyday Things Connect to the Internet

In everyday life

You are out, and you check on your phone that the front door is locked. You watch your pet at home through a camera. More and more devices can do things like this. In each case, the device itself is connected to the Internet.

Objects that are not obvious computers, unlike PCs and smartphones, can connect to the Internet too. This is called IoT, short for the Internet of Things.

The electricity meter at home is one of them. A "smart meter" sends the amount of electricity you use to the power company over a network. Japan offers an example of a large rollout. By the end of March 2021, TEPCO Power Grid, a Japanese grid company, had installed about 28.4 million smart meters. That covers almost every home and business in its service area. The company knows how much power was used without sending meter readers door to door.

Factories use IoT to watch the condition of machines. In shipping, it tracks where packages are and how warm they are.

IoT is made of four parts

IoT devices come in many types. But if you look inside, most are built from the same four parts. To keep things simple, this article splits IoT into four parts. Books and companies divide it in slightly different ways.

1. Thing: It has a part that senses temperature, light, movement and so on, and turns it into an electrical signal. This part is called a "sensor." A small computer inside reads the sensor values and makes decisions. It is called a microcontroller (MCU).
2. Network: It sends the readings out, by radio or by wire.
3. Cloud: Computers on the other side of the Internet collect and store data from many devices. They make decisions by following set rules.
4. App: People check the results on a phone or PC, and send commands to the device.

Data flows from ① to ④, and commands travel the other way, from ④ to ①. "What Is a Microcontroller?" explains what is inside a microcontroller, and "What Is Cloud Computing?" covers the cloud.

To send short messages from devices to the cloud, a set of rules called MQTT is often used. Its key feature is a go-between server placed between senders and receivers. Each receiver first tells the go-between which kinds of data it wants. The sender does not need to know the receivers. It just hands its data to the go-between, and the data gets delivered.

A home example: smart locks

Let's look at the four parts in a front door lock. A "smart lock" is a product you attach to your existing door lock. You can then lock and unlock the door from your phone. Each product works differently, so here we simplify it to a typical design.

① Thing: The unit holds a motor that turns the lock's inside knob. It also has a sensor that detects whether the door is closed. For example, the sensor can detect whether a magnet on the door frame is close by. The microcontroller inside follows rules such as "lock the door a little after it closes."

② Network: At home, the phone and the unit connect directly through the low-power form of Bluetooth, called BLE. To use the lock while you are out, people usually add a hub that joins the home Wi-Fi. The battery-powered unit talks to the hub over BLE, and the hub reaches the Internet over Wi-Fi. A device that bridges two different kinds of network like this is called a gateway.

③ Cloud and ④ App: A log of each lock and unlock stays in the maker's cloud, and you can view it in the app. When you tap "Lock" while you are out, the command goes to the cloud, then the hub, then the unit.

A factory example: spotting trouble before a machine breaks

In a factory, one stopped motor can sometimes halt a whole production line. So IoT is used to keep watch on the condition of machines.

① Thing: A sensor that measures shaking (vibration) is attached to the motor. When the parts that support the spinning shaft start to wear, the strength and pattern of the shaking can slowly change. The microcontroller measures many times in quick succession. From these values, it calculates only the key figures, such as how strong the shaking is.

② Network and ③ Cloud: The key figures go to the cloud over the factory network or by radio, and months of them are stored. If unusual changes continue, the system alerts the person in charge through ④ the app.

With the alert, that person can plan to replace the part before it breaks. This is called "predictive maintenance": finding early signs of failure in data and fixing things in advance. Compared with replacing parts on a fixed schedule, it avoids throwing away parts that still work. It also cuts sudden stops. However, some failures give few warning signs, so not every breakdown can be predicted.

Choosing a network: distance, data and power

IoT uses many kinds of communication. When choosing one, ask three questions: how far, how much data, and how little power? No method does well on all three at once, so you give up one of them.

• Wi-Fi: Inside homes and offices, it can send large data such as camera video. It uses more power, so it suits devices plugged into an outlet.
• Bluetooth (BLE): It sends small amounts of data over short distances, from a few meters to a few tens of meters, using little power. It works together with a phone or a hub (see "How Does Bluetooth Work?").
• LPWA: It gives up a lot of speed in return for reaching several kilometers or more on little power. More on this below.
• Cellular networks (4G and 5G): They cover wide areas and can send large data. They suit moving cars and distant devices that have a power supply (see "What Is 5G?").

LPWA stands for "low-power wide-area." There are four main types of LPWA.

• LoRaWAN: A standard from the industry group LoRa Alliance that uses radio bands needing no license. You can even set up your own base stations to receive the signals.
• Sigfox: It uses a network run by a specific operator and sends very short messages. A device can send at most 12 bytes at a time, about 12 letters or digits of plain text.
• LTE-M: A low-power version of 4G (LTE) mobile technology, made for IoT. It works even while moving.
• NB-IoT: It is also based on mobile phone technology, but it uses an even narrower slice of the radio band. It suits devices that stay in one place, such as meters.

The LTE-M and NB-IoT standards were completed in 2016 by 3GPP, the group that writes mobile phone standards. Both are used under a contract with a mobile carrier. For typical ranges and speeds, see the table in "Wi-Fi vs Bluetooth vs LPWA."

How devices run for years on a battery

Some LPWA and BLE devices run for years on a battery. The secret is that they spend almost all their time asleep.

Take a device that sends the temperature just once an hour. It wakes up, measures, finishes sending in a short time, and goes back to sleep. While asleep, it shuts down most of its circuits and uses only a tiny amount of electricity.

This resting state is called sleep mode. "What Is a Microcontroller?" shows how to estimate how many years a coin cell lasts. On the other hand, a camera that streams video nonstop needs wall power or regular charging.

Where to process data: the edge or the cloud

Collected data is not always sent to the cloud for processing. Sometimes it is processed inside the device, or on a computer inside the factory. This is processing at the edge of the network, so it is called "edge computing."

There are three main reasons to process data locally.

• Speed of response: A round trip to the cloud takes time. Urgent decisions, such as stopping a machine quickly, are made locally.
• Amount of data: Sending all the video or detailed vibration records would overload the connection and the budget. Devices boil the data down to key figures before sending.
• Privacy: Video and voice from inside a home can stay inside. If only the result "someone arrived" is sent, there is less risk of a leak.

On the other hand, the cloud is good at comparing records from thousands of devices or studying changes over long periods. In practice, both are used together. "What Is an NPU?" covers running AI on local devices.

Working across brands: Matter

For a long time, smart home devices from each maker had their own apps and their own ways of connecting. For example, you could not control one company's light bulb from another company's smart speaker.

So the industry group CSA created "Matter," a common standard. CSA's full name is the Connectivity Standards Alliance, and Amazon, Apple and Google are among its members. CSA announced the first version, Matter 1.0, in October 2022. The goal is for compatible devices to connect in the same way, even when they come from different makers.

Matter 1.0 runs over three kinds of network: Wi-Fi, wired LAN (Ethernet) and Thread. Thread is a low-power wireless network. Devices plugged into power act as relays, linking the radio signals like a mesh. The first setup is done over BLE. Version 1.0 covered lighting, heating and cooling controls, door locks, and media devices such as TVs.

Even small devices can be hijacked

An IoT device may be small, but inside it is a real computer. So, like a PC, it can be taken over. It has no screen, so the owner rarely notices that something is wrong. That also helps attackers.

A well-known example is "Mirai," malicious software that spread in 2016. It searched for Internet-connected security cameras, video recorders and similar devices. Then it tried to log in through the entry point meant for remote control. It used a list of a few dozen username and password pairs. People often leave these unchanged from the factory settings.

A "botnet" is a group of hijacked devices that can be controlled together from far away. A study presented at a US conference in 2017 counted the devices taken over by Mirai and its variants. Their number peaked in November 2016 at about 600,000.

Botnets are used for attacks that flood a target with huge amounts of data at once, knocking its service offline. This is called a DDoS attack. On October 21, 2016, the US company Dyn was targeted. Dyn provided many companies with a service that translates website names into IP addresses (DNS). As a result, Twitter, Netflix and other sites became hard to reach, mainly in the US. Dyn confirmed that a Mirai botnet took part in the attack (for DNS, see "How Does DNS Work?").

In October 2016, the US government's US-CERT (now CISA) issued a warning. Mirai runs only in a device's memory, so restarting the device removes it. However, US-CERT pointed out that unless the password is changed, the device may soon be infected again.

What Japan and other regions are doing

Take Japan as an example. Japan's Ministry of Internal Affairs and Communications (MIC), the research institute NICT and others launched "NOTICE" on February 20, 2019. NICT tries to log in to devices in Japan that can be reached from the Internet. It uses usernames and passwords that are easy to guess. If a login works, the user is told through their Internet provider and asked to fix the settings.

According to MIC and NICT, the test goes no further than checking whether a login works. It does not go into the device to change settings or look at data. From fiscal year 2024, the checks also cover devices with unfixed software weaknesses and devices already infected. Such weaknesses are called "vulnerabilities."

Japan also has labels that help buyers choose secure products. In March 2025, Japan's Information-technology Promotion Agency (IPA) launched "JC-STAR," a labeling scheme for IoT products. At the first level, ★1, makers check for themselves that a product meets the minimum measures every product needs, and then declare it. The higher levels, ★2 to ★4, set criteria for each type of product.

In the EU, the Cyber Resilience Act entered into force in December 2024. This law requires security measures for products that connect to networks. The duty to report vulnerabilities that are found applies from September 2026. Most of the rules apply from December 2027. One difference stands out: makers choose whether to apply for JC-STAR, while the EU law is mandatory.

What users can do

• At first setup, change the password to one that is hard to guess (see "How Are Passwords Cracked?")
• Install the device's software updates. Updates delivered over the network are called over-the-air (OTA) updates. Turn on automatic updates if the device offers them
• Turn off features you don't use, especially entry points for remote control
• When buying, check how long updates will be provided. Consider replacing devices that no longer get updates

Common misconceptions

By the numbers

The IoT Analytics count does not include smartphones, PCs or tablets. Counting methods differ between research firms. For example, a hub that links many sensors may count as one device. The numbers are estimates.

Learn more

• Compare in a table: Wi-Fi vs Bluetooth vs LPWA, MCU vs MPU (choosing the "brain" of an IoT device), TCP vs UDP (MQTT runs on top of TCP)
• Terms for the next step: TLS (encrypting communication), firewall (limiting the ways in from outside), SBOM (a list of the software inside a product)
• Try the numbers: dBm converter (units for radio signal strength), password brute-force time calculator
• Related articles: "What Is a VPN?" (how devices open to the Internet get targeted), "What Is an IP Address?"