Security
As of 19 October 2026, version 0.1.2
We only describe what actually works in the released version. Work in progress is labelled as such.
Connection
- Encryption between computers. Screen, keyboard, mouse, clipboard and chat go directly between the computers over an encrypted WebRTC channel (DTLS-SRTP). Our connection server and the TURN relay only pass encrypted data and cannot see the screen or what you type.
- Nothing before acceptance. A computer sends no picture and accepts no input until someone at it accepts the connection or the caller enters the unattended-access password.
- Protection against password guessing. After 3 wrong passwords from one device, the computer blocks further attempts for 5 minutes.
An honest limitation: the server helps set up each connection. Verification of the computer's identity, which protects even against a compromised server, is in progress. Until then we do not claim that "nobody but you can see the session".
Account
- Your password never reaches the server. The app derives a key from it (Argon2id) on your device; the server only stores a hash of that key.
- Saved computer passwords in the address book are encrypted on your device (XChaCha20-Poly1305). We do not have the key. Names, tags and notes in the address book are not encrypted this way.
- Two-factor sign-in (2FA, TOTP) with the option to remember a device for 30 days; you can clear the list of trusted devices at any time.
- Sign-in limits: 10 wrong passwords per 15 minutes per account and 20 attempts per minute per IP address.
Software and infrastructure
- Signed updates. The app only installs an update with a valid digital signature. Every download has a SHA-256 checksum.
- Servers in the EU. The connection server and the TURN relay run in Helsinki (Finland, Hetzner).
- The browser viewer loads its code from our server, so it relies on trust in the server more than the desktop app does.
Status
| Session encryption between computers | Live |
|---|---|
| 2FA and trusted devices | Live |
| Signed updates, SHA-256 checksums | Live |
| Computer identity verification | In progress |
| Apple and Microsoft code signing | In progress |
| 2FA recovery codes | In progress |