OpenDesk

Open source · Self-hosted · Beta

Remote desktop through a relay that can't see your screen.

OpenDesk lets you view and control another computer over the internet. You run the relay. The two computers encrypt the screen, input, sound and files between themselves, so the relay only passes along bytes it can't read.

DownloadOpen the browser viewer

For Windows, macOS and Linux. The browser viewer controls a computer that runs the app, without installing anything.

The home screen shows this computer's ID and a one-time password. During a session, the toolbar shows whether the connection is direct or relayed.

How a session works

Host, relay and viewerThe host and the viewer each open an outbound wss connection on port 443 to the relay. They try a direct UDP path between themselves. If that fails, the same encrypted traffic goes through the relay, which cannot decrypt it.Hostshares its screenViewerapp or browserYour relayforwards sealed bytesoutbound wss://outbound wss://direct UDP when the network allowsChaCha20-Poly1305 either way

  1. Share an ID and password

    The computer you want to reach shows a 9-digit ID and a password that changes after every session.

  2. Agree on a key

    The other side enters both. SPAKE2 turns the password into a key that only the two computers know. The password never crosses the network.

  3. Connect the shortest way

    They try a direct UDP path first. If a firewall blocks it, the same encrypted traffic goes through the relay instead.

What you get

  • Your own relay

    One small Rust service. The Docker Compose setup puts Caddy in front, which gets the HTTPS certificate for you.

  • End-to-end encryption

    A key per session from SPAKE2, ChaCha20-Poly1305 on every frame and keystroke. TLS protects the connection to the relay on top of that.

  • No open ports

    Both computers connect out to the relay on port 443. No port forwarding, no inbound firewall rules.

  • Direct when it can be

    ICE finds a direct UDP path between the computers. The session toolbar says Direct or Relayed and shows the round trip.

  • The usual tools

    System sound, text clipboard sync, file transfer with a consent prompt, session recording, and a picker for each monitor.

  • Unattended access

    A fixed password for your own machines, an optional code from an authenticator app, and start at sign-in so a restart doesn't lock you out.

  • Open source

    AGPL-3.0. Rust for the relay, crypto and capture; Tauri and React for the app. Read it, build it, run your own.

  • Any desktop, plus a browser

    One app hosts and views on Windows, macOS and Linux. A browser can view and control without installing anything.

Download

Newest build: v0.1.0-beta.5 (beta). Install it on both computers. The app connects to the project's test relay out of the box; you can point it at your own.

macOS

Apple silicon, macOS 12.3 or later. No Intel build yet.

Windows

Windows 10 (1803) or later, 64-bit.

Linux

x86_64. Screen sharing goes through PipeWire and the desktop portal.

These builds are not code-signed. The first time you open the app, macOS Gatekeeper and Windows SmartScreen will warn you. Getting startedshows how to get past each warning. All builds and their changelogs are on thereleases page.

Before you rely on it

  • OpenDesk is in beta. Most testing has happened on macOS; Windows and Linux hosting is less mature.
  • The browser viewer always goes through the relay and has no sound, file transfer, clipboard sync or recording.
  • Linux hosts on Wayland have limited input support.
  • The relay can't read your session, but it does see who connects to whom, when, and how much data flows. Security model

Run a relay in a few minutes

On any server with Docker and a DNS name:

git clone https://github.com/treeot/opendesk.git
cd opendesk
DOMAIN=relay.example.com docker compose up -d

Then set each app's relay to wss://relay.example.com/ws. Self-hosting guide