VeyndeskSecurity
Exactly how Veyndesk connects and what is and isn't encrypted, including current gaps.
Last updated 31 October 2026 · Veyndesk 0.5.1
Summary
- The password is never sent over the network. The remote computer sends a random challenge and only a hash proving the password comes back.
- Direct connections are end-to-end encrypted (WebRTC DTLS).
- Relay connections are encrypted in transit but not end-to-end: they pass through Cloudflare's servers.
- Connections by IP address on a local network are not encrypted yet.
- One-time-password sessions show an Accept / Deny prompt by default. Permanent-password sessions don't.
How a connection is made, and how it's protected
| Connection | When it's used | Encryption |
|---|---|---|
| Direct (P2P) | First choice when you connect by ID. The two apps exchange connection details through ntfy.sh, then connect directly using STUN (Google and Cloudflare servers). | End-to-end (DTLS). Only the two computers can read the session. |
| Relay | If a direct connection isn't ready within about 7 seconds. The shared computer runs a Cloudflare "quick tunnel" (cloudflared) and the viewer connects to it over HTTPS. | HTTPS/TLS in transit. Cloudflare's edge servers handle the traffic unencrypted inside their network, so this is not end-to-end. |
| Local network / IP address | When you type an IP address, or as a fallback when the partner was found on your local network. | Not encrypted yet (plain WebSocket). Avoid on untrusted networks. |
Adding end-to-end encryption to the relay and local connections (a key exchange between the two apps) is the top security item on the roadmap.
Passwords
- One-time password: 8 random letters and digits, made new every time the app starts or when you click New.
- Permanent password (Settings, at least 8 characters): stored only as a salted SHA-256 hash on your computer.
- Login is challenge–response:
proof = SHA-256(SHA-256(salt:password) : random nonce), so the password and its hash are never sent. - Lockout: after 8 wrong passwords within 5 minutes, further attempts are rejected for a few minutes.
Accept prompt and unattended access
| Partner uses… | Accept / Deny prompt? |
|---|---|
| One-time password, "ask before accepting" on (default) | Yes. No answer within ~45 s = refused. |
| One-time password, "ask before accepting" turned off | No |
| Permanent password | No. This is unattended access. |
Anyone who knows your permanent password and your ID can connect without you being asked, whenever Veyndesk is running. Use a long, unique password, only set one on computers you need to reach unattended, and remove it in Settings when you no longer need it. The app always shows Your screen is being shared while a session is active, and Disconnect all ends every session.
External services
Veyndesk has no accounts and no Veyndesk-run servers. To connect over the internet it uses public services; see the privacy page for exactly what is sent to each.
Builds
Every download is built by GitHub Actions from the public source code; the build workflow is in the repository. Installers are not code-signed yet.
Report a security issue
Please report vulnerabilities privately using GitHub's Report a vulnerability form (Security tab of the repository), not in a public issue. Include the version, operating system and steps to reproduce. You'll get a reply on the advisory.