Matrix Remote Locked before it leaves. Only the paired computer can open it.
Encryption
Three layers
Pairing, requests and connection setup
- How it is locked
- Sealed with the two computers' own keys (X25519, HKDF-SHA256, ChaCha20-Poly1305)
- Who can read it
- Only the two paired computers
The screen picture
- How it is locked
- WebRTC DTLS-SRTP
- Who can read it
- Only the two paired computers
Mouse, keyboard, clipboard and files
- How it is locked
- WebRTC DTLS (encrypted data channels)
- Who can read it
- Only the two paired computers
| What | How it is locked | Who can read it |
|---|---|---|
| Pairing, requests and connection setup | Sealed with the two computers' own keys (X25519, HKDF-SHA256, ChaCha20-Poly1305) | Only the two paired computers |
| The screen picture | WebRTC DTLS-SRTP | Only the two paired computers |
| Mouse, keyboard, clipboard and files | WebRTC DTLS (encrypted data channels) | Only the two paired computers |
Man in the middle
Why our relay can't look
Each computer only accepts the other's video key if that key arrived inside a sealed message from the paired computer. Anyone in the middle, our relay included, would have to swap that key, and a swapped key means the connection never starts. Matrix Remote's own tests prove this, through our relay too.
Pairing
Why you compare a number
Both computers work this number out from the keys they just exchanged and a random number each one picked. If someone tried to get in between them, the two numbers would be different.
Same six digits? Press They match on both computers. Different? Press They don't match. Nothing is saved, and you can start again.
Our relay
What our relay does know
When two computers are not on the same network, our relay introduces them, and if they can't reach each other directly it passes the locked picture on. In the app's own words, this is what it knows:
That two computers talked, and when.
How much data went through it.
Both computers' internet (IP) addresses, and when each one is online.
The random device IDs, never your name, files, screen or typing.
Once it checks licences: this computer sends it the whole licence key, which can include the name and e-mail address the key was issued to. The relay checks the key each time and keeps only the licence number and a hash of this computer's device ID, not the name or e-mail. Our current relay doesn't check licences, and Matrix Remote doesn't send it the key.
Setting
Always use the relay
Every session goes through our relay, so the other computer never learns this computer's network address.
It is slower. It is still encrypted from end to end.
Setting
Use my Tailscale network
If both computers are on your Tailscale network, the picture and your mouse and keyboard go over it.
Our relay still introduces the two while it is reachable, so it still sees their internet addresses.
If our relay is down, they still connect only when you have set the other computer's Tailscale address (⋯ ▸ Set address (Tailscale)… on the Viewer) or it is on the same network. This switch alone doesn't do that.
On your computer
What stays on your computer
On a MacYour secret key, your paired computers and the access-password check live in the macOS Keychain.
On WindowsYour secret key and your paired computers are protected by Windows for your account (DPAPI).
Session history is encrypted on this computer only.
The access password is never readable by any server: it travels sealed to the Receiver, and only a check value is kept there.
A list of who connected and for how long. Kept encrypted on this computer only. We never see it. Clear deletes it.
Never
What we don't do
No analytics, advertising or telemetry in the app.
Nobody at Matrix Remote can see your screen, your typing, your files, your pairing codes, check numbers or access password, or which computers you have paired.
We will never ask you to pair with us.
This website has no analytics, no trackers, no cookies and no third-party content.
Honest limits
What we don't claim
We don't claim forever-secrecy against someone who later steals a computer and its keys. Keep your computers locked with a password, like you would anyway.