Remotek

Q: Where do the code emails go?

From noreply@remotek.io through Resend; on your own server without a key the code is printed to the log.

Remote control of a computer from a phone or another PC: screen and input, terminal, files, power and sensors.

Download for Windows Download the APK

Client and agent in one installer

Windows 10/11
Android 8.0+
iOS — later

Remotek Search A

Load

1 s

38%

Processor4.2 GHz

Memory11.4 / 32 GB

PS C:\Users\abdul> Get-Service remotek-agent

Status Name DisplayName

------ ---- -----------

Running remotek-agent Remotek Agent

CtrlTabEsc^C

Features

The desktop arrives as a stream of frames. A tap is a click, a long press the right button, two fingers scroll. From another PC the mouse and keyboard go to the remote machine entirely.
PowerShell or cmd, with administrator rights where they are needed. The session lives on the computer and survives the application being put away.
Browsing the drives, downloading and uploading, renaming and deleting. Text and images open inside the application.
Shut down, restart, sleep, hibernate and lock, at once or after a delay that can be cancelled. A sleeping computer is raised by Wake-on-LAN.
Processor, graphics card, memory, disks and network, refreshed once a second. A threshold rule sends a notification to the phone.
The process list with icons and a search, ending tasks, switching windows, starting installed programs.

PowerShell

Administrator

PS C:\Users\abdul> whoami

abdul-desktop\abdul

PS C:\Users\abdul> Get-Service Spooler

Status Name DisplayName

------ ---- -----------

Running Spooler Print Spooler

PS C:\Users\abdul>

CtrlTabEsc^C

command…

ABDUL-DESKTOPonline · uptime 3d 4h

Power

Shut down

Restart

Sleep

Hibernate

Lock

In 60 s · cancel

Confirm

Restart now

CancelConfirm

Sensors

1 s

61%

Graphics54 °C

Memory11.4 / 32 GB

CPU47 °C

Fan1,240 RPM

Network128 KB/s

CPU over 85 % for five minutes — a notification

App demo

The Windows app The Android app

The desktop client's window on sample data: the sections switch the way they do in the app. The phone app on sample data: the computer list, a PC's dashboard and its tools open the way they do in the app.

Remotek sample data

ABDUL-PConline· 18 msdirect 3 ms

ABDUL-PC online· 18 msdirect 3 ms

CPU

23%load

4.71 GHzclock54°temperature

loadclock

Memory

18.4GB

of 31.9 GB

58%load47°temperature

Swap · 2.1 GB / 8.0 GB

GPU 0NVIDIA GeForce RTX 4070

41%

61°temperature142 Wpower38%fan

VRAM5.2 GB / 12.0 GB

2.35 GHzclock

10.50 GHzmemory

NetworkEthernet

↓ 48.3 Mbit/sdown↑ 3.1 Mbit/sup

Disks

C:\412 GB / 931 GB

41°

D:\1.62 TB / 1.82 TB

38°

System

uptime3d 4h 12m

logged inabdul

TerminalPowerShell · admin

PowerShell

PowerShell 7.4.6PS C:\Users\abdul> Get-Process | Sort CPU -desc | Select -First 3 NPM(K)  PM(M)   WS(M)   CPU(s)    Id ProcessName     92 412.18  398.02   812.44 11244 chrome     71 280.33  301.51   402.10  8712 Code     38 118.90  214.07   355.72  1320 dwmPS C:\Users\abdul>

Install

Install Remotek on the computer

The installer carries both the client and the agent. Choose “Connect to this PC” and turn the autostart on: Windows asks for administrator rights once.

Sign in on the phone

Email and the code from the letter, or sign-in through Google. The server address is already filled in.

The computer appears in the list

No port forwarding is needed: the agent and the application both connect to the server themselves.

Security

There are no inbound connections

The agent opens an outbound connection to the server itself. On a local network the application connects to the PC directly and checks the SHA-256 fingerprint of its certificate.

TLS the whole way

Phone to server and PC to server. Unencrypted transport is turned on only by the explicit --insecure flag, for debugging on a local network.

Tokens instead of a password

An Ed25519-signed access token lives 15 minutes, a refresh token 90 days and changes on every renewal. A refresh token presented twice revokes its whole family.

The database holds no secret in the clear

Passwords are argon2id; tokens, pairing codes and the codes from letters are SHA-256.

The boundary of an account

Computers, devices and codes belong to an account. Another account's identifier gets the same answer as one that exists nowhere.

Rate limits

120 requests per 10 seconds per device, dangerous commands 5 a minute, terminal input and the live screen 600 per 10 seconds.

The log, and revoking a device

Every command is a log line with the device, the arguments and the result. A device is revoked with one button; the IP addresses of sign-ins and visits are kept for 30 days and seen only by the server's operator.

There is no end-to-end encryption

Frames and files travel through the server, and it sees them as they pass.

There is no second factor

The code in the letter confirms a new installation, not every sign-in.

The secure desktop is out of reach

While the session is locked or a UAC prompt is open, remote input is not accepted. Sensors, the terminal and files keep working.

Your own server

The hub is one process and one SQLite file. There is no ready-made image: it is installed from a working copy of the repository. Pick where it runs.

VPS · Docker

Ubuntu 22.04 or 24.04 with a public IP, the domain’s A record pointing at it, ports 80 and 443 open.

Copy the code to the server and run the installer:

On your machine, in the repository root

git archive --format=tar HEAD | gzip -9 > /tmp/remotek-src.tar.gz
scp -P 22 /tmp/remotek-src.tar.gz [email protected]:/tmp/
ssh -p 22 [email protected] 'mkdir -p /opt/remotek/app \
  && tar xzf /tmp/remotek-src.tar.gz -C /opt/remotek/app \
  && bash /opt/remotek/app/deploy/bootstrap-server.sh hub.example.com [email protected] 22'

Details

The script installs Docker, a firewall, the hub and Caddy, which gets the certificate for hub.example.com itself.

Create an account in the app: “Other server” → https://hub.example.com. The verification code is in the log:
On the server
```
docker logs remotek-hub-1 2>&1 | grep "verification code"
```
Details
The code arrives by email once the hub has a Resend key (REMOTEK_RESEND_API_KEY) and a sender address (REMOTEK_MAIL_FROM). Without them the code goes to the log.
On the PC, sign in to that account in Remotek for Windows as “Connect to this PC”. Then close registration: /admin → Pairing.

Raspberry Pi 5

A Pi 5 with 64-bit Raspberry Pi OS, wired to the router, with a fixed DHCP address.

Clone the repository into ~/remotek and install the hub as a service from that folder:
On the Pi
```
sudo deploy/pi/install.sh --public-url http://192.168.50.2:8080
```
Details
The script fetches Python 3.12 itself and creates the remotek-hub service. --public-url is the Pi’s fixed address.
Create an account in the app: “Other server” → http://192.168.50.2:8080, with “Allow http://” on. The verification code is in the log:
On the Pi
```
journalctl -u remotek-hub | grep "verification code"
```
Details
The code arrives by email once the hub has a Resend key (REMOTEK_RESEND_API_KEY) and a sender address (REMOTEK_MAIL_FROM). Without them the code goes to the log.
On the PC, sign in to that account in Remotek for Windows the same way, with “Allow http://”, as “Connect to this PC”. Then close registration: /admin → Pairing.
Details
http:// is for home or a VPN only. From outside, use Tailscale Serve: see docs/.

Mac

An always-on Mac, wired to the router. The hub runs without Docker: a magic packet does not leave Docker’s network.

Install the hub by sections 4 and 5 of docs/deploy-macos.md and start the service:
On the Mac
```
sudo launchctl bootstrap system /Library/LaunchDaemons/app.remotek.hub.plist
```
Details
The code goes in /Users/Shared/remotek, the service runs as _remotek, the hub’s address is in the plist, and the plist in /Library/LaunchDaemons.
Create an account in the app: “Other server” → http://192.168.50.3:8080, with “Allow http://” on. The verification code is in the log:
On the Mac
```
sudo grep "verification code" /Users/Shared/remotek-data/logs/hub.err.log
```
Details
The code arrives by email once the hub has a Resend key (REMOTEK_RESEND_API_KEY) and a sender address (REMOTEK_MAIL_FROM). Without them the code goes to the log.
On the PC, sign in to that account in Remotek for Windows the same way, with “Allow http://”, as “Connect to this PC”. Then close registration: /admin → Pairing.
Details
http:// is for home or a VPN only. From outside, use Tailscale Serve: see docs/.

Windows

A Windows 10 or 11 (x64) PC that does not sleep, wired to the router. It needs Git, uv and a free port 8080.

Clone the repository, build and install the hub, and start it:
In PowerShell, in the repository root
```
powershell -ExecutionPolicy Bypass -File hub\installer\windows\build.ps1 -SkipSetup
powershell -ExecutionPolicy Bypass -File hub\installer\windows\install.ps1
& "$env:LOCALAPPDATA\Remotek\hub\remotek-hub.exe" --tray
```
Details
The installer puts the hub in %LOCALAPPDATA%\Remotek\hub and a shortcut in the Start menu, and creates the RemotekHub task: the hub starts at sign-in, with a tray icon.
Create an account in the app: “Other server” → http://192.168.50.4:8080, with “Allow http://” on. The verification code is in the log:
In PowerShell
```
Select-String "verification code" "$env:LOCALAPPDATA\Remotek\hub\data\hub.log"
```
Details
If Windows asks whether remotek-hub.exe may use the network, allow private networks. Codes arrive by email once the hub has a Resend key (REMOTEK_RESEND_API_KEY).
On the PC, sign in to that account in Remotek for Windows the same way, with “Allow http://”, as “Connect to this PC”. Then close registration: /admin → Pairing.
Details
http:// is for home or a VPN only. From outside, use Tailscale Serve: see docs/.

Router

A router with Docker and Docker Compose, OpenWrt for instance: a 64-bit processor, 1 GB of memory or more, a USB drive or an SSD.

Copy the repository onto the router’s drive and create the settings:
On the router, in the repository folder
```
cp deploy/.env.pi.example deploy/.env.pi
mkdir -p deploy/data
```
Details
In deploy/.env.pi: PUBLIC_URL is the router’s address, HUB_UID and HUB_GID the owner of deploy/data. The image is built for linux/arm64 and linux/amd64; built-in flash is too small for it.
Build and start the hub:
On the router, in the repository folder
```
docker compose -f deploy/docker-compose.pi.yml --env-file deploy/.env.pi up -d --build
```
Details
The same compose file as on the Pi: the container uses the router’s own network, so a magic packet reaches the LAN, and restarts by itself (restart: unless-stopped).
Create an account in the app: “Other server” → http://192.168.50.1:8080, with “Allow http://” on. The verification code is in the log:
On the router, in the repository folder
```
docker compose -f deploy/docker-compose.pi.yml --env-file deploy/.env.pi logs hub | grep "verification code"
```
Details
The code arrives by email once the hub has a Resend key (REMOTEK_RESEND_API_KEY) and a sender address (REMOTEK_MAIL_FROM). Without them the code goes to the log.
On the PC, sign in to that account in Remotek for Windows the same way, with “Allow http://”, as “Connect to this PC”. Then close registration: /admin → Pairing.
Details
http:// is for home or a VPN only. From outside, use Tailscale Serve: see docs/.

If the router cannot run containers, put the hub on a Pi, a Mac or a PC. The router then only needs fixed DHCP addresses for the hub and the PC, and, for a hub outside the home, wakes the PC over SSH with the command set in /admin (on OpenWrt etherwake -D -i br-lan {mac}).

Wake-on-LAN on the PC

For Remotek to wake a sleeping or switched-off PC, set the PC up once.

UEFI/BIOS: turn on “Wake on LAN”, “Power On By PCI-E” or “Resume By PCI-E Device”; turn off “ErP Ready” and “Deep Sleep”.
Network adapter: Device Manager → the adapter → Power Management: check all three boxes. Advanced: Wake on Magic Packet → Enabled.
Details
Keep “Allow the computer to turn off this device to save power” checked: clearing it greys out the wake boxes. If the PC still does not wake, turn Energy Efficient Ethernet off. To check, the command below should list the adapter.
In PowerShell
```
powercfg /devicequery wake_armed
```
Fast Startup: turn it off, since it powers the network adapter down after Shut down. Control Panel → Power Options → Choose what the power buttons do, or:
In PowerShell as administrator
```
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power" /v HiberbootEnabled /t REG_DWORD /d 0 /f
```
A cable: the PC is wired to the router. Over Wi-Fi a magic packet almost never wakes it.
Who wakes it: a hub on the same network, a second PC running Remotek at home, or the router over SSH when the hub has a VPN into the home network. Chosen in /admin; no port forwarding.

By default the apps connect to https://remotek.io. Your own hub’s address goes in on the sign-in screen: “Other server”.

Download

Windows 10 / 11

64-bit · .msi — client and agent in one installer, installed without administrator rights

SHA-256: —

Download the .msi

Android 8.0 and newer

.apk — installed from the file, Android will ask for permission

SHA-256: —

Download the APK

iOS and macOS — later.

Questions

Is the application not on Google Play?

Not yet: the APK is downloaded from this site, and its SHA-256 is printed beside the button.

Windows Defender complains about the installer

The installer is not signed with a developer certificate yet, so SmartScreen reports an unknown publisher.

Can a computer be woken from another city?

Yes, if something on the home network can send the magic packet: a second PC running Remotek, the router over SSH, or a server on that network.

And if the computer is locked?

Sensors, the terminal, files and power keep working, while Windows lets no remote input into a locked session.

Who can see my computers?

The owner of the server sees the metadata, and whatever is in flight while it is in flight; other accounts see nothing.

Where do the code emails go?

From [email protected] through Resend; on your own server without a key the code is printed to the log.