RemoteOS

Your computer, anywhere.
With a receipt.

An end-to-end-encrypted, energy-aware remote desktop. Hardware-accelerated HEVC on macOS today, browser-first via WASM + WebGPU. Every auth event lands in an append-only, hash-chained ledger.

Try in your browser Native apps See a session

WASM

Browser-first client

HEVC

Hardware accelerated

E2E

Encrypted media

Ledger

Hash-chained auth log

Download

One install. Every platform.

The web client is live now. Native apps for macOS, Windows, and Linux are next.

Available

Web client: v0.9.0-beta. Native apps will be signed and notarized.

Features

What's in the box.

Six things RemoteOS does — every install, every platform, every session.

ENCRYPTION

End-to-end encrypted by default.

ChaCha20-Poly1305 over an X25519 key exchange. Only your two devices hold keys. Nothing in the middle can read your screen, your inputs, or your files — including us.

RECEIPTS

Every event writes to an append-only ledger.

Auth events — sign-in, sign-out, MFA changes, token revocations — are hash-chained into a tamper-evident ledger today. Session-lifecycle events and Ed25519-signed receipts are next on the path.

ENERGY

Energy, in the design.

RemoteOS is built so each stage — capture, encode, wire, render — can report the joules it spent. The instrumentation is wired through the codec selector; the menu-bar reading lands when the desktop apps do.

TRANSPORT

QUIC-first transport.

Media flows over WebRTC today. A Media-over-QUIC track — one connection, multiple subgroups, per-stream priority — is in development; the measurement harness is live in the repo. WebRTC stays the fallback.

PERFORMANCE

Hardware-accelerated capture and encode.

ScreenCaptureKit on macOS feeds the VideoToolbox HEVC encoder with zero copies. The codec selector picks bitrate and keyframe cadence from the host's capabilities. Cross-platform encoder paths are tracked on the roadmap.

SELF-HOST

Self-hostable, end to end.

Run the whole stack on your own boxes — control plane, relay, TURN, ledger. Docker Compose for a single host, Helm chart for Kubernetes, ARM64 images for Pi and Apple Silicon homeservers. Your devices connect peer-to-peer where they can; your relay only when they can't.

Inside a session

Auth events are hash-chained today; session create / start / end and Ed25519-signed totals are next. The ledger is your account's, or a self-hosted Postgres you control.

Receipts

A ledger that grows with you.

Every auth event writes an append-only row — sign-in, sign-out, MFA changes, token revocations — hash-chained so tampering breaks the next hash. The schema is below; session-lifecycle events and Ed25519-signed rows are next on the path.

→ Tamper-evident, not magic. Each row carries the previous row's hash. A walker can verify the chain offline.
→ Yours, not ours. Self-host the Postgres holding the ledger. The schema is open; the chain verifies without our service.
→ Growing scope. Auth events today. Session-lifecycle and Ed25519 signatures next. Energy readings once the desktop apps instrument the stack.

RemoteOS Audit Ledger Row audit_logs

{
  "sequence":      42,
  "event_type":    "login_success",
  "user_id":       "28c0b665-6a6a-47c1-b5c9-ecd6be26e89d",
  "session_id":    null,
  "details":       { "ip": "203.0.113.7", "ua": "RemoteOS/0.9 wasm" },
  "previous_hash": "d068c49d1a090bec…",
  "event_hash":    "e2b9fedfd5e18231…",
  "created_at":    "2026-05-22T09:05:06Z"
}

Specs

Everything, on the table.

No marketing-page softening. The actual numbers, protocols, and platforms RemoteOS supports today.

Performance

Frame rate: Up to 4K @ 60fps (codec selector adapts)
Encoders: H.265 (HEVC) hardware-accelerated
Hardware paths: VideoToolbox on Apple Silicon and Intel Macs
Codec selection: Capability-detected per host; degrades cleanly on weaker hardware

Security

Encryption: ChaCha20-Poly1305 · X25519 ECDH for media
Authentication: Password + optional TOTP MFA today; SSO on the roadmap
Session keys: Per-session ephemeral; derived on the endpoints, not the server
At rest: Argon2id-hashed credentials
Transport: TLS 1.3 over QUIC (HTTP/3); WebRTC for media today, MoQ track in development
NAT traversal: ICE/STUN/TURN (RFC 8445); relay only when peer-to-peer fails

Receipts

Format: Append-only ledger — hash-chained rows, sequence-numbered
Logged fields: event_type · user_id · session_id · details · prev_hash · event_hash · sequence · created_at
Storage: Your account's ledger, or self-hosted Postgres
Verifiable: Anyone with the ledger can re-walk the chain offline; tampering breaks the next hash
Coverage today: Auth events (login, logout, MFA, token revoke)
Coverage roadmap: Session lifecycle (create / start / end), admin actions, signed receipts via Ed25519

Platforms

Web: Chrome 120+ · Safari 17+ · Firefox 122+ · WASM + WebGPU — live
macOS: 13+ Universal — in development
Windows: 10+ x64/ARM64 — in development
Linux: Ubuntu 22+, Fedora 39+, Arch · x86_64/aarch64 — in development
iOS / iPadOS: 17+ — coming
Android: 13+ — coming

Questions

Common ones, answered straight.

Where does my data live?

On your two devices. Sessions are end-to-end encrypted with ChaCha20-Poly1305 over X25519 ECDH — only the host and the viewer hold keys. Nothing in the middle, including RemoteOS infrastructure, can read your screen, your keystrokes, or your files.

How fast is it?

Media flows over WebRTC, hardware-accelerated on macOS via VideoToolbox HEVC. Latency depends on the network path between the two endpoints; the codec selector adapts bitrate and keyframe cadence to the host's capabilities. Cross-platform encoder paths and the Media-over-QUIC transport are on the roadmap.

Which platforms work today?

The browser is live (Chrome 120+, Safari 17+, Firefox 122+) — WASM + WebGPU. Native apps for macOS, Windows, and Linux are in development. iOS, iPadOS, and Android come after the desktop trio.

Can I host my own server?

The backend is a Rust server with a Postgres + Valkey + coturn stack — Docker Compose runs it on one box. Helm and a self-host guide come with the 1.0 release. Your devices connect peer-to-peer where possible; TURN handles the rest.

What is the audit ledger?

An append-only, hash-chained log RemoteOS writes for auth events — sign-in, sign-out, MFA changes, token revocations — today. Each row has a sequence number, the previous row's hash, and its own hash, so tampering breaks the chain. Session-lifecycle events and Ed25519-signed rows are next; the schema reserves the columns.

Why does it talk about energy?

Because performance claims that don't show their cost are unfalsifiable. The codec selector and transport harness are instrumented per stage; the joule readout lands on the receipt once the desktop apps ship and the ledger covers session lifecycle.

Is the source open?

Not today. The receipt schema is documented and the chain verifies offline. The wire protocols we depend on — QUIC, MoQ, WebRTC, MLS, OIDC — are open standards.

Your computer, anywhere. With a receipt.

One install. Every platform.

Web

macOS

Windows

Linux

iOS / iPadOS

Android

What's in the box.

End-to-end encrypted by default.

Every event writes to an append-only ledger.

Energy, in the design.

QUIC-first transport.

Hardware-accelerated capture and encode.

Self-hostable, end to end.

Six stages. One signed total.

You authenticate; the auth event lands in the ledger.

Your screen is captured at the source.

Frames travel over WebRTC.

The viewer paints the frame.

Your inputs go back over the same channel.

The session lifecycle writes to the ledger.

A ledger that grows with you.

Everything, on the table.

Performance

Security

Receipts

Platforms

Common ones, answered straight.

Your computer, anywhere.
With a receipt.