Selected services only
Share access to one service such as RDP, SSH, VNC, or a custom TCP port instead of exposing an entire subnet.
DeskAccess
TPM-aware, passwordless access control for RDP, SSH, VNC, and selected TCP services. Keep RDP private, then allow access only from authenticated machine identities with optional TPM-backed identity keys.
Scoped Remote Access
Invite and pairing links
Create temporary links or persistent paired access for trusted admin devices.
Windows, Linux, and Pi
Designed for desktop support, home labs, Raspberry Pi access, and small office administration.
Built For System Administrators
DeskAccess is for teams that want to stop exposing RDP directly and avoid broad VPN access. Administrators can keep RDP bound to a private or loopback address and require DeskAccess authentication before any client reaches it.
Replace exposed RDP entry points
Use DeskAccess as the controlled access path to RDP instead of opening port 3389 to a LAN, VPN subnet, or the public internet.
TPM-backed identity keys
Where TPM support is available, trusted access can require proof from hardware-backed key material so only the paired machine identity can reconnect.
Machine identity access
Pairing and reconnects use machine identity proofs at the DeskAccess layer, reducing dependence on shared remote-access passwords.
Alternative To Broad Remote Access Tools
DeskAccess is built for people who want a narrower alternative to traditional VPNs and full remote desktop products. Instead of opening a whole network, it exposes only the selected service you invite or pair.
Alternative to full VPN access
Use DeskAccess when you need access to one RDP, SSH, VNC, or TCP service rather than a full private subnet like many VPN-style tools provide.
Alternative remote desktop workflow
DeskAccess can launch existing RDP and VNC clients through a secure tunnel, making it useful for workflows often handled by remote desktop tools.
Open-source and self-hostable
The project is open source, and teams can run their own relay infrastructure when they want more control over availability and policy.
People comparing tools such as TeamViewer, AnyDesk, RustDesk, Chrome Remote Desktop, Tailscale, ZeroTier, or traditional VPNs may choose DeskAccess when service-scoped access is a better fit than broad device or network access.
Security Model
DeskAccess uses passwordless authentication at the DeskAccess layer. During pairing and reconnect, endpoints prove machine identity instead of relying on a shared DeskAccess password.
Encrypted transport
RDP, SSH, VNC, and custom TCP data are carried over encrypted peer connections between DeskAccess endpoints.
Private RDP by default
RDP can remain reachable only locally on the host while DeskAccess handles the authenticated remote access path.
TPM-backed identity
Where supported, DeskAccess can bind machine identity to TPM-backed key material. This is used as a hardware-backed identity key, not as full TPM manufacturer-chain attestation or device-health verification.
Passwordless pairing
Pairing links establish trust between machines. Later connections authenticate with machine identity proofs, not a DeskAccess account password.
Software fallback
On systems without TPM support, DeskAccess can fall back to software identity while keeping the same machine-identity authentication model.
Relay-safe design
Relays and discovery systems can help connect peers, but they do not receive plaintext service traffic.