No account

Trust one Mac, not a login

The QR code carries the certificate fingerprint and a per-install secret. Later connections have to present that secret before the Mac accepts input.

Steps

  1. Install the Mac app on macOS 13 or newer and grant Accessibility plus Screen Recording.
  2. On iOS 16 or newer, tap Scan QR. Allow Local Network if iOS asks.
  3. Stay on Automatic if the Mac has no public address. Tailcat tries a hole-punch, then an encrypted relay over TCP.
  4. Choose Direct if you only want LAN or your own VPN. That choice does not start Tailcat.

After the badge turns connected, use the desktop.

Questions

Do I have to install Tailscale?

No. Wi-Fi on the same network is fastest. Automatic mode can use built-in Tailcat without a public IP, port forward, or Tailscale account. Direct-only mode does not start Tailcat. A VPN you already run remains a direct path.

What does the relay learn?

It cannot read the desktop, window text, clipboard, or keystrokes. Those stay inside the certificate pinned at pairing. The relay forwards ciphertext and may see that a connection exists, plus timing and size.