How it works

1. Pairing: trust starts at the Mac's screen

• Each device has its own P-256 key pair. The iPhone's private key is generated inside the Secure Enclave and can't be exported; on devices without one it lives in the keychain, limited to that device. The Mac's private key is stored in a file only your user account can read.
• The Mac's ID is derived from its public key (the first 16 bytes of the key's SHA-256). The rendezvous service makes the Mac prove ownership with a signature, so nobody can claim or impersonate that ID.
• The pairing QR code only ever appears on the Mac's screen. It holds the Mac's ID, its public-key fingerprint, and a 32-byte pairing key that is valid for 5 minutes and works once.
• After scanning, the iPhone computes an HMAC-SHA256 over its own key fingerprint with the pairing key. That proves it saw the code and ties the proof to its public key, so nothing in between can swap in a different key. The Mac checks the proof and records the phone's public key.
• From then on each side accepts only the other's public key. There are no passwords and no accounts to phish or stuff; adding another phone takes someone standing at the Mac to scan the code.

2. What happens on every connection

1. Face ID first. Before every connection the iPhone asks for Face ID or the device passcode, and again when you return after more than 5 minutes in the background.
2. A signed request. The iPhone signs a request with its Secure Enclave key: a timestamp, a random nonce, one-time connection credentials and its network addresses. The rendezvous service passes it to the Mac. The addresses are covered by the signature, so the service can't point the Mac somewhere else.
3. The Mac decides. It accepts only a paired key, a timestamp within 2 minutes and a nonce it has never seen, so old requests can't be replayed. Only then does it open a UDP port, and closes it again if no session starts within 30 seconds.
4. Finding a path. Both sides try the local network, a direct path through the routers via STUN hole punching, and a Cloudflare TURN relay, all at once. If a direct path works within 0.6 seconds it wins; otherwise the first working path is used, and DuoDesk moves to a direct path if one turns up in the next 10 seconds. Relay credentials are issued only after the Mac accepts.
5. An encrypted session. Over that path the two open a QUIC connection (TLS 1.3). Each presents its certificate and checks that the other's public key is exactly the one recorded at pairing. If it isn't, the connection is dropped.
6. Self-healing. Each session keeps a backup relay path ready and switches to it after about a second without an answer on the main one. When the network changes, the app reconnects on its own, and your input isn't sent in the meantime.

3. If our servers were compromised

DuoDesk is designed on the assumption that the rendezvous service and the relay are already compromised. Encryption and identity checks happen only between your iPhone and your Mac; the servers hold no key that could decrypt a session or impersonate a device.

What the service sees and keeps in normal operation is listed in the privacy policy.

4. What the rendezvous service is allowed to do

• It runs on Cloudflare Workers, with one Durable Object per Mac. The Mac only connects out to it and registers with a signature; the service never needs, and never gets, a pairing key or a device's private key.
• Connection requests are passed to the Mac as they are; the only field the service reads is the push token.
• Relay (TURN) credentials are issued only after the Mac accepts a connection, and expire after 12 hours.
• The push relay only lets Live Activity pushes through, only to phones that have connected to that Mac (the service keeps just a hash of each token), and only on channels that Mac created. The push key stays in the service instead of shipping inside the Mac app.
• Abuse limits: at most 30 connection requests per minute from one IP address to one Mac, at most 8 pending connections per Mac, and messages of at most 8 KB.

5. Protections on the Mac

• No open ports on the internet. Normally the Mac has a single outbound connection to the rendezvous service. The session's QUIC listener is bound to the loopback address, and the outward-facing UDP port opens only for a verified request.
• Privacy screen. While you're connected, DuoDesk sets the physical displays' gamma tables to black. Gamma applies after the picture is composited, so what reaches your phone is unaffected, and macOS restores gamma by itself if DuoDesk Host quits or crashes, so the screen can't stay dark.
• Lock on disconnect, idle timeout. When you disconnect, DuoDesk can lock the Mac right away, using the same mechanism as the system's Lock Screen command. After 15 minutes without input the session ends on its own.
• Visible connections. The menu bar icon changes while someone is connected, and every connection, disconnection and its reason goes into the Mac's local connection log.
• Signed and notarized. DuoDesk Host is signed with a Developer ID, notarized by Apple and runs with the Hardened Runtime. It needs the Accessibility permission to carry out your input, which sandboxed apps can't have, so it isn't on the Mac App Store; you download it from this website instead.

6. Screen, input and measurements

• The screen is captured with ScreenCaptureKit at up to 60 fps, with no frames sent while nothing changes, and encoded in hardware by VideoToolbox as H.264 or HEVC, with low-latency rate control, no B-frames and a bitrate that adapts to the network.
• The Mac can add a virtual display that matches your phone's resolution, shown 1:1 without scaling.
• The pointer is drawn on the phone immediately and reconciled with the Mac afterwards, so it never waits for the network; the phone draws at 120 Hz.

Measurements

Measured in Singapore in October 2026 on DuoDesk's transport layer (QUIC over hole punching or the relay). The screen stream defaults to 12 Mbps. Your results depend on your network.

7. Known limitations

• The Mac needs a logged-in user; a locked screen is fine. A Mac with FileVault stops at the unlock screen after a restart, before any network is up, where no remote tool can reach it.
• DuoDesk connects over UDP, so networks that block UDP entirely won't work.
• About every 30 days macOS asks to confirm screen recording again; if that blocks the picture, someone has to click “Allow” at the Mac.
• The rendezvous service can see connection metadata (see section 3).