An end-to-end-encrypted, energy-metered remote desktop. Sub-20ms latency, 4K@60, hardware-accelerated on every platform. Every session is signed and logged — for you, by you, kept by you.
Download
macOS and the web client are stable. Windows and Linux are in open beta. Mobile is on its way.
Features
Six things RemoteOS does — every install, every platform, every session.
ChaCha20-Poly1305 over an X25519 key exchange. Only your two devices hold keys. Nothing in the middle can read your screen, your inputs, or your files — including us.
When a session ends, RemoteOS writes a tamper-evident receipt — start time, end time, frames, bytes, energy, peer fingerprints. You keep the receipts. We don't. Self-host the log if you want.
RemoteOS measures the joules of every session — your laptop, the encoder, the network, the remote box. The number lives in the menu bar and on the receipt. The first remote desktop honest enough to tell you what it costs in physics.
RemoteOS rides Media-over-QUIC for video and inputs. One connection, multiple tracks, one congestion controller. Sub-100ms over the public internet. Fallback to WebRTC where QUIC is blocked.
Stream 1080p over modest networks; the viewer's GPU/NPU upscales to 4K. Hardware-accelerated end to end — VideoToolbox, NVENC, QuickSync, AMF, AV1. Frames cost less than the bytes that carry them.
Run the whole stack on your own boxes — control plane, relay, TURN, ledger. Docker Compose for a single host, Helm chart for Kubernetes, ARM64 images for Pi and Apple Silicon homeservers. Your devices connect peer-to-peer where they can; your relay only when they can't.
Inside a session
Click "Connect" and RemoteOS lights up six internal stages. Each one measures its own energy. At "Disconnect," the session leaves you with a single signed receipt — every byte and every joule accounted for.
Email + passkey, or single sign-on. The remote box and your viewer derive a shared session key — neither side moves alone, neither key sits on a server.
ScreenCaptureKit on macOS, DXGI on Windows, PipeWire on Linux. The hardware encoder converts frames to AV1, H.265, or H.264 with zero copies. The encoder logs its own joule cost.
Media-over-QUIC carries the session as a multi-track stream — video, audio, input, clipboard, files. Each chunk is signed under the session key. The wire IS the audit.
On the viewer the GPU and NPU do the heavy lifting. Bandwidth stays modest; perceived quality climbs. The upscaler emits the joules it spent so the receipt sees end-to-end energy.
Mouse, keyboard, clipboard, file drops. Each event is signed under the session key. Kalman-filtered prediction smooths perceived latency without lying about what was sent.
Sum of capture + wire + render + input. The session ends with a signed total — duration, frames, bytes, joules, peer fingerprints. The receipt becomes a row in your ledger.
Receipts
When you disconnect, RemoteOS writes a session receipt to your account's ledger. Who connected, from where, for how long, how many bytes, how many joules. The signature is non-forgeable — rewriting one means forging an Ed25519 signature.
{
"kind": "remoteos.session.completed",
"session": "rs_2026_05_07_a3f1c91a_9241",
"viewer": { "device": "macbook-pro-16", "os": "darwin/14.6", "ip_geo": "us-ca" },
"host": { "device": "studio-imac", "os": "darwin/15.0", "ip_geo": "us-or" },
"transport": "moqt",
"codec": "av1+opus",
"started_at": "2026-05-07T17:22:04Z",
"ended_at": "2026-05-07T18:14:38Z",
"duration_s": 3154,
"frames": 189240,
"bytes": 412318472,
"joules": 4781.6,
"kwh": 0.001328,
"co2_g": 0.42,
"sig": "ed25519:c7a2…1f4b"
}Specs
No marketing-page softening. The actual numbers, protocols, and platforms RemoteOS supports today.
Questions