How the relay works

The relay is how your phone reaches your Mac when they're not on the same network. It forwards. It can't read.

When it's used

• Same Wi-Fi or the same Tailscale network? The phone talks to your computer directly. The relay isn't involved.
• Anywhere else — cellular, the office, a café — traffic goes through a relay that both sides can reach.

The same goes for paired hosts: machines without SSH reach your Mac directly when they can and through the relay when they can't.

The official relay works out of the box

A new Mac connects to the official relay with nothing to configure. Pair your phone and you can reach your Mac from anywhere.

End-to-end encrypted, always

Everything between your phone and your computers — sessions, chats, terminals, the remote screen, localhost pages — is encrypted on the two devices themselves. The relay in between, official or your own, only passes it on: it can't read it and can't change it.

• Every connection gets fresh keys, and recorded traffic can't be played back.
• Each computer signs in to the relay with a key of its own, so nobody else can pretend to be your computer.
• There's no unencrypted fallback.

Because of this, even a self-hosted relay at a plain ws:// address is safe to use.

Use your own

Prefer to keep everything on infrastructure you control, or need a relay closer to you? Run your own with one command and point Seedmux at it with one field. → Run your own relay

Or no relay at all

If you only ever connect on your local network or over Tailscale, you can turn the relay off for a machine entirely. For a paired host, write none in its Relay field in Settings › Remote Hosts.