Secure remote desktop for your Mac
Only you. And your Mac.
End-to-end encryption on every channel, a Mac that stays silent to strangers, and a relay that can’t see a thing.
PocketRocket Host needs a Mac with Apple silicon and macOS 26.1 or later. The PocketRocket app is coming soon to the App Store.
Is PocketRocket end‑to‑end encrypted? — Encrypted, or not at all.
Yes. Picture, sound, input, clipboard and files all travel encrypted with ChaCha20‑Poly1305 between your device and your Mac. Each session gets fresh X25519 keys, derived with HKDF, which gives forward secrecy: a key exposed later can’t unlock an earlier session. Your Mac refuses unencrypted traffic altogether.
Every channel, encrypted
- PictureChaCha20‑Poly1305
- SoundChaCha20‑Poly1305
- InputChaCha20‑Poly1305
- ClipboardChaCha20‑Poly1305
- FilesChaCha20‑Poly1305
- Unencrypted trafficRefused
Keys that never leave home.
The private identity key of your Mac lives in its keychain and never leaves it. Each session gets its own keys, so past sessions stay private.
Since September 2026, a strict mode also uses separate keys for each direction and protects against replayed traffic.
Identity key
Ed25519
Stays in the keychain of your Mac
Session keys
X25519 · HKDF
New for every session
- Session 1
- Session 2
- Session 3
Who can connect to my Mac? — Knock, knock. No answer.
Only your devices. Your Mac shares its public key through your iCloud account, and PocketRocket Host doesn’t answer anyone who can’t prove they know it—much like WireGuard. There are no pairing codes to leak, and the private identity key of your Mac never leaves its keychain. Your Mac serves one device at a time.
Can the relay see my screen? — The relay sees nothing.
No. The relay only forwards encrypted bytes it has no key for. Your Mac signs its connections with its Ed25519 identity, so neither the relay nor anyone in between can pose as your Mac, and HMAC-protected lookups stop strangers from listing the Mac computers that use the relay.
No codes. Nothing to read out loud.
Your devices trust each other through your Apple Account and iCloud. There’s no pairing code to share—or to intercept.
Is it safe to unlock my Mac remotely? — Released only to you.
PocketRocket releases the password of your Mac only after Face ID, Touch ID or Optic ID succeeds on your device, where the password is kept in iCloud Keychain. It then types it at the login window of your Mac over the end‑to‑end encrypted channel—and your Mac refuses any traffic that isn’t encrypted.1
Face ID, Touch ID or Optic ID succeeds on your device.
The password comes out of iCloud Keychain on your device.
It’s typed at the login window of your Mac, end‑to‑end encrypted.
Dark screens, private work.
During a session, the physical displays of your Mac go dark, so nobody at your desk sees your work.
Security at a glance.
| Feature | PocketRocket |
|---|---|
| Encryption | ChaCha20‑Poly1305 (AEAD) on every channel: picture, sound, input, clipboard, files |
| Session keys | Ephemeral X25519 for each session, derived with HKDF (forward secrecy) |
| Mac identity | Ed25519; the private key never leaves the keychain of the Mac |
| Unencrypted traffic | Refused by the Mac |
| Strict mode | Separate keys for each direction and replay protection (since September 2026) |
| Who can connect | Devices on the same Apple Account, via iCloud; no pairing codes |
| Unknown devices | No reply without proof of the key |
| Relay | Forwards only encrypted bytes; can’t impersonate your Mac; HMAC against enumeration |
| Router | Port mapped only for a session (NAT-PMP/UPnP), by design |
| Unlock | Password from iCloud Keychain, released after Face ID, Touch ID or Optic ID, typed over the encrypted channel |
| Displays of your Mac | Dark during a session, restored afterward |
Before you start.
Is PocketRocket end‑to‑end encrypted?
Yes: every channel is encrypted end to end with ChaCha20‑Poly1305, using fresh X25519 keys for each session, and your Mac refuses unencrypted traffic.
That covers picture, sound, input, clipboard and files. Keys are derived with HKDF for forward secrecy, so a key exposed later can’t unlock an earlier session.
Can the PocketRocket relay server see my screen?
No: the relay only forwards encrypted bytes it can’t decrypt, and your Mac signs its identity, so the relay can’t pose as your Mac.
That identity is an Ed25519 key whose private part never leaves the keychain of your Mac, and HMAC-protected lookups stop strangers from listing the Mac computers that use the relay.
How does PocketRocket stop strangers from connecting to my Mac?
Your Mac only answers devices that prove they know its key, which is shared through your iCloud account; to anyone else, it stays silent.
There are no pairing codes to leak, and the private identity key of your Mac never leaves its keychain.
Is it safe to unlock my Mac remotely?
PocketRocket releases the password of your Mac only after Face ID, Touch ID or Optic ID succeeds on your device and types it only over the end‑to‑end encrypted channel.
The password is kept in iCloud Keychain on your device, and your Mac refuses any traffic that isn’t encrypted. Unlocking works at the macOS login window and uses Automatic login in PocketRocket.
Do I need a pairing code or an ID and password to connect to my Mac?
No: there are no codes—devices signed in to the same Apple Account find your Mac through iCloud.
Do I need to open ports on my router for PocketRocket?
No: PocketRocket works without port forwarding, and when your router supports NAT-PMP or UPnP, PocketRocket Host is designed to map a port only for the length of a session.
Can someone at home see what I’m doing on my Mac during a remote session?
No: the physical displays of your Mac go dark for the session, and windows and the pointer appear only on the virtual display you’re using.
Leave your Mac at home. Take it everywhere.
Install PocketRocket Host
On the Mac you want to reach. It lives in the menu bar.
Get the PocketRocket app
On iPhone, iPad, Apple Vision Pro or another Mac.
Tap your Mac
Use the same Apple Account, and your Mac shows up on its own.
PocketRocket Host needs a Mac with Apple silicon and macOS 26.1 or later. The PocketRocket app is coming soon to the App Store.