How PandaSend keeps your terminal private
A terminal can run any command on your computer, so whoever can type into it has your computer. PandaSend is built so that only phones you paired can, and so that the service in the middle can't read or change anything.
At home: nothing leaves your network
On the same Wi-Fi, your phone connects straight to your computer over HTTPS, with a certificate your computer makes for itself. No account, no internet connection, no relay. Each phone signs in with a one-time pairing code shown on your computer.
Away from home: end-to-end encrypted through the relay
Your computer and your phone both connect out to PandaSend's relay, which passes traffic between them. Everything the relay passes is encrypted with keys that only your phone and your computer have. All cryptography comes from libsodium, a widely used, independently audited library. We don't invent our own.
- Identities. Your computer has its own long-term key pair. Each phone makes its own key pair when you pair it, in the phone's browser storage.
- Pairing. The QR code carries your computer's public keys and a one-time code. Your phone seals its pairing request to your computer's key (a libsodium sealed box), so the relay can't read the code or swap in a different key. Your computer signs its reply, and the phone checks the signature against the key from the QR code.
- Every connection. Your phone and computer each make fresh one-time keys, sign them with their long-term keys, and derive session keys from them (
crypto_kx). A recording of an old connection is useless for a new one. - Every message. Terminal traffic is sent as an encrypted, authenticated stream (
crypto_secretstream_xchacha20poly1305). A changed, reordered, replayed or cut-off message fails to decrypt, and the connection ends.
What the relay can and can't see
| The relay sees | The relay never sees |
|---|---|
| Which computers are online (as public keys), phone IP addresses while connected, and how much encrypted data flows | Commands, output, session names, pairing codes, or any key that could decrypt them |
The relay keeps no logs of traffic and stores nothing about sessions. Our automated tests record every byte the relay carries during a real session and check that none of the commands, output, session names or pairing codes appear in it.
Losing a phone
Every paired phone is listed in the PandaSend window on your computer. Revoke one and it's cut off at that moment, including any terminal it has open. Other phones and your computer keep working.
What isn't done yet
- System keychain storage for your computer's keys. Today they're in a file only your user account can read.
- A sleeping computer can't be reached. That's physics, not a bug, but it's worth knowing.
Found a problem? Please tell us before telling everyone: email support@pandasend.space, and we'll get back to you quickly.