Security

Security

• PadBridge only accepts packets signed with the shared key (HMAC-SHA256) and drops replayed packets.
• The packets are not encrypted. Anyone listening on the network sees the input. So run it only in the LAN or over a VPN such as Tailscale and never open the port to the internet.
• The status page only shows things. Outside the home network it asks for a PIN, but it is unencrypted HTTP and does not belong on the internet.
• The key does not belong in a repository or in any public chat. To get a new key, delete netpad.key and restart PadBridge; then copy it to the peer again.