Skip to content

Web Client

Marc Pope edited this page Jul 26, 2026 · 2 revisions

Web client

A RustDesk client that runs in the browser. Connect to a device from the console without installing anything locally.

It is a from-scratch TypeScript implementation of the RustDesk wire protocol — rendezvous, relay, NaCl handshake, login — not a WASM port of the desktop client.

Requirements

HTTPS is mandatory. Both WebCodecs (VideoDecoder) and Web Crypto (crypto.subtle) are restricted to secure contexts, so browsers block them over plain http://. This is browser policy, not a CortenDesk setting, and cannot be worked around in JavaScript.

http://localhost counts as a secure context, so local evaluation works.

The console itself is perfectly usable over plain HTTP — only the in-browser client needs TLS. See Web client requires HTTPS.

You also need the wss:// bridge to your RustDesk server's WebSocket ports reachable from the browser. See Reverse proxy and TLS.

Browser: best in Chrome or Edge. The desktop stream requires WebCodecs.

What it does

  • Screen — hardware-accelerated video via WebCodecs (VP8, VP9, H.264, H.265 and AV1 as the browser supports them)
  • Audio
  • Keyboard and mouse, including Ctrl+Alt+Del
  • Clipboard both directions
  • Multi-monitor switching
  • Session statistics
  • File transfer — a dual-pane manager inside the session: browse the remote filesystem, send and receive files and folders with progress, resume-aware digests, conflict prompts and drag-and-drop. Uses the File System Access API on Chromium; falls back to a picker and the Downloads folder elsewhere.

Saved passwords

A device's password can be saved for auto-login on subsequent connections. Saved passwords are hashed, never stored in plaintext.

Turning it off

Set CORTENDESK_NATIVE_WEBCLIENT=false to hide the web client. It is enabled by default.

Policies still apply

Permissions pushed by a strategy — file transfer, clipboard, audio and the rest — are enforced by the device, not by the client. Disabling file transfer in a strategy disables it for the web client exactly as it does for the desktop client.

Related

Clone this wiki locally