Install DuoDesk and it gives that machine a number. Type the number on any other computer and you are sitting at it — screen, mouse, keyboard, files. Windows, macOS and Linux, and nothing to configure on the router.
Four steps, and the third one is the important one: nothing happens on the far computer until somebody there agrees, or until you supply the password they set.
Everything below is in the app today, on all three platforms.
Mouse, keyboard, scroll, modifiers and Ctrl+Alt+Del. Coordinates travel as fractions of the picture, so a 4K desktop driven from a laptop still lands on the right button.
Every screen on the remote machine is listed; switching swaps the video track in place, with no reconnection and no gap.
Set a password and the machine answers by itself — the server room, the shop till, the parent's laptop that nobody can talk through a dialog.
A six-digit authenticator code on top of the password, checked on the remote machine itself.
Both directions, checksummed, straight down the same encrypted connection. Incoming files land in Downloads and nowhere else.
Copy on one machine, paste on the other. Off with one checkbox if you would rather it did not.
Blank the remote display while you work, so nobody standing next to it can watch. The blind is excluded from the capture itself.
Record what you see to a video file, on your own machine, with no extra load on the far end.
An address book of the machines you use, with reconnect tokens so you are not typing a password every morning.
Who connected, when, from which ID and how it ended — kept on your computer, not on ours.
Peer to peer over your own network or across the internet; a relay only when both ends are behind a NAT that refuses anything else. The app tells you which one you got.
The app checks a release feed, tells you what changed, and installs when you press the button — or at an hour you choose.
Remote-access tools have been around for twenty years and their users have been very clear about what goes wrong. These are the four things that come up again and again — on Trustpilot, on G2, on every support forum — and what DuoDesk does about each.
| The recurring complaint | What DuoDesk does |
|---|---|
| "It got used to scam my mother." Remote tools are the standard instrument of fake-support fraud. | The accept dialog names the caller, defaults to Reject, counts down to a refusal rather than an acceptance, and shows a plain warning the first time an unknown ID calls. You can also lock the machine to a list of IDs, so an unknown one never even rings. |
| "I could not cancel, and I was billed for another year." Billing and cancellation dominate the one-star reviews of the big incumbent. | There is nothing to cancel. DuoDesk has no account, no subscription and no licence check. You install it and it works. |
| "The free version keeps deciding I am a commercial user." Sessions cut off mid-work by a licence heuristic. | No heuristics, no session limits, no timer. The app never phones home for permission to run. |
| "It lags and the connection drops." | Direct peer-to-peer whenever the network allows, hardware-encoded video, and a status line that says the resolution, frame rate, bitrate, round trip and whether you ended up relayed — so a slow session is diagnosable instead of mysterious. |
What DuoDesk does not have yet: a whiteboard to draw on the remote screen, in-session text chat, Wake-on-LAN, a two-panel file manager, and mobile clients. They are not pretended at anywhere in the app.
Install it on both computers — the one you want to reach and the one you will be sitting at. Same app, both roles.
Apple silicon. First launch: right-click the app → Open. Needs Screen Recording and Accessibility.
DownloadAppImage. chmod +x it once, run it, and it updates itself from then on. Capture needs X11 or a Wayland portal.
DownloadA blue box appears saying “Windows protected your PC” and “Publisher: Unknown publisher”. Nothing was found in the file. It means this build is not signed with a paid Windows code-signing certificate, so SmartScreen has no publisher name to show and warns about a file it does not recognise. Every unsigned program gets the same box.
Click More info if the box shows one, then Run anyway.
Prefer to check rather than trust a button? Every build's SHA-256 is
in versions.json and under
each card's version history; compare it with
Get-FileHash .\DuoDesk.exe in PowerShell. The app verifies
that same published checksum before it runs an update. A signing
certificate is on the list — until there is one, this page would
rather explain the warning than pretend it does not happen.
Almost never. The two computers exchange a handshake through the rendezvous server and then talk directly. Only when both ends sit behind a NAT that refuses direct traffic does the video get relayed, and the app says relayed in the status line when that happens.
Because the build is not code-signed yet. A Windows signing certificate has to be bought from a certificate authority and, since 2023, kept on a hardware token or a cloud signing service — it is a yearly cost and an identity check, not a setting. Until there is one, SmartScreen has no publisher name to display and warns about a file it has not seen before. Nothing is hidden from you: the download section explains the exact dialog, and every build's SHA-256 is published so you can verify the file yourself.
No — and that is deliberate. The ID is bound to a key generated on that machine, which is what stops anybody else from claiming it. You can add a short name as an alias, though, if the digits are hard to read out over the phone.
An ID can be dialled by anybody who has it, so what matters is not how many machines fit but how far apart two addresses are. At sixteen digits a blind guess against a million registered machines lands about once in nine billion tries, which stops scanning being a strategy rather than merely making it slow. IDs issued when they were nine digits long keep working exactly as they are.
They can make your computer ask you a question. That is all. Without somebody pressing Accept, or the unattended password, there is no session. You can also switch the machine to a fixed list of allowed IDs and everything else is refused before anything appears on screen.
No. DuoDesk uses the same hole-punching every video call uses, and falls back to a relay when that fails.
No.
Every version published here is listed in versions.json, which is also the feed the app itself reads. Publishing a build is the same act as announcing it.