Keys only the two ends hold
Each time a viewer joins, it and the computer exchange fresh P-256 keys. The shared key is derived with HKDF-SHA256, salted with a per-session secret that the Silux server hands to the computer and the viewer over their own channels. The relay never receives it, so it cannot sit in the middle.
Everything sealed
Screen pictures, mouse and keyboard input, the session's clipboard sync, file transfers, the remote terminal and the remote camera travel as AES-256-GCM ciphertext. The relay sees only which kind of message it is forwarding, so it can still pace the picture for slow links.
Forward secrecy
Keys are created per connection and thrown away afterwards. A key captured later cannot unlock an earlier session.
Forged input is refused
Once a session is keyed, the computer ignores any unencrypted mouse or keyboard message, so nothing injected on the way can click or type.
You can see it
The session header shows “End-to-end encrypted” in the browser, and the desktop and phone apps show 🔒 end-to-end encrypted in the status line. Direct peer-to-peer sessions are encrypted with DTLS between the two ends.
Frequently asked questions
Can Silux see my screen?
Not on the relay: it only forwards encrypted data it has no key for. Recordings are saved on your own computer, never on Silux.
Which ciphers are used?
ECDH on P-256 with ephemeral keys, HKDF-SHA256 key derivation and AES-256-GCM authenticated encryption, with unique nonces per message.
Do I need to turn it on?
No. Current agents and viewers encrypt automatically.
Related features
Two-factor sign-in for every account, every time
Record remote sessions on your own computer
The picture goes straight from the computer to your browser
See how this compares on the feature matrix, or find Silux Connect in your country and city.