// security

A shell in a browser deserves paranoia.

You are considering exposing a terminal to the internet. That is a serious thing to do, so here is exactly how mtmux is built, what it protects against, and what it does not.

DATA PATH

tmux server

Unix socket, your uid. mtmux reads it as a normal client.

mtmux daemon

Seals every frame for the paired device. Holds the long-term key at 0600.

relay (untrusted)

Sees: ciphertext, sizes, timing. Cannot see: keystrokes, output, paths.

your device

Device key in non-extractable WebCrypto storage, scoped to the origin.

Guarantees

Pairing is an authenticated key exchange

A short-lived code carries a hash commitment; both sides confirm a 4-word fingerprint. A relay that swapped keys would produce a mismatch you can see.

Frames are sealed per session

x25519 agreement, HKDF-derived session keys, ChaCha20-Poly1305 with a per-frame counter. Keys rotate every 15 minutes and on reconnect.

Nothing listens

The daemon makes one outbound WebSocket. There is no open port to scan, no sshd to brute-force, no proxy to misconfigure.

Revocation is immediate

mtmux devices revoke ipad drops the socket and forgets the key. A stolen phone loses access without a password reset.

Least privilege by default

The daemon runs as you, never root. It can be limited to named sessions with --allow work,api so a paired phone can't reach everything.

Auditable

Every attach, key, share link and revocation is logged locally in JSONL. Team plans stream it to your SIEM.

What we defend against

✓A hostile or compromised relay reading or injecting output.

✓Passive network capture on hotel or cellular networks.

✓An attacker who learns a pair code after it expires or is used.

✓A lost device: revoke, and its key is worthless.

✓Replay of captured frames, via per-frame counters and rotation.

What we don't

!A compromised machine. If your box is owned, so is the session.

!An unlocked, paired phone in someone else's hands.

!Traffic analysis — the relay can infer when you are typing.

!Notification bodies you route to third parties: Slack sees what you send it.

!Malicious browser extensions on a paired desktop.

Don't trust the relay? Don't use it.

Two escape hatches, both one flag. LAN mode never leaves your network. Self-hosting keeps the same protocol with your own pipe.

$ mtmux up --lan

$ mtmux up --relay wss://relay.internal

$ mtmux devices ls # fingerprints + last seen

Disclosure

Report anything you find to [email protected]. We acknowledge within one business day, ship fixes for critical issues within seven, and credit reporters in the changelog unless asked not to.

Protocol specpublic

Client sourceMIT, on GitHub

Third-party reviewcrypto audit, Q2 2026

Data retentionframes: never stored