Remote Desktop by ID

Sharing a screen by Device ID — the P2P window, MangoSSH Direct's own capture, invites, the unattended Windows service — is a separate application now, MangoScreen. It is the same code built with one feature flag, and it is free. Install it on each computer you want to share or connect to. MangoSSH shows a one-time notice about this the first time you open it after upgrading.

What MangoSSH still does

• Connect by ID, over RDP — The main window still reaches a machine by its Device ID and password when that machine has Windows Remote Desktop enabled. No port forwarding, and the pairing is the same one MangoScreen uses.
• Direct IP — Dial an address you can already reach — a MangoFly tunnel address, or a Tailscale one — with no relay in the path at all.
• The relay itself — One relay serves both products, alongside MangoSSH's persistent sessions, the PAM Broker and browser access. Self-hosting it is unchanged.

What moved to MangoScreen

• Sharing this computer — MangoSSH no longer registers itself with the relay. Two apps doing it would give one computer two Device IDs.
• MangoSSH Direct — MangoSSH's own screen capture and input, for a machine with no RDP server at all. Windows, macOS and Linux.
• Invites — Rather than reading an ID and password out, the person who needs help types yours and clicks Invite.

How the pairing works, either way

The host registers with your relay and is handed a nine-digit Device ID and a six-digit access password; the viewer presents both. Six digits is a million guesses, so the exchange is a SPAKE2 balanced PAKE — recording it tells an observer nothing they can grind through offline, every guess costs one live attempt, and five failures lock the pairing until the host regenerates. A direct peer-to-peer path over QUIC is attempted first and the relay falls back by itself; on the direct path the host's per-pairing certificate is pinned through a MAC only the two ends can compute, and on the relay path the frames are sealed with keys from the same pairing. Either way the relay operator moves ciphertext.