PCFarV1.2

Remote control your PC, end to end encrypted.

Connect by ID over the internet through your own relay — including the Windows login screen, the lock screen, and after a reboot. Free to download.

Download

Windows 10/11, 64-bit. Both files are self-contained — no .NET install needed.

Download PCFar143.9 MB · the app Download PCFar Service71.1 MB · login-screen access

Put both files in the same folder. The app installs the service for you when you enable login-screen access — it looks for PCFarService.exe beside itself.

Verify what you downloaded

This software takes control of your computer. Check the hash before you run it.

Get-FileHash .\PCFar.exe        -Algorithm SHA256
Get-FileHash .\PCFarService.exe -Algorithm SHA256

File	SHA-256
`PCFar.exe`	`4985AD044D7448A3FA999BFBDD41F24049EA56CF1A23B1906B7CB90C4E0408B3`
`PCFarService.exe`	`A204499E422F7913EED49C4FBF6B8DEF31ADEF5AC74FE0D4F7C7DFF09C1212BE`

Security

What it actually does, stated precisely.

End-to-end encrypted. AES-256-GCM per message, keyed by a mutually authenticated handshake. The relay only ever moves ciphertext.
Hybrid post-quantum key agreement — ECDH P-256 and ML-KEM-768 combined, so the session holds if either one does. Available when both ends support ML-KEM; PC-to-PC does, macOS does not yet, and the app tells you which you got.
Forward secrecy. Fresh ephemeral keys per session, so a stolen device key cannot decrypt yesterday's traffic.
Mutual identity verification with trust-on-first-use pinning. If a device you know presents a different key, the connection aborts.
PIN-authenticated, hardened with PBKDF2 and bound to the session, with a lockout that survives restarts.
Default deny. Nobody sees your screen until you approve it, unless you deliberately turn on unattended access.

No independent audit. The design is deliberate and the primitives are standard, but nobody outside this project has reviewed it. Weigh that before using it for anything that matters.

You need your own relay

There is no company server in the middle — that is the point.

Connecting by ID over the internet goes through a rendezvous server you run yourself; it pairs two ends and forwards ciphertext it cannot read. On a LAN you can skip it entirely and connect straight to an IP address.

The relay is a single small binary (rdrelay) that runs anywhere, including a NAS or a cheap VPS.