PC remote control: how to do it safely

May 2026 · 7 min read

Giving remote access to your PC is convenient, but badly configured it's an open door for someone who shouldn't come in. PController starts from an architecture designed to cut that risk: no ports open to the internet, tokens that expire on their own, LAN with no external servers. In this guide we go through the real risks of remote control, how that architecture reduces them, and what else you can do yourself.

Risk 1: unauthorised access

What can happen: if someone gets hold of your URL or credentials, they could connect to your PC without you knowing.

How PController reduces it: authentication uses server-issued tokens with a TTL. The token expires on its own. The local server validates the token before opening the WebSocket — without a valid token there are no frames and no control. On top of that, each PC has a unique subdomain that's hard to guess.

What you can do: never share the session token. If you suspect someone got in, close the server on the PC: that invalidates the active session. Restart the server to invalidate the tokens.

Risk 2: traffic interception

What can happen: someone on the same WiFi network could try to capture the traffic between your phone and your PC.

How PController reduces it: over the internet, all communication goes through a tunnel encrypted with TLS 1.3 — an attacker would only see encrypted data. In LAN mode the traffic never leaves your network and every connection demands a session token. One caveat: inside the local network it travels without TLS. If you share the WiFi with strangers (an office, a coworking space), use a network you trust or the Pro plan's tunnel.

Risk 3: exposing your screen in public places

What can happen: if you share a public spectator link (a Premium feature), people who shouldn't could watch your screen.

How PController reduces it: public links are Premium-only, view-only, capped at 4 hours and limited to 5 spectators. You can revoke them at any time from the web app.

What you can do: don't share the public link with people you don't trust. Once you no longer need it, revoke it from the web app.

Risk 4: the desktop server as an attack surface

What can happen: if the server has vulnerabilities, an attacker could use them to run code on your PC.

How PController reduces it: the exposed surface is small. Every connection demands authentication: a single-use grant issued by your account, exchanged for a rotating session token, plus rate limiting against brute force. Access from the internet comes in only through the encrypted tunnel, authenticated against your account. There are no ports open to the outside.

What you can do: keep the server up to date. PController checks whether there's a new version and tells you in My panel (system tray icon → "Open my panel"), but it doesn't install anything on its own: the notice takes you to the downloads page and you run the installer yourself. When you do, pick the same installation mode as last time. Step by step in the guide.

General good practice

Use Google OAuth to sign in — if you have 2FA on your Google account, your PController account inherits it.
Close PController when you're not going to use it (system tray icon → "Quit"). To end a session without closing the server, revoke it from app.pcontroller.app/security.
If you're travelling, avoid leaving the server running unattended on your home PC.
Check from time to time, in the web app, which devices have an active session.
Don't accept invitations from PCs you don't recognise — only accept invitations from people you trust.

Is it safer than TeamViewer?

We don't make that comparison, because it depends on your threat model. TeamViewer has more years of security audits behind it. PController has the advantage that the server opens no ports to the internet: it only listens on your local network, and external exposure is limited to the encrypted tunnel. Less attack surface by design. But it's a newer product.

If your case calls for certified corporate security, talk to your IT team. For personal use and small companies, PController's architecture is reasonably safe.

Reporting vulnerabilities

If you find a security problem, write to us at hello@pcontroller.app before publishing it. We commit to replying within 48 hours.

You judge an architecture by using it, not by reading about it. The 7-day trial asks for no card: try it and draw your own conclusions.

Get started — free