Your computers stay yours.

Trust model

Input Portal builds a trusted group of computers through explicit human approval on the local network. Nothing else creates trust: not a computer name, not being on the same Wi-Fi, not an account.

A computer is its key, not its name

Every installation has a persistent device key. Other computers recognise it by that key. The computer name you see in the app is descriptive only; two computers can share a name, but never a key.

Discovery is not trust

Computers announce themselves on the local network so the app can list nearby candidates and know where to reach them. That announcement is treated as untrusted. A group member counts as present only after an encrypted channel, pinned to the key saved for it, has been established successfully.

Only members can act

Group updates, clipboard data, screen frames, and removals are accepted only from a computer whose full key matches a saved member. Input events travel inside the encrypted channel and are protected against replay, so a recorded packet cannot be played back later.

Pairing and approval

To add a computer, you select it or its group in the Nearby list. A small popup appears on the other computer with Deny and Approve. Pairing requires action on both ends, expires shortly, and runs only on the local network. A decision is accepted only as the answer to a request this computer actually sent, from the key it was sent to.

There is no verification phrase to compare, on purpose: pairing is a short, two-sided action between two people who can see both screens. A malicious program already on your network could imitate a computer name, so approve only a request you just initiated yourself, and deny anything unexpected.

Device keys and where they live

The device key, the group state, and the group's transport secret are stored in the operating system's per-user application-data directory: the same kind of place your browser keeps its profile. They are not stored on any server, and the group secret is never sent to the relay.

• On macOS and Linux the directory is created with mode 0700 and the state file with 0600, readable by your user only.
• On Windows the state currently lives in Roaming AppData with the standard per-user permissions.
• A computer that leaves a group generates a new key. A removed computer does the same when it learns of its removal. A computer outside a group generates a fresh key before every join request.

Encryption

Every session between two computers is encrypted end to end with the Noise protocol, pinned to the device keys both sides saved at pairing time. Only the two computers hold the session keys; neither the local network nor the relay can decrypt what passes between them.

• Input events carry sequence numbers with independent replay windows per process session, so a restart never weakens replay protection.
• Large messages such as clipboard images are chunked inside the encrypted stream and capped at 64 MiB.
• Screen frames for Remote preview travel inside the same encrypted channel.

Groups and removal

A computer belongs to at most one group. Membership is decided by the members: any member can approve a new computer on the local network, and every member accepts additions and removals from any other member. That also means a compromised member could add or remove computers, which is exactly why removal is quick and final.

Remove from group records a permanent ban for that device key. Members exchange and keep these bans, and a banned key is never accepted as a member again, even if someone tries to re-add it. The removed computer gets a new key automatically and can come back only by asking to join again on the local network, where a member has to approve it. No reinstall is involved. Bans cannot be undone by manipulating clocks or flooding the group with fake removals; received timestamps are clamped and the list is bounded.

The group's transport secret is not rotated on removal. If you believe a removed computer was fully compromised, create a new group; that is the only way to revoke the old secret entirely.

Internet relay: optional and off by default

Internet fallback is one setting for the whole group and is off for every new group. When it is on, computers that cannot reach each other on the local network connect through our encrypted relay. The local network is always tried first. No account and no server enrollment are involved.

The relay checks that a computer holds its device key and can prove membership of a group with a signature derived from the group secret. It knows a group only by a hash. Two computers see each other through the relay only when both are in the same group and each lists the other as a member. Only computers first approved on the local network can find each other there.

Allow preview over the Internet is a separate, group-wide switch. Screen frames never leave the local network unless you turn it on, and even then they stay end-to-end encrypted.

Data handling

• Clipboard and screen content are never written to disk by Input Portal. They exist only in memory while they are being transferred or shown.
• Video is silent and ephemeral. Remote preview shows frames; it does not record.
• No telemetry. The app has no analytics, crash reporting, or usage tracking. Its only network peers are your computers and, if enabled, the relay.
• Locked screens are respected. If the operating system refuses input while the screen is locked, the input is discarded, never queued.
• Interrupted sessions release keys. If a connection drops, any keys or mouse buttons it left held are released on the receiving computer.

Operating-system permissions

Input Portal asks only for what a platform requires to move the pointer, type, find other computers, and, if you use Remote preview, capture the screen. It never tries to bypass the login or secure-desktop screens.

Known limitations of the technical preview

We would rather tell you than have you find out. Current limitations of version 0.1.30:

• Windows builds are not code-signed yet; macOS builds are Developer ID-signed but not yet notarized for broad distribution. Check the checksums on the download page.
• On Windows, the device identity is stored in Roaming AppData. Moving it to non-roaming storage protected with DPAPI is planned before managed deployments.
• The group secret is not rotated when a member is removed. Create a new group if a removed computer may have been compromised.

Reporting a vulnerability

If you find a security problem, please tell us privately first. Email support@inputportal.app with the steps to reproduce it and the version you tested. Our contact details are also published at /.well-known/security.txt. We confirm receipt, work on a fix, and credit you if you wish once it ships.