What it is for

You want to reach your parents' computer or your own second computer remotely — without paying anything. With BrowserDesk Free you get your own access for three devices and one session at a time. This quick start takes you through it in four steps; each step points to the detailed guide.

What you need

• An e-mail address.
• The devices you want to reach: Windows, macOS or Linux.
• To control them: BrowserDesk on your computer, phone or tablet — or a browser.
• Important: Free is only for private use and for testing.

How to do it

1. Create an access — on browserdesk.de/en/preise/?modell=free enter your name and e-mail, open the link from the e-mail, set a username and password. At the end you see the ID for your devices. In detail: A2.
2. Install BrowserDesk on the devices you want to reach — and on your own. In detail: C1.
3. Add the devices to your access — in the program under Einstellungen › Fernzugriff (Settings > Remote access) sign in in the card Zugang (Access) and choose Dieses Gerät hinzufügen (Add this device), or more conveniently with a one-time code from a device that is already signed in. Every added device takes one of the three seats. In detail: C2.
4. Connect — and do so from within your access: your own BrowserDesk is signed in to your access (as a device or with Nur von hier aus steuern (Only control from here), see C2), or you sign in in the browser in the card "My devices" (D4). Then connect with the device's ID and its password (D2). Someone at the device must click Erlauben (Allow) (F1).

How you know it worked

You see the other device's screen in a window of its own and can use mouse and keyboard.

Good to know

• In Free the person at the device confirms every session. Unattended access (nobody sitting in front of it) is not part of Free — for that you need the cloud (Q2).
• Quick code in Free too: with Quick Support without installation (D1) you can also help a computer that is not in your access. Here too the person at the device confirms the session.
• The devices of your Free access can only be controlled from your access — anyone who merely learns ID and password does not get in.
• Swapping seats: if you take a device out of the access, its seat becomes free — at most three releases in 30 days.
• If you need more: A1 compares Free, cloud and own relay.

If it does not work

What it is for

Your company wants to look after the computers of employees or customers remotely — without running a server. With the cloud the relay runs at BrowserDesk on browserdesk.de; you get your own access with console, device list and permissions. This quick start shows the order; each step points to the detailed guide.

What you need

• A business, a public authority or an association (paid options exist only for these).
• An idea of how many devices you look after or how many technicians work at the same time — the price calculator takes the cheaper billing (A1).
• The devices: Windows, macOS or Linux; controlling also works from a phone, tablet or in the browser.

How to do it

1. Check the option — cloud, or your own relay after all? A1 answers that in a few questions.
2. Buy — online by card (A3) or on invoice (A4). While doing so you choose the name of your access; afterwards the link for setting up the administrator account arrives by e-mail.
3. Open the console — sign in to the console on browserdesk.de with the administrator account. There you see your access, and later the devices, users and settings.
4. Install BrowserDesk — on every device you want to look after (C1).
5. Bring the devices into the access (C2): - one by one: sign in on the device and choose Dieses Gerät hinzufügen (Add this device), or use a one-time code; - many at once: create a distribution key in the console and pass it along at installation (MSI, group policy, Intune, script).
6. Connect technicians — with ID and password (D2), from "My devices" or in the browser without installation (D4). Spontaneous help with a quick code (D1) works for devices in your access and for strangers' computers.

How you know it worked

In the console your devices appear in the device list with their status. After connecting, a technician sees the device's screen.

Good to know

• Unattended access — connecting without anyone at the device agreeing — is part of the cloud. Whether the device still asks is something you set as administrator.
• Devices outside your access count as Free on browserdesk.de: quick code yes, but every session must be confirmed at the device. So add devices you look after regularly to your access.
• Add-ons such as control room, ticket system, start center and remote console are booked on top (A1); extended inventory is only available with your own relay.
• Your connection data is on BrowserDesk's relay. If it should stay in-house: Q3.

If it does not work

What it is for

Your connection data should not leave your premises, or your network has no internet at all. Then you run the relay yourself: it brokers the connections, provides the console and browser access and runs on your server. The programs on the devices are the same as in the cloud — they just point to your relay.

What you need

• A server: Docker (Linux, amd64 or arm64), Linux without Docker (Ubuntu 22.04/24.04, Debian 12) or Windows Server 2019 or later (MSI).
• A name in DNS and a certificate if devices are to connect from outside.
• Open ports as listed in the installation guide.
• Someone to look after the server: updates and backups are your job.

How to do it

1. Check the option — is your own relay really right? A1.
2. Install the relay — depending on the server: Docker, Linux or Windows MSI. Afterwards your relay's console is up.
3. Try it without a licence — without a licence the relay runs for 30 days with up to 5 devices, after that permanently with 2.
4. Buy and install the licence — with or without internet at the relay (A5).
5. Install BrowserDesk on the devices (C1) and point them to your relay: either via your relay's download or by changing the relay address in the program (guide).
6. Bring the devices into your access (C2) — for many devices with a distribution key at installation.
7. Connect — with ID and password (D2), in the browser via your relay's address (D4) or spontaneously with a quick code (D1), which works for any computer with your own relay.

How you know it worked

Your relay's console shows the active licence under Licenses, and your devices are in the device list.

Good to know

• Only browserdesk.de issues licences. With internet the licence confirms itself every 30 days; without internet once a year via a request and activation code (A5).
• Extended inventory is only available with your own relay.
• You keep several customers on one relay apart with separate accesses.
• More guides for operation (updating, logs, network): Knowledge Base.

If it does not work

What it is for

Before you order, settle three things: who runs the relay (BrowserDesk or you), how you are billed (per device or per technician) and which add-ons you need. This page walks you through six questions and ends with the right order. Amounts are only shown in the price calculator at browserdesk.de/en/preise — it calculates with your numbers.

What you need

• A rough number: how many devices do you want to look after, and how many people work with them at the same time?
• For your own relay: a server (Docker, Windows or Linux) and the answer to "does it have internet access?".
• For paid plans: a business, public authority or association — orders need the tick I am ordering for a business, public authority or association.

How to do it

1. For whom? Private use or testing, a few devices → Free. For a business, public authority or association → continue with 2.
2. Where should the relay run? - At BrowserDesk → Cloud via browserdesk.de. You only install the program on your devices. - On your own server → Your own relay. The data stays in-house; in return you run the server yourself (installation, domain, updates, backup — see Install your own relay).
3. Does your relay have internet access? (own relay only) The calculator asks Does your relay have internet access?: - Yes: the licence confirms itself with browserdesk.de every 30 days, with 14 days of grace. You do nothing. - No, isolated network: you renew the licence once a year with a request code — the relay itself needs no internet for that. The first installation works the same way (A5).
4. Per device or per technician? You do not have to choose: the calculator works out both billing methods for your numbers and automatically takes the cheaper one. - Per device: you pay for every device you look after, technicians unlimited. If more devices are registered than purchased, the ones registered first stay reachable. - Per technician: you pay for every person working at the same time, devices unlimited. Pays off when a few people look after many devices.
5. Which add-ons? (cloud and own relay only, see table below)
6. Term and payment: cloud always 12 months; own relay 1 year, 2 years or 3 years at the same yearly price (price lock). Payment is in advance, Pay online via Stripe or On invoice. There is no automatic renewal.

What "concurrent technician" means

• A technician is any person who is currently controlling at least one device with BrowserDesk. Whoever is not connected does not count: ten colleagues of whom at most three work at once need three technicians.
• Counting happens when a session starts. A running session is never cut off because the number is reached — the next one waits until one ends.
• Signed in (user account, or a computer that has joined your access or relay), a person counts as one technician, even with up to three sessions at once and, on your own relay, up to nine views in the control room.
• Not signed in, every session counts as a technician of its own, in the control room every tile.
• Spontaneous support: per device, every device you help takes a seat until you remove it. Per technician, devices do not count.

Add-ons in one sentence

Start center and remote console are bought for a number of devices: a device takes its seat on first use, and the seat stays with that device.

How you know it worked

You know the model, billing, add-ons and payment method — and the link in the table takes you straight to the right step of the calculator. Under How many devices and technicians? it shows which billing is cheaper for you.

Good to know

What Free can — and cannot — do:

• Your own access at browserdesk.de, free of charge and without a time limit, for private use or testing only.
• 3 devices as seats. A device keeps its seat until you release it in the management console. So that nobody swaps seats in rotation, there is a swap brake: at most three releases in 30 days.
• One session at a time, each confirmed on the device — Free has no access without confirmation.
• Random name: we assign the name of the access at random (for example fuchs-48213), so that nobody can pose as a company or a person with a free address.
• Free devices can only be controlled from devices signed in to your access.
• Not in Free: control room, inventory, recording, ticket system, start center, remote console, USB redirection.

More:

• The cloud has no extended inventory; it is only available with your own relay.
• If a promotion is running, the calculator shows it with its conditions. Promotions cannot be combined.
• Your own relay only accepts a licence per technician from a certain version on; the calculator names it.
• Without a licence, your own relay runs a 30-day trial with up to 5 devices, then permanently with 2 (A5).
• More devices or technicians in the middle of the term: there is no separate flow for that yet — write to info@browserdesk.de. For a cloud access you can also use Choose cloud → Existing access (A7).

If it does not work

The relay's messages are in German; the English meaning is in brackets.

What it is for

You want to use BrowserDesk privately — for the family's computers, say. With Free you get your own access at browserdesk.de at no cost. You register your devices in it, and only devices from your access can control them. It takes a few minutes: form, e-mail, choose your sign-in.

What you need

• An e-mail address you can read. There is one Free access per address.
• Private use or testing. Businesses, public authorities and associations use the cloud (A1).
• Later, the BrowserDesk program on each device (C1).

How to do it

1. Open browserdesk.de/en/preise/?modell=free — or click Start for free on the website, or Choose Free on the Free card.
2. In the step Your Free access enter your name and e-mail address.
3. Set both ticks: I use BrowserDesk Free privately or for testing. and the acceptance of the licence agreement and terms of use.
4. Click Request link. The page shows "Link sent" and the next steps.
5. Open the e-mail "BrowserDesk Free — please set up your access" and click Set up access →. The link is valid for 48 hours.
6. The page Set up your Free access opens. We assign the name of the access at random — you do not choose it. Enter: - Username - Password and Repeat password — the minimum length is shown below the fields. The password is never sent by e-mail; keep it safe.
7. Click Create access.
8. The page shows Done with the address, the username and the ID for your devices. Copy copies address and ID; Sign in opens the management console of your access.
9. Add devices: install BrowserDesk on the device, then in the program under Einstellungen (Settings) → Fernzugriff (Remote access) enter the ID, your username and your password, click Beitreten (Join) and choose Dieses Gerät hinzufügen (Add this device) in the window that follows. Details and the one-time code: C2.

How you know it worked

• The page shows Done, and you receive the e-mail "BrowserDesk — your access … is ready" with address, ID, sign-in address and username.
• At the sign-in address (https://<ID>.browserdesk.de/admin) you sign in with username and password.
• Added devices appear there in the device list.

Good to know

• 3 seats: every added device takes a seat until you release it in the management console — at most three releases in 30 days. Your own computer that you only control from needs no seat: after Beitreten choose Nur von hier aus steuern (Only control from here).
• One session at a time, and the person at the device confirms each one.
• No access password: unlike the cloud, Free has no shared password for the devices. Devices get in with your username and password or with a one-time code.
• Your devices can only be controlled from devices signed in to your access — a device's ID and password alone are not enough. That protects against callers who "just need the number".
• The access only comes into being with Create access. Until then you can open the link several times.
• Requesting a new link for the same address makes the old one invalid.
• We store your name, e-mail address and the IP address of the request — for your access and against abuse.
• More devices or sessions: Move from Free to cloud.

If it does not work

What it is for

Your company wants to use BrowserDesk without running a server of its own. With cloud via browserdesk.de you get your own access at <name>.browserdesk.de. You choose the name when ordering, pay online and set up the access via a link from the e-mail — then your devices join.

What you need

• A business, public authority or association (paid licences are only for these).
• The number of devices and the number of technicians working at the same time (A1).
• A payment method offered by Stripe — such as card, PayPal or Apple Pay.

How to do it

1. Open browserdesk.de/en/preise/?modell=cloud — or Choose cloud on /en/preise/.
2. Under For which access? leave New access selected and type your preferred name under Name of your new access: 3 to 40 characters, lower-case letters, digits and hyphens. "Praxis Müller" becomes praxis-mueller. Below the field you see straight away whether the name is available.
3. Enter How many devices do you look after? and How many technicians work at the same time?. The calculator shows both billing methods and takes the cheaper one.
4. If you like: under Features Control room or Ticket system (per access and year), under Add-on modules per device Start center or Remote console with the number of devices (one-time).
5. Click Continue to your details.
6. In the step Who is ordering, and how will you pay? fill in company, contact person, e-mail address and postal address, and set the ticks I am ordering for a business, public authority or association. and the acceptance of the licence agreement.
7. Under How would you like to pay? choose Pay online and click Place binding order and pay.
8. You are taken to Stripe. There you see the amount including VAT and pay.
9. Stripe sends you back to What happens now: "Payment received — order …".
10. Open the e-mail "BrowserDesk — set up the access for your cloud licence" and click Set up access →. The link is valid for 7 days.
11. On Set up your access your name is already fixed. Enter Username, Password, Repeat password and the Access password for your devices — a different one from your password, because it is given to every device. Then Create access.
12. Add devices: install BrowserDesk, in the program under Einstellungen (Settings) → Fernzugriff (Remote access) enter the ID and the access password (leave the user empty), Beitreten (Join), then Dieses Gerät hinzufügen (Add this device). Many devices at once: C3.

How you know it worked

• Two e-mails: "BrowserDesk — payment received, order …" — this is your order confirmation, it concludes the contract — and the e-mail with the set-up link.
• After Create access the page shows Done with address, username and ID for your devices; the e-mail "BrowserDesk — your access … is ready" follows.
• Sign in opens the management console at https://<name>.browserdesk.de/admin (B1).

Good to know

• The name is reserved as soon as you order, and it cannot be changed later.
• Term 12 months, paid in advance, no automatic renewal (A7).
• You can change the access password later in the management console. It is never sent by e-mail, and neither is your password.
• One order can hold several items (Add another licence); a cloud licence applies to exactly one access.
• More devices or longer for an access you already have: choose Existing access, enter its name and the new total. After payment we check that the access belongs to you, activate it and send "BrowserDesk — your cloud licence for … is active" (A7).
• Prefer an invoice? A4. Just a quote? Just request a quote by email.

If it does not work

What it is for

Your purchasing department prefers a bank transfer to a card. On invoice you order cloud or your own relay just like online — except that the contract comes about with our order confirmation and you pay in advance. Once your payment has arrived, you receive what you ordered.

What you need

• A business, public authority or association.
• Billing address, optionally a VAT ID.
• For cloud the name of the new access or of your existing access (A3); for your own relay the answer to Does your relay have internet access? (A5).

How to do it

1. Put together what you need on browserdesk.de/en/preise as for an online order (A3 for cloud, A5 for your own relay) and click Continue to your details.
2. In the step Who is ordering, and how will you pay? fill in company, contact person, e-mail address and postal address, and set the ticks I am ordering for a business, public authority or association. and licence agreement.
3. Under How would you like to pay? choose On invoice and click Place binding order.
4. The page What happens now shows your order number and the next steps. Note the number.
5. Wait for the order confirmation and invoice by e-mail.
6. Transfer the invoice amount.
7. Once your payment has arrived, what you ordered comes by e-mail (table below).

How you know it worked

• The acknowledgement of receipt lists order number, items, net total and — for a new cloud access — the name with "(reserved)".
• In the end you hold the licence file, or your access is set up or activated.

Good to know

• The name of a new cloud access stays reserved for you until it is set up.
• Prices are net. The invoice states the amount including VAT.
• No automatic renewal — you order the renewal yourself (A7).
• If the total falls below the minimum for online payment (for example because of a promotion), the order always goes on invoice.
• A quote first? Just request a quote by email — contact person and e-mail address are enough. You receive "BrowserDesk — your quote request … has been received" and then the quote. You can then order on the page or by replying to the e-mail.

If it does not work

What it is for

You run your own relay. To go beyond the trial, it needs a licence file from browserdesk.de. You buy it in the price calculator, receive it by e-mail and install it in your relay's console. In doing so, the licence binds itself once to your installation — automatically with internet, with a request code without internet.

What you need

• An installed relay (B2) and a console account with the role system administrator.
• A business, public authority or association as the buyer.
• The answer to: does the relay have internet access?

How to do it

Buy

1. Open browserdesk.de/en/preise/?modell=relay — or, in your relay's console under Licenses, the button Buy a licence.
2. Enter How many devices do you look after? and How many technicians work at the same time?; the calculator takes the cheaper billing method.
3. Choose the Term: 1 year, 2 years or 3 years, always at the same yearly price.
4. If you like: Extended inventory, Control room, Ticket system and the add-on modules Start center and Remote console.
5. Answer Does your relay have internet access? with Yes or No, isolated network. This decides how the licence confirms itself later (see "Good to know").
6. Continue to your details, fill in your details and pay — online as in A3 from step 6, or on invoice as in A4.
7. The licence file arrives in a separate e-mail "Your BrowserDesk relay licence" — online right after payment, on invoice once your payment has arrived. Save the attachment browserdesk-relay.lic.

Install with internet

1. Open your relay's console → Licenses → Install licence.
2. Step File: choose the licence file, Next. It is only checked at first.
3. Step Check: look at licensee, devices or technicians, term and functions. If everything is right: Next.
4. Step Connection: leave Activate online selected and click Install licence. The relay briefly contacts the licensing authority.
5. The assistant shows "Licence active until …".

Install without internet

1. As above up to step Connection; there choose This relay has no internet access and click Install licence. The licence is now pending.
2. Step Without internet: the request code is in the field. Send by e-mail opens an e-mail to info@browserdesk.de with the code and the licence number — or use Copy request code and send it from another computer.
3. The reply contains an activation code. Paste it into the activation code field and click Enable.
4. If you have closed the assistant in the meantime: below the licence status there is a note with Continue activation — it takes you straight to this step.

How you know it worked

• The assistant ends with "Licence active until …" (or Licence active).
• Under Licenses the operating mode reads "Licensed", together with licensee, devices or technicians, "Valid until" and "✓ bound to this installation".

Good to know

• Trial without a licence: a new relay runs for 30 days with up to 5 devices. After that, without a licence, 2 devices remain permanently — the ones registered first, for private use only; business use needs a licence after the trial. The console shows this as Trial mode (no licence) with the end date.
• With internet the licence confirms itself with browserdesk.de every 30 days, with 14 days of grace. Without internet you renew it once a year with a request code. The line Licence check shows when it is due and when the block starts; Check now confirms immediately.
• One installation per licence. After installation the relay keeps running without internet. When moving to another server, the activation must be released at browserdesk.de (B8).
• After expiry the relay keeps running for the grace period stated in the licence (line "Grace period"). After that, operation stops until a valid licence is installed (A7).
• Try functions: under Functions of the licence every additional function can be tried once per installation with Try for 10 days; Buy more leads to the price calculator (A6).
• A licence per technician is only accepted by a relay from a certain version on — the calculator and the licence e-mail name it. Update the relay first (B8).
• A pending licence changes nothing about the running operation until the activation code is installed. Pending by mistake: Discard pending licence.
• In detail for operators: Install the relay licence (German).

If it does not work

Messages from the relay's server are in German; the English meaning is in brackets.

What it is for

You can add things to your cloud licence or to the licence for your own relay:

• Add-on modules — Start Center and remote console. You buy them once per device. Every device that uses an add-on module takes a seat.
• Functions — control room and ticket system: in the cloud per access and year, with your own relay per relay and year in the licence. With your own relay there is also the inventory (per device and year).

This page shows where to buy more and how seats work. Prices are on /en/preise/.

What you need

• Cloud: an access with a paid cloud licence. BrowserDesk Free has neither add-on modules nor control room or ticket system.
• Own relay: a running licence, its licence number and the e-mail address it was issued to. Both are in the licence e-mail; the number is also in the console under Licenses.

How to do it

Buy more add-on modules (Start Center, remote console)

1. Open /en/preise/ and choose Buy add-on modules. With your own relay you can also start from the console: Licenses → section Add-on modules → Buy more seats.
2. Under What are you buying for? choose: - Your own relay — then enter the Licence no. - Cloud via browserdesk.de — then enter Your access.
3. Enter the number of devices per module. Order as usual — online or on invoice (A3, A4).
4. Afterwards: - Cloud: the seats are available for your access; the confirmation arrives by e-mail. - Own relay: you get a replacement licence with the same term and the additional seats. In the console Licenses → Install licence (A5). It is activated again. This ends the old licence. The new one can only be activated on the same relay on which the old one was active.

Book control room or ticket system (cloud)

1. On /en/preise/ choose Book a function for your access.
2. Under Which function, for which access? choose Control room or Ticket system and enter Your access.
3. Order. The function is valid for 12 months from activation; if it is already running, the booking continues from its end.

With your own relay, control room, ticket system and inventory are part of the licence. You extend the licence when renewing (A7) or ask by e-mail at info@browserdesk.de.

See what your access has

Console → Tenants → double-click the access (Edit tenant) → tab Features. In the console the access is called tenant. For each function it shows whether it is booked, where it comes from and how many seats are taken. More: G4.

With your own relay the console additionally shows Functions of the licence and Add-on modules under Licenses, with bought, taken and free seats.

How you know it worked

• The confirmation e-mail.
• The tab Features shows the function as booked; for add-on modules the new number of seats.
• On the device the menu item Startcenter (Start Center) is no longer locked (F8).

Good to know

How a seat is tied to a device

• A device only takes a seat when it uses the module: the remote console when it is first opened, the Start Center on the first click on a start button. Or you assign the seat in the console (G24).
• The seat stays fixed to that device. You cannot move it to another device.
• It only becomes free when you delete the device (in the cloud also via Free up place in the device list).
• Deletion brake: so that "delete and sign in again" does not become a swap, only the first deletions within 30 days free the seat at once — at least 3, with many seats 10 % of them. Every further one keeps the seat locked until the 30 days are over. If the same device comes back, it gets its old seat again. The console shows the state, for example "Deletion brake: 2 of 3 releases by deletion used in the last 30 days."
• Scope: in the cloud the seats apply per access. With your own relay they apply to the whole relay; all tenants share them.
• Bought once means: the seats carry over when you renew, without buying them again. They only work while your licence or your cloud licence is running.

Places of the access (devices)

This is something else: every device you add to the access takes a place in the access (C2). More devices in the access: A7.

If it does not work

What it is for

BrowserDesk licences are paid in advance: the cloud for 12 months, your own relay for 12, 24 or 36 months. There is no automatic renewal. This page shows how to renew, how to get more devices or technicians and how you notice the end in time. Prices are on /en/preise/.

What you need

• Cloud: the name of your access (for example praxis-mueller) and the e-mail address you ordered it with.
• Own relay: the licence number and the e-mail address the licence was issued to. Both are in the licence e-mail; the number is also in the console under Licenses.

How to do it

Cloud: renew or more devices

1. Open /en/preise/ and click Choose cloud.
2. Under For which access? choose Existing access and enter Your access.
3. Renew: enter the e-mail address of your order under Renewing? Email address of your order and click Look up renewal. The calculator is filled in; booked functions such as control room or ticket system are preselected.
4. More devices or technicians: enter the new total — not just the additional ones.
5. Order as usual — online or on invoice (A3, A4).
6. Afterwards it says: "We activate the purchased devices for your access and let you know by email." This does not happen by itself at once: we check that the access is yours and then activate it.

Own relay: renew or extend the licence

1. Open /en/preise/ and choose Renew licence. Or from your relay's console: Licenses → Renew licence — then the licence number is already filled in.
2. Under Which licence are you renewing? enter Licence no. and Email address of the licence, then Look up licence.
3. The calculator is filled in with your current scope. If you want to extend, change the numbers.
4. Order. The new licence file arrives by e-mail.
5. In the console Licenses → Install licence (A5).

How you know it worked

• Cloud: the e-mail that your cloud licence for the access is active. The console shows the new number and the new end date.
• Own relay: the console shows the new "valid until" and the new scope under Licenses.

Good to know

• The renewal continues from the end. If you renew before the end you lose no days: the new term starts where the old one ends.
• Bought seats of add-on modules carry over — you do not buy them again (A6).
• More devices or technicians in the middle of the term: the website does not name a separate process for this yet. Write to info@browserdesk.de stating which access or licence.
• Devices above the bought number do not get in. The devices added first count.

Reminder before the end

BrowserDesk can send an e-mail 30 days and 7 days before the end — with a link to renew right away. It goes to the address of the licence or of the access's order. Whether these reminders are being sent at the moment is not promised. Keep the end date in mind yourself. It is in the licence e-mail and in the console.

What happens after the end: A9.

If it does not work

What it is for

You started with Free and now need more — or you use the cloud and want to move to your own relay. For neither switch is there a dedicated process yet that does everything at once. This page says honestly what works today.

Which variant suits you: A1.

What you need

• The name of your access (for example fuchs-48213).
• For the move to your own relay: a relay licence (A5) and a server (B2).

How to do it

From Free to cloud

1. Open /en/preise/ and click Choose cloud.
2. Under For which access? choose Existing access and enter Your access — the name of your Free access.
3. Enter devices or technicians and order (A3).
4. After payment we check by hand that the access belongs to you and assign the cloud licence to it. Then you get an e-mail.

From the cloud (or Free) to your own relay

A move "at the push of a button" is missing. You set up your own relay from scratch and bring the devices over one by one:

1. Buy a relay licence (A5) and install the relay (B2).
2. Create an access on your own relay. In the console the access is called tenant.
3. On every device change the relay address to your own relay (C6, guide /kb/relay-adresse-aendern/). If BrowserDesk runs as a service, the service follows.
4. Add every device to the new access (C2). For many devices: C3.
5. Set up settings, users, scripts, start buttons and workflows again on your own relay.

How you know it worked

• Free to cloud: the e-mail that your cloud licence for the access is active. The devices then no longer have to have sessions confirmed at the device (depending on the access's settings).
• Move: the devices are listed in your own relay's console under Devices.

Good to know

• What does not come along when moving: there is no export of a whole access. Settings, scripts, tickets, start buttons, users and history stay in the old access. For your records the console has CSV exports, for example for devices, sessions, audit log and tickets (G17).
• The old access remains until it expires or is deleted. When the cloud licence ends, Free applies there (A9). To have it deleted completely: A11.
• Bought seats of add-on modules belong to the cloud or to the relay licence. They do not move along automatically. Ask by e-mail beforehand.
• Moving devices without touching the device is not possible: every device needs the new relay address (C6).

If it does not work

What it is for

Your licence ends on a fixed day. If you do not renew in time, something changes — in the cloud differently from your own relay. This page says exactly what happens, so that you can renew in time (A7).

What you need

• The end date of your licence. It is in the licence e-mail and in the console.

How to do it

Cloud: what happens the day after the end

If the cloud licence ends and has not been renewed, Free applies to your access:

• Your data stays. Devices, users, settings, scripts and tickets are not deleted. Only the limits of Free apply.
• Only as many devices as in Free. The devices added first stay. Devices above that are disconnected within about 5 minutes. If a session is running on one of them, it may run to its end. That device does not accept a new one.
• Every session has to be confirmed at the device. No more unattended access.
• One session at a time.
• The cloud services are gone, for example scripts, Start Center, remote console, control room, tickets. What is stored stays stored.

If you renew afterwards, your cloud licence applies again. Bought seats of add-on modules are then back as well.

Own relay: what happens after the end

1. Grace period: after the end date everything keeps running. The console warns. How long is stated in your licence; if nothing is stated there, it is 5 days.
2. After the grace period nothing runs any more. The relay accepts no devices and no sessions. Running sessions are disconnected too — within about one minute. There is no fallback to a small free mode.
3. The console then says: "Die Relay-Lizenz ist am … abgelaufen, die Kulanz endete am …. Bis eine gültige Lizenz eingespielt ist, nimmt dieser Relay keine Geräte und keine Sitzungen mehr an." (The relay licence expired on …, the grace period ended on …. Until a valid licence is installed, this relay accepts no devices and no sessions.)
4. Install a new licence (A5) — then everything runs again.

Recurring check: some licences confirm themselves regularly with browserdesk.de — with internet automatically, without internet by request code. If this confirmation is missing for longer than the check interval plus grace period, the relay stops in the same way. The grace period for this is 14 days by default. The console then says how to run the check now.

Non-payment

• Payment is in advance. Online, payment is done before activation. On invoice we usually activate only once the money has arrived.
• What happens if an already activated order is not paid is not described as a separate process. If in doubt, ask info@browserdesk.de.

How you know it worked

There is nothing to do here. You can see the state:

• Cloud: in the console on the access (term, plan).
• Own relay: in the console under Licenses — with end date and grace period.

Good to know

• A reminder e-mail 30 and 7 days before is possible but not promised (A7).
• Free after expiry is not a cancellation: the access remains. Deletion: A11.
• How to get more devices or a longer term afterwards: A7.

If it does not work

What it is for

Your accounts department needs the invoice, or you want to check what you ordered. There is no customer area where you can download invoices yet. Everything arrives by e-mail. This page says which e-mails these are and how to get a missing invoice.

What you need

• The order number. It is shown on the page after ordering and in every e-mail about the order.
• The mailbox of the e-mail address you gave when ordering.

How to do it

Paid online

1. After payment the e-mail "BrowserDesk — payment received, order …" arrives. It is your order confirmation.
2. The invoice is created by the payment service Stripe after payment. It carries your order number as an extra field. Search your mailbox for the order number. If you find no invoice, write to us (below).
3. The invoice names the recipient as you entered it at Stripe.

Ordered on invoice

1. After ordering the page says: "Order confirmation and invoice arrive by email."
2. We write the invoice by hand and send it by e-mail. The order confirmation concludes the contract.
3. You transfer the invoice amount in advance. Then the licence file or the activation follows.

An invoice is missing or wrong

Write to info@browserdesk.de — with your order number and what is missing or wrong (for example address or VAT ID). A way to download the invoice again yourself is still missing.

How you know it worked

You have the invoice with your order number as a PDF or e-mail.

Good to know

• Keep the order number. It connects payment, invoice, licence and access. We will ask for it.
• Licence e-mail and invoice are separate. The licence file (own relay) or the set-up link (cloud) arrives in its own e-mail.
• You can also see what you booked in the console: with your own relay under Licenses, in the cloud in the tab Features of your access (A6).
• Prices on the page are net. The invoice states the amount including VAT; online, Stripe shows it before you pay.

If it does not work

What it is for

You do not want to use BrowserDesk any more. Good news: there is no subscription. You pay each term in advance, and there is no automatic renewal. If you do not renew, you pay nothing more. This page says what happens afterwards and how to have an access deleted completely.

What you need

• The name of your access or your licence number, and your order number.

How to do it

Simply do not renew

1. You do nothing. At the end of the term the licence ends by itself.
2. What happens then is in A9: - Cloud: your access falls back to Free. The data stays, limits apply. - Own relay: after the grace period your relay accepts nothing more.

Cancel

• The terms of use name in section 10 a cancellation with 30 days' notice to the end of a month (terms of use). How this notice period fits a term paid in advance without a subscription has not been clarified yet.
• If you want to cancel explicitly, write to info@browserdesk.de — with access or licence number and order number.

Have an access deleted completely (cloud)

An access with all devices, users, settings, tickets and logs can be deleted completely. Only the relay's operator may do that. For an access on browserdesk.de:

1. Write to info@browserdesk.de that the access should be deleted — with its name.
2. Do you need data beforehand? Download CSV exports from the console, for example for devices, sessions, audit log and tickets (G17). Or say in the e-mail which data you need.

With your own relay you delete it yourself: the system administrator can do that there (G23).

Clean up the devices

Remove BrowserDesk from the computers: C8.

How you know it worked

• Not renewed: after the end date no further invoice arrives.
• Deleted: the access can no longer be reached; signing in to its console no longer works.

Good to know

• Money back: you will not find a rule for refunds or withdrawal on the website. The offer is aimed at businesses, public authorities and associations. Ask in individual cases at info@browserdesk.de.
• After the end we delete your data according to the terms of use, unless there is a duty to keep it; on request we provide it beforehand.
• Backups can still contain deleted data for a while until they rotate out.
• Free costs nothing and has no end. Deletion works as above.

If it does not work

What it is for

Your purchasing department or your data protection officer needs documents before BrowserDesk is used. This page says where you find which evidence and what you have to request.

What you need

• A browser. The texts are public on browserdesk.de.
• For the data processing agreement: an e-mail to info@browserdesk.de.

How to do it

At a glance

Conclude the data processing agreement

1. Read /en/dpa.html.
2. Write to info@browserdesk.de that you want to conclude the agreement — with company and access.
3. It applies with our confirmation. If you want a signed copy, say so in the e-mail.

View third-party licences

• In the program: Einstellungen › Allgemein (Settings > General) → card Rechtliches (Legal) → next to "Open-Source-Lizenzen" (open-source licences) click Anzeigen (Show). The licence agreement is there too, with Im Browser öffnen (Open in browser).
• In the relay: the package, the Windows installation and the Docker image contain the file LIZENZEN-DRITTER.txt.

Software bill of materials and security check

For every version a software bill of materials (SBOM in CycloneDX format) and a check for known vulnerabilities are produced. There is no public download for them on the website. Ask for them for your version at info@browserdesk.de.

How you know it worked

• DPA: our confirmation by e-mail.
• For your records: the privacy notice and the DPA state their date at the top. Note it down.

Good to know

• Date of the texts: the privacy notice and the DPA state their date at the top. If we change sub-processors, we announce it beforehand as the DPA says.
• Own relay: the data stays on your systems. Only our update feed remains reachable. For your own documentation B9 helps.
• Your organisation's questionnaire: according to the DPA we answer a questionnaire on the measures on request.
• What BrowserDesk stores and who sees what — in plain language: F10.

If it does not work

What it is for

The console is BrowserDesk's administration in your browser. There you see your devices, sessions and tickets and set everything up. This page guides you through the first sign-in and shows where things are.

What you need

• An up-to-date browser.
• The address of your console: the address of your relay with /admin at the end. For an access on browserdesk.de, the button Sign in at the end of the setup takes you there (A2, A3). With your own relay it is the address of your server.
• Your username and password (chosen by you during setup).

How to do it

1. Sign in

1. Open the console's address. You see "Relay administration — please sign in".
2. At the top you can choose the language: DE or EN.
3. Enter Username and Password, then click Sign in.
4. If you have set up a second factor, the field Code from the authenticator app appears next. Enter the six-digit code from the app.
5. If your operator has set up a company sign-in, there is also Sign in with SSO.
6. No account yet? On the right under New around here?, Create account leads to the order — Free is set up in a few minutes (A2).

2. The layout at a glance

• On the left the sidebar with all areas, grouped by task.
• At the top the header with the search field Find anything …, the relay version, the light/dark switch, Refresh and on the right your account circle.
• In the middle the chosen view. After signing in this is the Overview.

3. The sidebar

What you see depends on your role. The console hides what your role may not do:

• Users, Billing and Licenses are only visible to the relay's system administrator. Orders only exists on browserdesk.de itself.
• Scripts & packages and Data pools are available from the technician role, Start Center from the tenant administrator role.
• In Settings, everyone with access sees Relay status; Four-eyes approvals and Audit log are available from supervisor; everything else only for the system administrator.

A click on Settings replaces the sidebar with the settings menu. Back takes you out again.

4. The overview

• At the top tiles: tenants, devices in total, online, active sessions, open alerts and the licence. A click leads to the matching view.
• Below that Needs attention: everything waiting for an approval or answer from you — for example devices that were rejected when signing in (G20).
• Then four cards: Last seen, Latest sessions, Latest runs, Upcoming runs.

If there is no device yet, the overview shows Welcome to BrowserDesk with two steps instead. As administrator of an access on browserdesk.de your access already exists — add your first device right away (C2). Only the system administrator of the relay needs the button Create tenant.

5. Find anything with Ctrl+K

The search field at the top is the quickest way to everything.

1. Press Ctrl+K (Mac: ⌘+K), outside an input field also / — or click into the field Find anything ….
2. Type a few letters. It finds views, settings down to a single field, help sections and, from two characters, also devices, accesses, members, tickets, scripts, packages, workflows and start buttons.
3. Click a result or jump there with Enter. Under Actions you find commands such as "New tenant …" that open the matching dialog directly.

The search also finds devices by computer name, signed-in user and IP address. With an empty input it shows what you opened last. More in G1.

6. Your account

A click on the circle at the top right opens your account menu:

• My account
• Appearance (light or dark) and Accent color
• Language: Deutsch, English or Automatic
• Second factor: additionally secure your sign-in with an authenticator app (B4)
• Change password
• Sign out

How you know it worked

• You see the Overview with the tiles.
• Your account circle is at the top right; the account menu shows your name.

Good to know

• "Tenant" and "access" mean the same. The console mostly still says "tenant", the program on the device says "Zugang" (access).
• Where things are:

• The Devices view has three layouts: Grid (table), Cards and Dashboard. A click on a device opens its details.
• Only your browser remembers what you searched for last.

If it does not work

What it is for

With your own relay, all connections run through your server instead of browserdesk.de. There are three ways: Docker, Linux without Docker, and Windows Server with an MSI. Each way brings its own database (PostgreSQL). This page tells you which way fits, what to settle beforehand and what to do after the installation. The commands themselves are in the KB articles.

What you need

• A server, depending on the way: - Docker: a Linux server with Docker and Compose v2 (amd64 or arm64). - Linux without Docker: Ubuntu 22.04 or 24.04 or Debian 12 (x86_64) and root access. - Windows: Windows Server 2019 or newer and administrator rights. Windows 10/11 works for testing.
• A name under which devices and browsers reach the server, for example relay.company.com, and a TLS certificate for that name (for example from Let's Encrypt as a PFX file).
• Open ports inbound: 9013/tcp (devices, console and web access), 3478/udp (TURN) and 5349/tcp (TURN over TLS).
• A licence if the relay is to run for business longer than 30 days or with more than two devices (A5).

How to do it

1. Choose a way and install

2. Sign in for the first time

1. Read the start password from the file admin-password.txt: - Docker: browserdesk-relay/data/admin-password.txt (the first start takes about a minute), - Linux: /var/lib/triline/BrowserDesk/Relay/admin-password.txt, - Windows: %ProgramData%\Triline\BrowserDesk\Relay\admin-password.txt.
2. Open the console: https://<your-server>:9013/admin/. A Windows relay without a certificate is first reached at http://<your-server>:9013/admin/. With a self-signed certificate the browser shows a warning.
3. Leave the user name empty, enter the start password and sign in. This is the relay's emergency sign-in.
4. Right afterwards, create a named account with a second factor and work with it from then on (B4).

3. Set up name and certificate

• Windows: Settings → TLS certificate → choose a certificate from the Windows store → Bind. It takes effect after a relay restart.
• Linux and Docker: Settings → Configuration → section TLS certificate: enter the path of the PFX file and its password, then Save & restart relay (B3).
• Choose an RSA certificate with the “ISRG Root X1” chain. Otherwise the desktop programs fail to connect without a visible message.

4. Make it reachable from outside

1. Open the ports from “What you need” in the firewall. The Windows MSI creates the rules itself.
2. In Settings → Configuration → STUN and TURN, enter the Public IP if the relay sits behind address translation (NAT). Left empty, the relay finds it at start-up. With Docker, also put the address as PUBLIC_IP into the .env file.
3. If your firewall only allows individual ports (typical for cloud servers), set Relay ports from and Relay ports to in the same section and open that UDP range too. With 0 the operating system picks the ports.

5. Licence, accesses, devices

1. Install the licence: A5.
2. Create an access for your devices: Tenants → New tenant. In the console an access is called a tenant.
3. Switch the devices to your relay (C6) and add them to the access (C2, many at once: C3).

How you know it worked

• https://<your-server>:9013/health answers with "ok":true and the relay's version.
• You can sign in to the console; Settings → Relay status shows the version.
• A device with your relay's address appears under Devices.

Good to know

• Without a licence a new relay runs for 30 days with up to five devices, then permanently with the two devices registered first — for private use only.
• Port 443: browserdesk.de bundles everything on port 443. Your relay listens on 9013 by default. You change the port in Configuration → Server → Port (for the MSI with PORT=…). The STUN and TURN section also has the option Multiplex turns: onto the relay's own TLS port. There is no tested guide for running your own relay on 443 yet — write to info@browserdesk.de.
• No TLS proxy in front. The relay evaluates the real peer address, never a header such as X-Forwarded-For. Behind a reverse proxy that terminates TLS, sign-in throttles and trusted networks only see the proxy (B9).
• Back up the key: Docker writes a value BD_KEYRING_KEY into .env. Without it, all secrets stored in encrypted form are unreadable — keep it separately from the server (B9).
• Backup: with Docker, the data/ folder; on Linux /var/lib/triline/BrowserDesk/Relay plus pg_dump browserdesk; on Windows %ProgramData%\Triline\BrowserDesk\Relay. More in B8.
• Uninstalling on Windows removes both services but keeps the data under %ProgramData%\Triline\BrowserDesk\Relay.
• Updates: B8. Hardening: B9. Changing settings: B3.

If it does not work

What it is for

All settings of your relay are in the file relay.json. You do not have to edit it by hand: the console shows it as a form with sections. Passwords and other secrets never leave the server — you only see whether one is set.

What you need

• Your own relay from version 20260924.12 (B2).
• A console account with the system administrator role. Other roles do not see this page.

How to do it

1. In the console open Settings. Under Initial setup click Configuration.
2. Open the matching section. Among others there are:

| Section | What you set there | |---|---| | Server | port, bind address, allowed browser origins, retention of recordings, waiting viewers per address | | TLS certificate | PFX file and password; on Windows the thumbprint from the certificate store | | STUN and TURN | public IP, ports, TURN over TLS, port range for relayed media | | Self-update and mirror | relay self-update, feed address, mirror of the program feeds | | Administration and database | database connection | | Sign-in via SSO (OIDC), Provisioning via SCIM, Sign-in via LDAP / Active Directory | company sign-in for console accounts (B4) | | Device certificates (mTLS) | certificates for devices (B9) | | Email (SMTP) | the relay's mail delivery |

1. Change values. Below each field there is a hint on what it does.
2. Secrets (passwords, client secret, database connection): - leave empty = unchanged, - type new text = set anew, - tick Clear secret = empty it.
3. Click Save. Port, bind address, TLS, TURN and database need a restart — use Save & restart relay for those. Everything else applies at once.

For values without a field of their own there is Advanced: relay.json as text at the bottom. It shows the whole file, secrets as placeholders. What you save there replaces the whole file; placeholders are kept.

How you know it worked

• After Save you see “Saved. Port, TLS and TURN take effect after the next relay restart.”
• After Save & restart relay you see “Saved. Relay is restarting… (wait a moment, then reload)”. After reloading, the form shows your values.
• A secret shows “set — leave empty to keep” instead of “not set”.

Good to know

• During a restart running sessions reconnect by themselves; the viewer shows this.
• On Windows the restart from the console has not yet been tested on a real relay. If the relay does not come back, restart the BrowserDeskRelay service in the Windows services console.
• Every change lands in the audit log — with the names of the fields, never with the values.
• Secrets are stored encrypted. You must back up the key for that (B9).
• Manual edits to the file only take effect after a restart. If the file is then not valid JSON, the relay does not start and writes a copy relay.json.broken-<time>. The form checks your input beforehand.
• Form and text changed at the same time: the console asks Form or text?. The text is saved; the form changes are lost.
• The path of the file is shown under Advanced: relay.json as text.

If it does not work

What it is for

Accounts sign in to the console with a role. The role decides what the account may do. Every account can secure its sign-in with a second factor — a code from an authenticator app. On your own relay you can also connect the sign-in to your company sign-in: OIDC (for example Entra ID or Keycloak), LDAP / Active Directory or SCIM.

What you need

• Cloud: you are the administrator of your access. Every access has one administrator; further ones only with a Cloud licence, not in Free.
• Own relay: an account with the Administrator role and no restriction to accesses (system administrator).
• For the second factor an authenticator app, for example Microsoft Authenticator, Google Authenticator or Aegis.
• For OIDC, LDAP and SCIM: your own relay and access to your identity provider or directory.

How to do it

The roles

In the console an access is called a tenant, and its administrator a tenant administrator.

Create further administrators of an access

1. Tenants → double-click the access (Edit tenant) → tab Administrators.
2. Enter a user name and a start password (at least 8 characters), click Create administrator.
3. Administrators sign in on the address of their access.

Create accounts with other roles (system administrator)

1. Open Users in the sidebar. The page is called Users & roles.
2. At the top enter user name, password and role, click Create / Change.
3. If the account should only see certain accesses: in the row menu (⋮) choose Assign tenants… and tick the accesses. Without a selection the account sees all of them.

On browserdesk.de only the operator creates such accounts. If you need technician or read-only accounts there, write to info@browserdesk.de.

Second factor for your own account

1. Click your account circle at the top right → Second factor → Set up.
2. Scan the QR code with the authenticator app. If that does not work, type the key shown below it by hand.
3. Enter the six-digit code from the app and confirm. The first correct code turns the second factor on.

From now on, after the password the sign-in also asks for the Code from the authenticator app. This also applies when you sign in with this account in the program. You turn it off in the same dialog, only with a valid code.

Phone lost: reset the second factor

A system administrator opens Users & roles. The column Second factor shows “active” for the account. In the row menu (⋮) choose Reset second factor and confirm. After that the password is enough again, and the account sets up the second factor anew.

Company sign-in (own relay only)

You set up all three ways under Settings → Configuration (B3).

• OIDC (section Sign-in via SSO (OIDC)): enter Authority (issuer), Client ID, Client secret and the Redirect URI — the redirect URI is https://<your-relay>/admin/api/auth/oidc/callback and must be registered exactly like that at the provider. Role mapping decides which role an account gets. The sign-in page then shows Sign in with SSO.
• LDAP / Active Directory (section Sign-in via LDAP / Active Directory): server (the name as in the certificate), LDAPS port 636, either a service account with search base and user filter, or just a bind template such as {benutzer}@company.local. Group → role maps groups to roles. Sign-in uses the normal sign-in form.
• SCIM (section Provisioning via SCIM): Enable SCIM. Then in Users & roles → API tokens … create a token with the purpose SCIM provisioning and copy it — it is shown only once. In the identity provider enter the address https://<your-relay>/scim/v2 and this token. The provider then creates accounts, changes roles and disables them; sign-in still happens via OIDC or LDAP.

How you know it worked

• The new account is listed in Users & roles; the column Origin shows Local, LDAP or SCIM.
• With a second factor the column Second factor shows “active”, and the sign-in asks for the code.
• An account disabled via SCIM shows “SCIM · disabled”.

Good to know

• The emergency sign-in (without user name, with the relay's admin password) has no second factor. Work with named accounts and give the emergency sign-in a long password (B9).
• The second factor is voluntary. A requirement for console accounts and recovery codes do not exist yet. For members of an access there is a requirement (B5).
• A code works only once. If you sign in twice within 30 seconds, wait for the next code.
• Turning the second factor on signs your account out in the program; the program asks again, with a code.
• OIDC and SCIM accounts bring their second factor from the identity provider. LDAP accounts use the console's second factor.
• Disabling via SCIM immediately ends all console sessions of the account. Via SCIM the relay grants at most the role set in Highest role via SCIM (default Supervisor).
• LDAP only works encrypted (LDAPS). Nested groups are not evaluated. A Linux or Docker relay needs the libldap2 library for it; the Docker image has it.
• Forgot your password: a system administrator or another administrator of the access sets a new one. There is no reset by email. If you are the only administrator of an access on browserdesk.de, write to info@browserdesk.de.
• Restrict console access to certain networks: B7.

If it does not work

What it is for

Members are personal accounts of your access. People use them to sign in in the program (card Access) and in the browser under My devices, and they see the devices of the access. You decide which devices a member sees, and you can require a second factor for all members. Members do not get into the console — that is what console accounts are for (B4).

What you need

• An access in the Cloud or on your own relay.
• A console account as administrator of the access.

How to do it

Create a member

1. In the console open Tenants. In the console an access is called a tenant.
2. In the row menu of your access (⋮) choose Users. The dialog Users of … opens with the list of members.
3. Enter New user * and Password *, click Create user.
4. Give the member the access name, user name and password.

Set devices per member

1. In the same list, in the member's menu (⋮), choose Set devices.
2. Choose Selected devices only and tick the devices — or All devices of the access (default).
3. Save. The column “Devices” then shows “selected” or “all”.

Require a second factor

1. Tenants → double-click the access (Edit tenant) → tab Governance policy.
2. Turn on Second factor required for users, Save.
3. Anyone without a second factor sets it up at their next sign-in under My devices in the browser. Until then the program refuses such accounts.

A member can set up the second factor voluntarily: sign in under My devices in the browser → Two-factor → Set up → scan the QR code → enter the first code.

Change password, delete a member, phone lost

In the member's menu (⋮):

• Change password — the console asks first and names devices that are still signed in via a member account.
• Reset second factor — only shown if the member has one. After that the password is enough again.
• Delete.

How you know it worked

• The member appears in the list Users of … with the columns “Devices” and “Second factor” (“active” or “—”).
• The member signs in in the browser under My devices and sees their devices. In the program they sign in in the card Access (C2).

Good to know

• Member or access password: without members, an access has one shared access password. It never signs in under My devices and has no second factor. Personal accounts are safer and traceable in the audit log.
• “Selected only” with nothing selected means: see nothing, never “everything”.
• The selection is first of all a view. Without “control only from the device's own tenant”, anyone who knows device ID and device password reaches the device. With Control only from the device's own tenant (tab Governance policy) the selection also applies when connecting, waking and restarting. Administrator accounts are never restricted.
• Changing the password or deleting a member invalidates their sign-ins immediately. Devices that joined via this account and do not yet carry their own proof no longer sign in afterwards. Since version 20261010.3 devices fetch their own proof when they sign in — so update the programs first, then change passwords.
• Revoke all tokens additionally invalidates all sign-ins via the access password and the devices' own proofs. Programs that joined must then join again. Use it only in an emergency.
• Turning on the second factor signs the member's program out; it signs in again with a code.
• A code works only once. Signing in twice within 30 seconds means waiting for the next code.
• A member who connects from the browser also enters the device's password (D6).

If it does not work

What it is for

If you look after several customers, each one gets its own access. Your technicians only see the customers they are responsible for; scripts and software only reach the devices of the access they are started from. If you want, a device can only be controlled from its own access. In the program on your customers' devices your name, logo, colour and support contact appear.

What you need

• Ideally your own relay (B2). There you create as many accesses as you like and assign accounts.
• In the Cloud every access is a separate order. Only the system administrator sets up one console account for several accesses — on browserdesk.de that is the operator. Write to info@browserdesk.de for this.
• A console account as system administrator (create accesses, assign accounts) or as administrator of the access (policy, branding).
• For the brand in the program: a logo as PNG, JPEG or WebP.

How to do it

1. One access per customer

Tenants → New tenant → enter a name → Save. In the console an access is called a tenant. The customer's devices go into this access (C2, C3).

2. Technicians only for their customers

1. Users & roles: create an account with the role Technician (B4).
2. In the row menu (⋮) Assign tenants… → tick the customers' accesses → Save.
3. For the customer themselves: create an administrator in the access (Edit tenant → tab Administrators). They manage only their own access.

3. Control only from the device's own access

Edit tenant → tab Governance policy → Control only from the device's own tenant:

Then Save. Free accesses are always at least on “members and computers”.

4. Your brand in the program

1. Edit tenant → tab Branding.
2. Under Colour & welcome set a Custom accent colour and optionally a welcome text; under Logo upload your logo.
3. Under Own brand in the program enter the product name (up to 40 characters), support text (up to 240 characters) and support link (https:, mailto: or tel:).
4. Save.

The devices of the access fetch the branding at start-up and after joining.

How you know it worked

• A technician with assigned accesses only sees those in Devices and Tenants.
• A device that does not belong to the access is refused when connecting, for example with “Dieser Rechner ist kein Mitglied des Zugangs, zu dem das Gerät gehört. …” (this computer is not a member of the device's access).
• In the program on the customer's devices, your name and logo are at the top, below them in small print “powered by BrowserDesk”. Under Einstellungen → Allgemein (Settings → General) the card “Support – <your name>” appears. Window title and notification area carry your name.

What the other side sees

Your customer sees your name, your logo and your support contact in the program. “powered by BrowserDesk” always remains visible in small print.

Good to know

• The boundary for sending always applies: a script, package or workflow from access A never reaches a device of access B — not even if someone knows its device ID.
• Without a level, the access is only a group in the address book when connecting. The barrier is then the device password. To separate customers when connecting as well, set the level (step 3).
• Additionally restrict by network: B7.
• SVG logos are not shown by the program; it then keeps the BrowserDesk logo. Upload PNG, JPEG or WebP for the program. The web shows SVG too.
• What is not renamed: installation folder, service, Start menu entry and the signature “ondeso GmbH” remain BrowserDesk. Updates come from the BrowserDesk feed.
• A program file under your own name (own file name and icon, Windows only) is built by BrowserDesk. There is no way to order it yet — write to info@browserdesk.de. After the first update the file is called BrowserDesk.exe again; name, logo and support in the interface remain.

If it does not work

What it is for

You decide from which networks someone may open the console and control your devices — for example only from the company network and via your VPN. There are three lists:

An empty list means: no restriction.

What you need

• The addresses of your networks in CIDR notation, for example 203.0.113.0/24 or 2001:db8::/48.
• For the lists of an access: an account as administrator of the access. In the console an access is called a tenant.
• For the relay list: your own relay and an account as system administrator.

How to do it

Lists of an access

1. Tenants → double-click the access (Edit tenant) → tab Security.
2. At the top it says Your address as the relay sees it:. Insert my address adds it to the list.
3. In Console: administrators of this access and Viewers: connect, wake up, restart enter one network per line.
4. Save networks.

Relay list (own relay)

1. Settings → Admin access → section Trusted networks.
2. Enter networks, one per line — your own first (Insert my address).
3. Save networks.

How you know it worked

• After saving: “Trusted networks saved.”
• From outside, the console shows: “The console cannot be reached from your address — it is outside the trusted networks. …”
• A viewer from outside gets: “This device can only be controlled from the trusted networks of its access — your address is not one of them. …” The BrowserDesk program shows this sentence in German: „Dieses Gerät lässt sich nur aus den vertrauten Netzen seines Zugangs steuern — …“
• Every refusal is recorded in the audit log.

Good to know

• You cannot lock yourself out: if your current address is not in the new list, the console does not save and tells you so.
• Behind a reverse proxy the lists do not work. The relay only sees the proxy's address. If Your address as the relay sees it: shows 127.0.0.1 or the proxy's address, run the relay without the proxy (B9).
• IPv4 always with four parts. 10 or 10.1 are not understood as networks. Bits after the prefix are cut off (10.1.2.3/8 becomes 10.0.0.0/8).
• Running sessions stay when you save; the list applies from the next connection. Open console sign-ins stop working from the next request.
• Not covered: the sign-in in the program and under “My devices” itself. A viewer list only exists per access, not for the whole relay.
• Specific computers instead of networks: tab Governance policy → Control only from the device's own tenant → Only computers of the tenant (B6). Both can be combined: first the network is checked, then the computer.
• System administrators are only bound by the relay list, not by the list of an access.

If it does not work

What it is for

Depending on how it was installed, your own relay does not update itself, and its data belongs in a backup. This page shows how to update it for each installation way, how the backup works in the console, how to restore it, and what matters when you move to another server.

What you need

• Your own relay (B2) and a console account as system administrator.
• For Docker and Linux: access to the server's command line.

How to do it

Update

In the console: Settings → Relay update → Check for update, then Apply update. Whether the relay updates itself is set in Configuration → Self-update and mirror → Relay self-update. Leave self-update off on Linux installations that you update with the script.

Back up

1. Settings → Maintenance schedule.
2. Under Backup passphrase set a passphrase and Save. Without a passphrase the relay does not back up its keys.
3. Add job → choose Backup (database + images) and set a schedule. Run now tests the job immediately.
4. The backups are listed under Existing backups. Every database backup comes with an encrypted archive of the keys (….nachweise.zip.enc). Download both and keep them outside the server.

Keep the value BD_KEYRING_KEY (with Docker in the .env file) separately and safely, for example in a password manager (B9).

Restore (same server)

1. Settings → Maintenance schedule → Existing backups → row with the database backup (….dump.gz) → Restore.
2. In the dialog Restore database? type the database name and click Restore.
3. The relay restarts. Sign in again afterwards.

Move to a new server

1. Install the relay on the new server the same way (B2), but do not start it yet, or stop it again right away.
2. Decrypt the key archive with the backup passphrase and unpack it into the relay's data folder before the first start: openssl enc -d -aes-256-cbc -pbkdf2 -in <name>.nachweise.zip.enc -out nachweise.zip
3. If BD_KEYRING_KEY was set, set the same value on the new server before the relay starts.
4. Start the relay, then restore the database backup (as above).
5. Point the name (DNS) at the new server. If the devices keep the same address, you do not need to change anything on them. For a new address: C6.
6. Licence: a licence is valid for one installation. Have the activation released at browserdesk.de (info@browserdesk.de) and install the licence file again on the new server (A5).

How you know it worked

• After an update, Relay status (or /health) shows the new version.
• After restoring, the console confirms that the database was restored, names the file holding the previous state, and says that the relay is restarting.
• After a move the devices sign in at the new server, and their device certificates remain valid.

Good to know

• Running sessions during an update: the viewer shows „Relay wird aktualisiert – Verbindung wird wiederhergestellt …“ (relay is being updated, reconnecting) and reconnects by itself. A direct session keeps running.
• Restoring resets everything: devices, accesses, users, tickets, settings. Whatever came later is gone. The state before lies as …-vor-einspielen.dump.gz in the same list — that is how you undo it.
• All console sign-ins end when restoring.
• Without the keys, all encrypted values are empty on a new server: a new device CA (all device certificates invalid), mail and sign-in credentials gone.
• Windows wraps the keys to the machine (without BD_KEYRING_KEY). A move to another machine is then not possible without losing the encrypted values; there is no way to re-wrap yet. Write to info@browserdesk.de before such a move.
• Linux without BD_KEYRING_KEY stores the keys unencrypted and warns at start-up (B9).
• Docker: the whole backup is the data/ folder plus the value BD_KEYRING_KEY from .env.
• Going back to the old version with Docker: set RELAY_VERSION in .env back and run docker compose up -d, as long as the old image is still loaded.

If it does not work

What it is for

Your own relay can be reached from the internet and brokers access to all your devices. This page is a checklist: what to set after the installation so that only the right people get in, no foreign computer can pose as one of your devices, and your keys survive a server failure.

What you need

• Your own relay (B2) and a console account as system administrator.
• Access to the server (firewall, environment variables of the service).

How to do it

1. Network and certificate

1. Provide a real TLS certificate for the relay's name — RSA with the “ISRG Root X1” chain (B2).
2. Open only what the relay needs in the firewall: 9013/tcp, 3478/udp, 5349/tcp and, if set, the Relay ports from/Relay ports to range. Never open the database to the outside.
3. Run the relay without a reverse proxy that terminates TLS. It only evaluates the real peer address. Behind a proxy the per-address throttles and trusted networks do not work.

2. Console

1. Create named accounts and set up the second factor for each one (B4).
2. Give the emergency sign-in (without user name) a long password: Settings → Admin access → section Admin password → Change. The emergency sign-in has no second factor.
3. Restrict the console to your networks: Admin access → Trusted networks (B7).

3. Devices

1. Settings → Device certificates (mTLS). Every device gets its own certificate when it joins and identifies itself with it — so no foreign computer can pose as a known device.
2. Under Enforcement first turn on checking of presented certificates. Turn on enforcing the certificate only when all devices demonstrably connect via mTLS.
3. Devices that no longer have a certificate after a reinstallation wait under Enrollment requests. Check them and click Approve.
4. Decide per access who may control: Edit tenant → Governance policy → Control only from the device's own tenant (B6). Without this level, device ID and device password are enough.
5. Device passwords set centrally in older versions stay stored with a weaker method until you set them again: Devices → the device's menu → Set password.

4. Keys and backup

1. Set BD_KEYRING_KEY. With this value the relay encrypts its key ring. Docker writes it into .env during the installation. On Linux without the value the ring is stored unencrypted, and the relay warns at start-up. On Windows, Windows protects the ring for this machine.
2. Keep the value separately from the server, for example in a password manager — never in relay.json and never next to the backup.
3. Set a Backup passphrase (B8). Only then does the relay back up its keys.
4. Start every call of the program on the server (for example --set-setting) with the same environment as the service.

How you know it worked

• Every console sign-in asks for the code.
• The relay's start-up log no longer warns that the key ring is stored in plain text.
• The backup job no longer reports missing keys.

Good to know

• Losing BD_KEYRING_KEY means losing all encrypted values — device CA (all device certificates invalid), licence activation, passwords for mail and sign-in services.
• A program call without the value aborts if the ring is wrapped. That is intended; otherwise it would create new keys.
• Waiting viewers per address: at most five viewers without sign-in may wait for a device from one address at the same time (adjustable under Configuration → Server). Behind a proxy all of them share these five.
• Block a single device: Devices → the device's menu → Block. Reset its certificate: Reset certificate — the next join issues a new one.
• Suspicion that a copy of the database fell into the wrong hands: the key for sign-in tokens is renewed by a call to the administration API; there is no form for it. Afterwards all programs must join again. Write to info@browserdesk.de in that case.
• The server itself you harden like any other server (SSH with keys only, firewall, operating system updates). BrowserDesk does not provide its own guide for that.

If it does not work

What it is for

BrowserDesk is one program with two roles: a device is controlled, or you use it to control another one. On Windows, Mac and Linux both live in the same application. Phones, tablets and the Fire TV Stick control other devices. This page tells you which file to get for which device and what happens on first start.

What you need

• The programs are in the download section of the home page. Every plan (Free, Cloud, own relay) uses the same program.
• A supported system:

• For the service on Windows and for the MSI: administrator rights once.

How to do it

Windows: single file

1. In the download section, download the Windows file.
2. Start it. On first start BrowserDesk copies itself into your user profile and runs from there — no administrator rights needed. It updates itself from there later.
3. So that others can access this computer: on the start page, in the card Ihr Desktop (Your desktop), switch on Eingehende Verbindungen zulassen (Allow incoming connections). The switch stays on when the program restarts.
4. The first time you switch it on, BrowserDesk asks BrowserDesk dauerhaft einrichten? (Set up BrowserDesk permanently?): - Als Dienst einrichten (Set up as a service) — BrowserDesk starts with the computer (confirm the Windows administrator prompt once). - Nur diesmal (Just this time) — the computer can only be reached while the program is running.

You can set up or remove the service later: Einstellungen › Fernzugriff (Settings > Remote access) → card Systemdienst (System service) → Dienst installieren (Install service) or Dienst entfernen (Remove service).

Windows: MSI for deployment

The MSI (button "MSI" in the download section) is meant for IT departments deploying via GPO, Intune or script. It installs for all users and sets up the service right away. How to bring many devices straight into your access is described in C2 and C3.

Mac

1. In the download section, get the DMG for macOS.
2. Drag BrowserDesk into the Applications folder and start it.
3. If the Mac is to be controlled, BrowserDesk needs two permissions that only you can grant: Einstellungen › Fernzugriff → card macOS-Berechtigungen (macOS permissions): - Bildschirmaufnahme (Screen Recording) — so a helper sees the screen. - Bedienungshilfen (Accessibility) — so they may move mouse and keyboard.

For each permission there is Anfragen (Request — opens the macOS prompt) and Systemeinstellungen (System Settings — opens the matching page). Details: C5.

1. In the card Ihr Desktop, switch on Eingehende Verbindungen zulassen.

Linux

1. In the download section, pick the package for your distribution: .deb for Ubuntu and Debian, .rpm for Fedora and Rocky — each for x64 or ARM64.
2. Install it, e.g. on Ubuntu: sudo apt install ./<file name>.deb. According to the download page, the package sets up the service and device permissions by itself.
3. Start the program. Under Einstellungen › Fernzugriff → Systemdienst you see whether the service is set up.
4. Optional: if the computer should also be reachable at the login screen, the card Zugang vor der Anmeldung (Access before login) has the switch Anmeldebildschirm fernsteuern (Control the login screen remotely). Turning it on asks for the administrator password once. Read the box "Vorher wissen" (Know beforehand) in the card first.

iPhone, iPad, Android, Fire TV

The apps are ready. The public distribution (App Store, Google Play, Amazon) will follow — it will be listed in the download section. Android phone, tablet and Fire TV Stick share one APK.

Without installing

To control another device you do not necessarily need a program: web access at browserdesk.de/app runs in the browser (D4). For one-off help on a Windows PC there is Quick Support (D1).

How you know it worked

• On the start page, the card Ihr Desktop shows a nine-digit ID under "EIGENE ID" (own ID).
• At the top of the start page the card Erste Schritte (First steps) lists three steps: switch on reception, join an access, reachable. Finished steps are ticked; once all three are done, the card disappears.
• With the service, Ihr Desktop reads "Der Dienst nimmt Verbindungen an" (the service accepts connections) and the card Systemdienst reads "Status: Läuft (Autostart + Auto-Update)" (running).
• On the Mac the card macOS-Berechtigungen shows "vollständig" (complete) at the top right.

Good to know

• With or without the service?

| | Without service | With service | |---|---|---| | Windows | reachable while the program runs | starts at boot, reachable even with nobody logged in | | Linux | reachable while the program runs | starts when you log in; login screen only with "Zugang vor der Anmeldung" | | Mac | — | not available; reachable while someone is logged in and BrowserDesk runs |

• Reachable does not mean open: whoever wants access needs the ID and password or a quick code — and, depending on the settings, consent at the device (D2, F1).
• Via browserdesk.de, devices can only be controlled if they belong to an access. After installing, add the device to your access: C2.
• Mac: the permissions belong to the app. macOS may ask again from time to time even though they are granted. After granting Bildschirmaufnahme, macOS may require the app to restart.
• Updates: all desktop programs update themselves.
• Start menu (Windows): if the entry is missing, the start page shows a notice. Create it under Einstellungen › Allgemein (Settings > General) → card Startmenü (Start menu); this needs administrator approval once.
• Remove completely (Windows): see the Knowledge Base article Fully uninstall a client.

If it does not work

What it is for

Via browserdesk.de you can only control devices that belong to an access — your Free access, your Cloud access or an access on your own relay. A device you add takes one place there, can then be reached from the access and appears in its address book. There are three ways: sign in in the program, enter a one-time code, or pass a deployment key at installation.

What you need

• BrowserDesk on the device to be added — Windows, Mac or Linux (C1).
• The name of your access (e.g. fuchs-48213) and one of these: - a user account of the access (user and password), or the access password if your access has one, - a one-time code, - a deployment key (Cloud and own relay only, not Free).
• A free place. Free has three places; Cloud has as many as were bought.
• Own relay: the device must already know your relay before it joins — otherwise the join goes to browserdesk.de and is refused. Set the relay address: C6.

How to do it

Way 1: Sign in in the program

1. On the device open BrowserDesk and choose Einstellungen › Fernzugriff (Settings > Remote access). The card Zugang (Access) is at the top.
2. In the field "ZUGANG" (access) enter the name — or the address such as fuchs-48213.browserdesk.de.
3. Enter your account under "BENUTZER" (user) and "PASSWORT" (password). If your access has an access password: leave the user empty and enter the access password.
4. Click Beitreten (Join). If your account has a second factor, BrowserDesk asks for the code from your authenticator app (Zweiter Faktor (Second factor) → enter code → Anmelden (Sign in)).
5. The question Dieses Gerät hinzufügen? (Add this device?) appears: - Dieses Gerät hinzufügen (Add this device) — takes a place; the device can be reached from the access. - Nur von hier aus steuern (Only control from here) — takes no place; you only see the address book and control the access's devices from here.

You can change this later: the card Zugang has the switch Dieses Gerät hinzufügen.

Way 2: With a one-time code — no password on the device

For Free this is the main way, because a Free access has no access password.

A one-time code is valid for 30 minutes and for exactly one device.

Way 3: Right at installation — deployment key

For many devices (Cloud or own relay, not Free). The device joins the access while it is installed — no password, no click.

1. Console: Tenants → Edit tenant → tab Add devices → section Deployment key.
2. Fill in "Valid (days)" (1 to 30), "Maximum devices" and a "Note", then Create key.
3. The key and the commands under How to install are visible only now — Copy key or Copy commands.
4. Pass them at installation, for example: - Windows MSI: msiexec /i BrowserDesk.msi BDZUGANG=<access> BDSCHLUESSEL=<key> /qn - Windows single file: BrowserDesk.exe --join <access> --key <key> - Linux: sudo BDZUGANG=<access> BDSCHLUESSEL=<key> apt install ./<file name>.deb

More on deploying to many devices: C3.

How you know it worked

• The card Zugang shows "Beigetreten: <name>" (joined) and, at the switch Dieses Gerät hinzufügen, "Hinzugefügt — Platz 2 von 3 belegt. …" (added — place 2 of 3 taken; with your numbers).
• On the start page the card Ihr Desktop (Your desktop) shows "Zugang: <name>" below the ID.
• In Erste Schritte (First steps), "Zugang beitreten" (join access) is ticked.
• A device added at installation says in the card Zugang: "Dieses Gerät gehört zum Zugang „…“ (bei der Installation oder von einem anderen Benutzer hinzugefügt)." (this device belongs to access … — added at installation or by another user). You only see the address book there after signing in.
• In the console the device is listed under Devices.

Good to know

• Joined is not added. If you only sign in and choose Nur von hier aus steuern, you see the address book. The device can only be reached once you choose Dieses Gerät hinzufügen.
• Only join your own access. Whoever calls you and asks you to join or for a code may want to take over your computer.
• Free devices can only be controlled from their own access.
• Free up a place (browserdesk.de only): console → Devices → the device's menu → Free up place. The device is then out and only comes back when it is added again in the program. With Free, at most three releases are possible in 30 days.
• Deleting the device (Delete in the same menu) ends the place without that limit — the device may come back.
• Leave: card Zugang → Verlassen (Leave). If the device was added, it signs off and can no longer be reached via the access; the administration frees the place.
• Deployment keys can be revoked in the console at any time (row menu → Revoke); devices already added stay. Treat the key like a password.
• If an access is full, a device with a deployment key waits and asks again every 10 minutes — a place that becomes free is used without you doing anything.

If it does not work

What it is for

If you look after many computers, you do not want to set them up one by one. With the MSI you install BrowserDesk including the service through your software distribution. If you also pass the name of your access and a deployment key, every device joins your access while it is installed — no click, no password, no access password.

What you need

• An access in the Cloud or on your own relay. Free has no deployment keys; there devices join with a one-time code (C2).
• Enough free places in the access.
• The MSI: on browserdesk.de the MSI button in the download area (address /dl/client/latest/msi). On your own relay the same address on your server.
• Software distribution that runs msiexec with administrator rights (GPO, Intune, PDQ or your own script).
• Own relay: the devices must know your relay's address before they join (see “Good to know”).

How to do it

1. Create a deployment key

1. In the console Tenants → double-click the access (Edit tenant) → tab Add devices → section Deployment key. In the console an access is called a tenant.
2. Fill in Valid (days) (1 to 30), Maximum devices and a Note, then Create key.
3. The key (starts with bdk_) and the ready-made commands under How to install are visible only now. Copy key or Copy commands.

2. Deploy

Windows, MSI — the command for your software distribution:

msiexec /i BrowserDesk.msi BDZUGANG=<access> BDSCHLUESSEL=<key> /qn

The MSI installs for all users, sets up the service and stores the join request. The service redeems it as soon as it runs.

Windows, single file by script — without the MSI:

1. Download the current EXE and set it up as a service (Install a client from the command line).
2. Join: BrowserDesk.exe --join <access> --key <key> — without a window.

Linux (deb or rpm):

sudo BDZUGANG=<access> BDSCHLUESSEL=<key> apt install ./<file name>.deb

If the package manager does not pass the values on, put the file /var/lib/browserdesk/join-request.json with the content {"tenant":"<access>","key":"<key>"} there by hand.

3. After the rollout

Revoke the key in the console (row menu → Revoke). Devices already added stay.

How you know it worked

• In the console the key's row counts along: used / maximum, state “valid”, later “used up”.
• The devices appear under Devices in the access.
• On the device the card Zugang (Access) says: „Dieses Gerät gehört zum Zugang „…“ (bei der Installation oder von einem anderen Benutzer hinzugefügt).“ (this device belongs to access … — added at installation or by another user).
• --join returns an exit code: 0 added, 1 refused (the reason is in the output), 2 not yet (relay not reachable or access full — the service keeps trying), 64 wrong call.

Good to know

• Treat the key like a password. Anyone who can read the command line in your software distribution sees it. That is why it is time-limited, limited to a number of devices and revocable — and never the access password.
• Access full: a device with a key waits and asks again every 10 minutes. A place that becomes free or is bought is used without you doing anything.
• Own relay: the join goes to the relay the device knows — browserdesk.de by default. It is refused there („Dieser Verteil-Schlüssel gilt nicht für diesen Zugang.“ — this deployment key is not valid for this access), and the request is discarded. There is no MSI property for the relay address. Where the device stores the address is described in Change the relay address; there is no tested way yet to preset it during deployment — write to info@browserdesk.de.
• Mac: the MSI and --join exist only for Windows, the Linux package only for Linux. Add Macs one by one (C2).
• Without access without confirmation, someone at the device has to accept every session. How to reach devices unattended: C4.
• Redeeming the same request twice does no harm: a device counts once per key and keeps its place.

If it does not work

What it is for

You want to control a computer nobody is sitting at — a server, your office computer from home, a customer's device overnight. That takes three things: BrowserDesk runs without an open window (service), the device has a fixed password, and it accepts connections without confirmation.

What you need

• Cloud or your own relay. In Free every session must be confirmed at the device — this does not work there.
• The device belongs to your access (C2).
• Windows: administrator rights for the service.
• Linux: set up the service; for the sign-in screen BrowserDesk installed as a package (deb/rpm) and the administrator password once.
• Mac: there is no service. A Mac can be reached as long as a user is signed in, and it needs the permissions from C5.

How to do it

1. Set up the service (Windows, Linux)

1. Open BrowserDesk on the device → Einstellungen › Fernzugriff (Settings > Remote access).
2. In the card Systemdienst (System service) click Dienst installieren (Install service). Windows asks for administrator rights.
3. On Windows, BrowserDesk then starts with the computer and stays reachable even when nobody is signed in. On Linux it starts with your sign-in.
4. Linux, sign-in screen: in the card Zugang vor der Anmeldung (Access before sign-in) turn on Anmeldebildschirm fernsteuern (Control the login screen remotely). The administrator password is asked for once.

Many Windows devices at once: the MSI sets up the service as well (C3).

2. Set a fixed password

1. On the start page, in the card Ihr Desktop (Your desktop), click the key symbol Eigenes Passwort setzen (Set own password) under “EIGENES PASSWORT” (own password).
2. Enter at least 6 characters, Setzen (Set).
3. Optionally turn off Systempasswort aktiv (System password active) — then only your own password is valid.

Centrally for many devices: in the console Devices → the device's menu → Set password. The device takes it over at its next sign-in to the relay, even if it was offline.

3. Allow without confirmation

1. Einstellungen › Sicherheit (Settings > Security) → card Zugriffssteuerung (Access control).
2. Under “WER DARF ZUGREIFEN” (who may access) choose Automatisch zulassen (unbeaufsichtigt) (Allow automatically — unattended).

4. Make it reachable (Mac, and without service)

In the card Ihr Desktop (Your desktop) turn on Eingehende Verbindungen zulassen (Allow incoming connections). With the service, it says „Der Dienst nimmt Verbindungen an“ (the service accepts connections) instead.

How you know it worked

• The card Systemdienst (System service) shows „Status: Läuft (Autostart + Auto-Update)“ (running).
• The card Ihr Desktop (Your desktop) says „Der Dienst nimmt Verbindungen an“.
• You connect with device ID and password (D2) without anyone clicking at the device — also after a restart of the device.
• In the Windows notification area the menu of the BrowserDesk symbol shows „Bereit (Dienst)“ (ready, service).

What the other side sees

No dialog. On Windows a small session window with your name appears at the top right during the session; on Mac and Linux the BrowserDesk window turns into this card. Through it the person at the device can end the session at any time (F1).

Good to know

• Free: the setting Automatisch zulassen (unbeaufsichtigt) does not help there — every session must be confirmed at the device. For unattended access you need the Cloud (prices) or your own relay.
• At the Windows sign-in screen and in User Account Control prompts you can only control with the service (E6).
• Restart remotely and be reconnected afterwards: E17.
• Mac: before a user signs in, a Mac cannot be reached.
• Remember the password: tick Zugangsdaten speichern (Save credentials) when connecting. On Windows it is stored encrypted for your Windows account on this computer; on Mac and Linux in your account's address book, unencrypted.
• Lockout after failed attempts: after five wrong passwords from the same direction the device refuses attempts for a while — first 30 seconds, longer on repetition, at most 15 minutes.
• Remove the service again: Dienst entfernen (Remove service) in the same card (C8).
• More protection: control only from the device's own access (B6), only from trusted networks (B7).

If it does not work

What it is for

If a Mac is to be controlled, BrowserDesk needs two permissions from macOS: Screen Recording (so the helper sees the picture) and Accessibility (so they may guide mouse and keyboard). Only the owner of the Mac can grant them — no installer, script or administration can do this for you. Without these permissions there is no error message on the Mac; the picture is missing or clicks come to nothing.

What you need

• A Mac with an Apple chip (Apple silicon) and macOS 12.3 or later. Intel Macs can control other devices but cannot be controlled.
• BrowserDesk on the Mac (C1).

How to do it

1. Open BrowserDesk → Einstellungen › Fernzugriff (Settings > Remote access). The card macOS-Berechtigungen (macOS permissions) is also on the page Fernzugriff (Remote access).
2. At Bildschirmaufnahme (Screen Recording) click Anfragen (Request) and agree in the macOS dialog.
3. At Bedienungshilfen (Accessibility) click Anfragen (Request) and agree.
4. If no dialog appears (macOS shows it only once per app): click Systemeinstellungen (System Settings) next to the permission. The matching page under “Privacy & Security” opens; turn BrowserDesk on there.
5. If macOS asks you to restart the app after granting Bildschirmaufnahme (Screen Recording), quit BrowserDesk and open it again.
6. In the card Ihr Desktop (Your desktop) turn on Eingehende Verbindungen zulassen (Allow incoming connections).

How you know it worked

• The card macOS-Berechtigungen (macOS permissions) shows „vollständig“ (complete), and both permissions say „erteilt“ (granted).
• A helper sees the Mac's picture, and their clicks and keystrokes arrive.

What the other side sees

If a permission is missing, the helper gets a notice:

• without Screen Recording: „Auf diesem Mac ist „Bildschirmaufnahme“ für BrowserDesk nicht erteilt. Der Besitzer muss sie freigeben: Systemeinstellungen → Datenschutz & Sicherheit → Bildschirmaufnahme.“ (Screen Recording not granted — the owner has to allow it). The connection is then not established.
• without Accessibility: „Auf diesem Mac ist „Bedienungshilfen“ für BrowserDesk nicht erteilt — Maus und Tastatur werden vom System verworfen. …“ (Accessibility not granted — mouse and keyboard are discarded). The picture is visible, control does not work.

Good to know

• macOS asks again from time to time — even when the permissions are already granted, for example with a dialog saying BrowserDesk wants to bypass the system's picker for private windows. That is not a lost permission: agree. While the dialog is open, it can block the program.
• Password fields: if a password field on the Mac has the focus (“Secure Input”), macOS discards keystrokes from outside — even with all permissions. The mouse keeps working. The card shows this as a yellow box, and the helper gets a notice.
• Without a signed-in user a Mac cannot be reached. There is no service for the Mac like on Windows (C4).
• Mac as viewer: if you control other devices from the Mac, you do not need these permissions.
• Blocking input on the Mac also needs Accessibility (E16).

If it does not work

What it is for

By default BrowserDesk connects to browserdesk.de. If you run your own relay, enter its address in the program. It applies to the whole device — including the background service. In a company network with a proxy, also set the proxy.

What you need

• BrowserDesk on the device, Windows, Mac or Linux (C1).
• The relay's address, for example wss://relay.company.com:9013. Ask your relay operator.
• For a proxy: host and port, possibly user and password.

How to do it

Enter the relay address

1. Open BrowserDesk → Einstellungen › Netzwerk (Settings > Network).
2. In the card Netzwerk (Network), under “RELAY-ADRESSE” (relay address), enter the address, for example wss://relay.company.com:9013.
3. Leave the field or press Enter. The address is saved for the whole device.
4. If the service is running, it follows by itself. Below the field you see „Der Hintergrunddienst zieht um …“ (the background service is moving), shortly after „Der Hintergrunddienst ist jetzt mit … verbunden“ (now connected to …).
5. Add the device to the access on the new relay (C2).

Back to browserdesk.de: enter wss://browserdesk.de:443 and leave the field. Below the field you then see „Relay gewechselt — …“ (relay switched).

Set a proxy

1. Einstellungen › Netzwerk (Settings > Network) → card Proxy.
2. Under “MODUS” (mode) choose: - Kein (None) — direct connection, - System — the system's proxy settings (environment variables http_proxy, https_proxy, no_proxy), - Manuell (Manual) — enter “PROXY-HOST”, “PORT” and optionally “BENUTZER (OPTIONAL)” (user) and “PASSWORT” (password).
3. In the card Netzwerktest (Network test) click Test starten (Start test).

How you know it worked

• Below the field it says „Gespeichert.“ (saved) or „Relay gewechselt — …“ (relay switched) and then that the background service is connected.
• The card Relay-Einstellungen (Relay settings) shows the new relay. Jetzt vom Relay laden (Load from relay now) fetches the current state.
• The Netzwerktest (Network test) checks DNS, TCP, TLS, HTTPS and the WebSocket connection one by one and shows where it gets stuck.

Good to know

• Switching back and forth: the device remembers its state per relay (certificate, access). If you return to a relay, it says „Relay gewechselt — Zertifikat und Zugang für … wiederhergestellt.“ (certificate and access restored); on a new relay „Relay gewechselt — das Gerät schreibt sich bei … neu ein.“ (the device registers anew). There it appears as a new device.
• First the address, then the join: a join always goes to the relay currently entered. On the wrong relay it is refused (C3).
• Without a scheme the program adds wss://, without a port it uses 443. If your relay runs on 9013, include the port. Unencrypted ws:// only works to your own computer. Invalid input is not saved.
• Proxy: HTTP proxies only (CONNECT). With a proxy, the picture always runs via the relay. The proxy password is stored protected (DPAPI) on the device.
• Variable BD_RELAY: if it is set on the computer, it takes precedence over the field. The card points this out.
• Pass on a diagnosis: in the card Netzwerktest (Network test), Diagnose exportieren (Export diagnosis) creates a report. More in Network diagnosis.
• Further guides: Change the relay address, Configure a proxy.

If it does not work

What it is for

A computer is retired or replaced. It should disappear from your administration, and its place in the access should become free for the new device. Depending on whether the old device is still running and whether it holds places of add-on modules, you proceed slightly differently.

What you need

• A console account as administrator of the access.
• For the new device: BrowserDesk (C1) and a way into the access (C2).

How to do it

Remove the old device

1. In the console open Devices and open the device's menu.
2. If the device is offline: Delete → confirm Delete device?.
3. If the device is still online: Delete asks Block and delete device? — deleting alone is pointless, a running program signs in again at once. Block & delete keeps the computer out permanently.
4. Uninstall BrowserDesk on the old device if it will be used further (C8).

Only free up the place (browserdesk.de)

1. Devices → the device's menu → Free up place.
2. Confirm Free up this place?. The device leaves the access and can no longer be reached. It only comes back when it is added again in the program.

Leave the access on the device itself

Einstellungen › Fernzugriff (Settings > Remote access) → card Zugang (Access) → Verlassen (Leave). If the device was added, it signs off; the administration frees the place.

Add the new device

Add the new device like any other (C2). It gets its own device ID; the old device's ID does not carry over. Set up the device password and access without confirmation anew (C4).

Many old devices at once

Settings → Cleanup removes devices that have been offline for longer than a chosen number of days (system administrator only).

How you know it worked

• The device is no longer listed under Devices; the console confirms the deletion.
• After Free up place the console reports “Place freed up — … of … places in use.”
• On the device, after the release, it says „Dieses Gerät wurde aus seinem Zugang entfernt (Platz freigegeben). …“ (this device was removed from its access).

Good to know

• Delete or free up the place? Delete removes the entry; a device that comes back online may return with its proof. Free up place throws it out of the access; it only comes back by being added again. Free up place only exists on browserdesk.de.
• Free: three places. At most three releases via Free up place in 30 days.
• Add-on modules (Startcenter, remote console): their place is fixed to the device. It only becomes free when the device is deleted (also through Free up place). Per module, at most three releases or 10 % of the places — whichever is larger — are possible in 30 days; after that a place is locked until a stated date. If the same device returns, it gets its old place back if one is free (G24).
• Blocking alone (Block) keeps a device out at once but leaves it in the list — for example on suspicion of misuse.
• Device broken and the disk gone: simply delete it. It will never sign in again.
• Buy more places: prices.

If it does not work

What it is for

You no longer need BrowserDesk on a Windows computer — or only not the service that keeps the computer reachable at all times. There are three levels: remove the service, uninstall the MSI or remove BrowserDesk completely. Afterwards you delete the device in the console.

What you need

• Administrator rights on the Windows computer.
• For deleting in the console: an account as administrator of the access.

How to do it

Remove only the service

1. Open BrowserDesk → Einstellungen › Fernzugriff (Settings > Remote access) → card Systemdienst (System service) → Dienst entfernen (Remove service).
2. Windows asks for administrator rights.

Or via the BrowserDesk symbol in the notification area: BrowserDesk beenden (Dienst entfernen) … (quit BrowserDesk — remove service) — also with administrator approval.

The program stays; you can still open it and allow connections by hand.

Uninstall the MSI

If BrowserDesk was installed with the MSI, remove it like any other program in the Windows settings under the installed apps. This also removes the service tasks.

Remove completely

For the portable single file, and if nothing should remain: run the script from Fully uninstall a client in PowerShell as administrator. It removes service and watchdog tasks, processes, autostart entries, program, data and cache folders (for every user and in the SYSTEM profile) and checks at the end that nothing is left. With -KeepData identity and logs are kept.

Afterwards in the console

Devices → the device's menu → Delete (C7).

How you know it worked

• After Dienst entfernen (Remove service) the card Systemdienst (System service) shows „Status: Nicht installiert“ (not installed).
• After the script, the check at the end reports that no trace is left.
• The device appears offline in the console and can be deleted.

Good to know

• The service does not come back by itself. Since version 20260912.8, Dienst entfernen (Remove service) also removes the watchdog task that used to restart it.
• The service consists of two tasks in the Windows Task Scheduler: BrowserDeskUnattended and BrowserDeskWatchdog. Both run as SYSTEM.
• Removing only the tasks also works by command: & "C:\Program Files\BrowserDesk\BrowserDesk.exe" --uninstall-service.
• What happens to your data: the script without -KeepData also deletes the device password, the join to the access and the device certificate. If BrowserDesk comes back to the computer later, it has the same device ID, but a new password and no access any more — it has to join again (C2).
• Mac and Linux: there is no guide of its own for removing yet. Write to info@browserdesk.de.
• Repair instead of removing if BrowserDesk only hangs: Repair a client.

If it does not work

What it is for

Someone calls: "Something isn't working." Their computer has no BrowserDesk yet. With Quick Support („Schnellhilfe“) they download a single file, start it and read you a quick code of six digits. You type the digits, they click „Erlauben“ (Allow) — and you see their screen. Nothing is installed and nobody has to share a password.

What you need

• You (helper): BrowserDesk on your computer, phone or tablet — or simply a browser with browserdesk.de/app. No account needed.
• The person at the device: a Windows PC with internet. On macOS and Linux there is no separate Quick Support file yet — the person installs BrowserDesk and creates the code in the program (see below).
• Model: any — Free, Cloud or your own relay. On browserdesk.de it also works for a stranger's computer that starts Quick Support for the first time and belongs to no account.

How to do it

macOS or Linux at the device: install BrowserDesk (C1). Then on the start page, in the card Entfernten Desktop steuern (Control a remote desktop), choose the tab Schnellcode; below it, under Für dieses Gerät als Ziel (for this device as target), click Schnellcode erzeugen (Create quick code). The same exists in the sidebar under Fernzugriff (Remote access) in the card Erreichbarkeit (Reachability). If it asks to switch on „Eingehende Verbindungen zulassen“ (allow incoming connections), do that first. The rest is the same.

How you know it worked

The session window opens on your side showing the person's screen. From now on you also know the device's ID — it is listed under „Zuletzt verwendet“ (Recently used), and next time you can connect with it (D2) if the person allows it.

What the other side sees

• Before the connection, the dialog Zugriff erlauben? with your name and the addition "per Schnellcode". Ablehnen (Deny) is preselected: an accidental Enter lets nobody in. Without an answer the request is denied when the countdown runs out.
• During the session the Quick Support window stays open; its button then reads Trennen und beenden.

Good to know

• The code is valid for 5 minutes and only once. When it expires, Quick Support shows a new one by itself (Neuer Code (New code) gets one immediately).
• The code only replaces the password, never the consent. Without „Erlauben“ at the device nobody gets in.
• Nothing is installed: no service, no autostart, no tray icon. After quitting, the computer can no longer be reached through Quick Support. Windows keeps the device identity so the computer gets the same ID next time.
• Do not rename the file: if its name no longer contains "Schnellhilfe", the full program starts and installs itself.
• Quick Support allows screen, control, clipboard and files — no command line.

If it does not work

What it is for

Every device with BrowserDesk has a fixed nine-digit ID and a password. Whoever knows both can connect — even when nobody sits at the device, if the device is set up that way. This is how you reach your own computer while away or look after computers where nobody can give consent.

What you need

• At the device: BrowserDesk, reachability switched on (C1) and — via browserdesk.de — an access the device belongs to (C2).
• On your side: BrowserDesk on your computer, phone or tablet, or web access (D4).
• Connecting without consent only works with Cloud or an own relay. With Free, someone at the device always has to agree.

How to do it

On a phone or tablet it is the same: field "Partner-ID", below it "Passwort". In the browser: D4.

How you know it worked

• The panel "Verbinde mit …" disappears and the session window with the device's screen opens.
• The device is then listed under Zuletzt verwendet (Recently used). If you ticked Zugangsdaten speichern, a click on the tile connects without typing again; the tile's menu (⋮) then offers Gespeichertes Passwort entfernen (Remove saved password).

What the other side sees

• With Nachfragen (Bestätigung am Gerät) and always with Free: the dialog Zugriff erlauben? (Allow access?) showing your name.
• With Automatisch zulassen (unbeaufsichtigt): no dialog. On Windows a small session window with your name appears at the top right; on Mac and Linux the BrowserDesk window turns into that card. From there the person at the device can end the connection at any time (F1).

Good to know

• It does not work without a password. Even if someone at the device would agree: the device never accepts an empty password. Without a password, use a quick code (D1).
• Three passwords are valid side by side: the one the program generated (while Systempasswort aktiv is on), your own one and a one-time password. The one-time password (Neues Einmalpasswort (New one-time password) under "EINMALPASSWORT") is valid for exactly one session.
• New password: Neues Passwort (New password — arrow icon next to "PASSWORT") creates a new one at once; the old one stops working. A password saved by the helper is then wrong and is replaced on the next successful connect with the box ticked.
• Where the saved password is kept: on Windows encrypted for your Windows account, only on this computer. On Mac and Linux in your user account's address book, only on this computer, but not encrypted.
• Lock after wrong attempts: after five wrong passwords from the same source, the device accepts no attempts for a while — first 30 seconds, longer on repetition, at most 15 minutes.
• Abbrechen (Cancel) in the panel "Verbinde mit …" only frees your side. The attempt continues in the background; if the connection still comes about, it is closed right away.
• If the person at the device disconnected you, you only get back in once they allow you again at the device (F1) or after 10 minutes without any attempt. Every new attempt pushes the 10 minutes further.

If it does not work

What it is for

If you look after the same computers again and again, you do not want to type the ID every time. BrowserDesk remembers every device you were connected to and shows the devices of your access as a list. One click connects — with the saved password if you let it save one. In the console you sort devices into groups with tags and connect straight from the device list.

What you need

• BrowserDesk on your computer (Windows, macOS, Linux) or the app on your phone or tablet (D5).
• For your access's devices in the program: a sign-in to the access with user and password (C2). With the shared access password alone the program does not show the list.
• For tags and the console device list: an account in the console.
• With Free, every session has to be confirmed at the device — also from the list.

How to do it

Way 1: "Recently used" on the start page

1. Every successful connection ends up on the start page under Zuletzt verwendet (Recently used).
2. A click on the tile connects. If you ticked Zugangsdaten speichern (Save credentials) when connecting, BrowserDesk fills in the password itself.
3. The field Ziele durchsuchen… (Search targets…) filters by name, computer name and ID. The switch next to it toggles between tiles and list.
4. The tile's menu (⋮) offers Verbinden (Connect), Umbenennen (Rename), Gespeichertes Passwort entfernen (Remove saved password — only if one is saved) and Entfernen (Remove).

Way 2: the address book

1. Open Adressbuch (Address book) in the sidebar. It holds the same entries as "Recently used".
2. Add a device by hand: Ziel hinzufügen (Add target) → in the window Neues Ziel hinzufügen (Add new target) enter the ID and a name → Hinzufügen (Add). The window does not ask for a password. It is saved on the first successful connection if Zugangsdaten speichern is ticked.

Way 3: your access's devices

1. If you are signed in to the access with user and password, the Adressbuch shows "Zugang: …" (Access: …) below, with every device you may reach. Each tile says ONLINE, OFFLINE or BESETZT (busy).
2. Click a device that is online: BrowserDesk connects with the password saved for this ID.
3. If a device is offline and can be woken, it shows a power icon ("Aufwecken (Wake-on-LAN) und verbinden" — wake up and connect).
4. The circular-arrow icon Geräteliste aktualisieren (Refresh device list) reloads the list.

Way 4: from the history

1. Open Verlauf (History) in the sidebar. It lists finished sessions in both directions.
2. For an outgoing session click Verbinden (Connect). BrowserDesk fills in ID and saved password on the start page. Then click Verbinden there.

Way 5: in the console — tags and connecting

1. Open Devices in the console. On the left is the tree with your accesses and, below it, Tags.
2. Add a tag: right-click a device → Manage → Edit. In the window Edit device enter the tags under Tags (comma-separated), for example "Building 1, Server", then Save.
3. Filter by tag: click a tag in the tree. The list then shows only devices with that tag.
4. Connect: click the play icon in the device's row — or right-click → Access → Connect.
5. In the window enter the Device password (and the support reason if the access requires one). With Remember the password until this tab is closed the console does not ask again in this tab.
6. Click Connect. The session opens in a new browser tab (D4).

On a phone or tablet the tab Mandant (access) lists the devices of the access. If no password is saved, the app asks for it when you tap (D5).

How you know it worked

• The session window with the device's screen opens (from the console: a new tab).
• The device then appears first under Zuletzt verwendet (Recently used).

What the other side sees

The same as with any connection by ID and password: depending on the settings, the dialog Zugriff erlauben? (Allow access?) and, during the session, the session window (F1).

Good to know

• Where the saved password is kept: on Windows, encrypted for your Windows account, only on this computer. On Linux and macOS it is stored unencrypted in your user account's address book. Another Windows account or another computer cannot read it — there you type it again.
• Password changed at the device: then the saved one is wrong. With Zugangsdaten speichern ticked, BrowserDesk replaces it on the next successful connection. Without the tick the old one stays.
• Groups and tags only exist in the console. The program knows names but no tags. Umbenennen (Rename) in the program only applies to your own address book.
• Which devices you see in the access's list is set by the administrator: all of them or only selected ones (B5).
• "Remember the password" in the console only lasts until you close the tab. It changes nothing at the device.

If it does not work

What it is for

You are at someone else's computer or may not install anything there? Open browserdesk.de/app in the browser and connect from there. The page has two cards: Connect (no sign-in, with the details from the device) and My devices (with your account, shows the devices you may reach). Every session opens in a new tab.

What you need

• A current browser. Chrome or Edge are recommended; Firefox and Safari work too.
• For Connect: the device's ID and password — or a quick code created by the person at the device (D1).
• For My devices: a user account in your access. The administrator of your access creates it.
• An own relay offers the same page at its address under /app.

How to do it

Way 1: card "Connect" — no sign-in

1. Open browserdesk.de/app.
2. In the card Connect choose the tab: - ID + password: enter "Device ID" and "Device password". The device shows both in its BrowserDesk window (D2). - Quick code: enter the six digits the device is showing right now. If there is no BrowserDesk there yet, a link to Quick Support appears below the field (D1).
3. If the device's access requires a support reason or a ticket, extra fields appear for them.
4. Click Connect. A new tab opens; the start page says "The session is running in a new tab."

Way 2: "Recently used"

Below the card Connect, Recently used lists the devices you connected to in this browser. A click fills in the ID and puts the cursor into the password field — you type the password each time. The "×" next to it removes the entry.

Way 3: card "My devices" — with your account

1. In the card My devices enter "Access", "User" and "Password", then Sign in.
2. If your account has a second factor, the field "Code from the authenticator app" appears. If your access requires a second factor you do not have yet, the page walks you through Set up second factor (scan the code, enter the code, Activate).
3. Your devices are listed on the left; use Search to filter. Click a device: the right side shows ID, system, "Last seen" and, if available, a preview image.
4. Click Connect, enter the "Device password" in the dialog (and the support reason if required), then Connect. The session runs in the new tab.
5. If the device is offline and can be woken, there is Wake up.

In the session tab

• Before the picture a small window shows the state. If the device is offline it offers "Wake up (Wake-on-LAN) and connect". Under "Check connection", Run test checks whether your browser reaches the relay. "Close tab" takes you back.
• During the session the gear icon in the toolbar opens "Vorgaben für neue Sitzungen" (defaults for new sessions): picture quality and video codec every new session starts with. Below, under "Hilfe" (help), the link "Verbindungsprobleme lösen" (solve connection problems).
• End: the red cross in the toolbar ("Sitzung trennen", disconnect session).

How you know it worked

• The new tab shows the device's screen; the tab title carries the device's name.
• After a connection from the card Connect, the device is listed on the start page under Recently used.

What the other side sees

The same as with a connection from the program: depending on the settings, the dialog "Zugriff erlauben?" (Allow access?) and, during the session, the session window (F1).

Good to know

• No password in the browser: password and quick code never appear in the address and are not stored. "Recently used" only keeps ID, name and time — and only in this browser.
• An access password (a shared password of an access) does not sign you in on the web. "My devices" needs a personal user account.
• The sign-in to "My devices" only applies to this browser tab and expires after a while; then sign in again. Sign out ends it at once; Two-factor sets up or turns off the second factor.
• A quick code is valid once. If the connection fails, the session tab asks for a "New quick code from the device", not for a password.
• Pop-ups: if the browser blocks the new tab, allow pop-ups for browserdesk.de and click Connect again.
• Devices that require a client certificate cannot be controlled from the browser — use the program.
• Language: the button at the top right switches between English and Deutsch.

If it does not work

What it is for

You are out and only have your phone with you — or you want to show a computer on the TV from the sofa. The BrowserDesk app turns a phone, tablet or Fire TV Stick into a viewer: you see the computer's screen and control it with your finger or the remote. It can control a Windows, macOS or Linux computer.

What you need

• iPhone or iPad with iOS or iPadOS 15 or later.
• Android phone or tablet with Android 7 or later.
• Amazon Fire TV Stick with Fire OS 6 or later — the same app as for Android. Not on the sticks with Vega OS: Stick 4K Select (2025), Stick HD and Stick 4K 3rd gen (2026) (H15).
• How to get the app: C1.
• At the computer: BrowserDesk and ID with password (D2) or a quick code (D1).
• With Free, every session has to be confirmed at the computer.

How to do it

Phone and tablet: connect

At the bottom (on a tablet in landscape, on the left) there are four tabs: Verbinden (Connect), Mandant (access), Verlauf (History), Einstellungen (Settings).

1. Tab Verbinden, card Entfernten Desktop steuern (Control a remote desktop).
2. Type the "Partner-ID" — that is the computer's ID. Below it, the computer's password. Or switch on Schnellcode statt Kennung (Quick code instead of ID) and type the six digits the computer shows.
3. If the app should keep the password: switch on Zugangsdaten speichern (Save credentials — only on this device).
4. Tap Verbinden (Connect). Afterwards the devices are listed below under Zuletzt verwendet (Recently used).

Phone and tablet: from your access's device list

1. Tab Mandant (access).
2. Under Am Mandanten anmelden (Sign in to the access) enter the access name, your user and the password, then Anmelden (Sign in). If your account has a second factor, the window Zweiter Faktor (Second factor) asks for the code from your authenticator app.
3. The devices appear with an online dot. Pull down to reload the list.
4. Tap a device. If no password is saved, the window "Mit … verbinden" (Connect to …) asks for it. Kennwort auf diesem Gerät speichern (Save password on this device) is preselected. Tap Verbinden.

In the tab Verlauf (History) tapping an entry fills in the ID.

Phone and tablet: working in the session

The default is Trackpad-Modus (Trackpad mode): your finger moves a pointer as on a laptop touchpad.

• Quick bar at the bottom: ⌨ opens the on-screen keyboard. Strg (Ctrl), Alt, ⇧, ⊞ latch: tap one, then a key — that gives the combination; afterwards they release on their own. ⊞ twice = Windows key. Plus Esc, Tab, arrow keys, Entf (Del), 1× (undo zoom) and Zwischenablage senden (Send clipboard).
• Mouse wheel at the edge: to the right of the picture is a strip. Dragging it scrolls where the pointer is.
• External keyboard on an iPad: every key goes straight to the computer, including combinations.
• Switch to direct mode under Einstellungen (Settings) → turn off Trackpad-Modus. That is also where Standard-Qualität (default quality), Standard-Codec (default codec) and the Relay-Adresse (relay address) are.

Fire TV Stick

On the TV a separate interface for the remote starts.

1. Enter the ID on the number pad on the left. Back deletes the last digit.
2. Go to the field "Kennwort eingeben — OK drücken" (enter password — press OK) and press OK. Fire OS opens its on-screen keyboard.
3. Choose Verbinden (Connect). Next to it the devices are listed under Zuletzt verbunden (Last connected).

In the session:

How you know it worked

The computer's screen fills the app. Afterwards the computer is listed under Zuletzt verwendet or, on the TV, under Zuletzt verbunden.

What the other side sees

The same as with a connection from a computer: depending on the settings, the dialog Zugriff erlauben? (Allow access?) and, during the session, the session window (F1).

Good to know

• The phone is not controlled. Here the app is only a viewer.
• A password is always needed: without a password the computer refuses the connection — even if the field suggests otherwise. Without a password only a quick code works.
• Clipboard: the app reads the phone's clipboard only when you tap Zwischenablage senden. Text from the computer arrives on its own.
• iPhone in the background: when you switch apps, it disconnects by itself and reconnects when you come back.
• TV: the arrow keys move the pointer there and are not passed on to the computer as arrow keys — not even from a Bluetooth keyboard.
• Light and dark follow the system setting on phones and tablets.

If it does not work

What it is for

You work from home and need your computer at the office. Nobody is there to click "Allow". So your office computer is set up once to be reachable without consent. At home you open browserdesk.de/app, sign in with your personal account and connect from My devices — without installing anything. A second factor makes sure a stolen password alone is not enough.

What you need

• Cloud or an own relay. With Free every session has to be confirmed at the device — in an empty office nobody says yes.
• At the office computer: BrowserDesk with the service (C4), in your company's access (C2), with its own password and access without consent (D2).
• A personal user account in the access. The administrator creates it (B5). The shared access password does not sign you in to "My devices".
• For the second factor: an authenticator app on your phone, for example Microsoft Authenticator, Google Authenticator or Aegis.
• At home: a current browser — or BrowserDesk on your computer.

How to do it

Set up once at the office

1. Install BrowserDesk and set up the service so the computer is reachable even when nobody is signed in (C4).
2. Add the computer to the access: Einstellungen › Fernzugriff (Settings > Remote access) → card Zugang (access) → sign in with your user → switch on Dieses Gerät hinzufügen (Add this device) (C2).
3. Set an own password for the computer and choose Automatisch zulassen (unbeaufsichtigt) (Allow automatically — unattended) (D2). Remember the password — you need it at home.
4. Note the computer's ID (start page, card Ihr Desktop — Your desktop). It helps you recognise it in the list.

Connect from home

1. Open browserdesk.de/app.
2. In the card My devices enter "Access", "User" and "Password", then Sign in.
3. If your account has a second factor: enter the code from the authenticator app.
4. Click your office computer on the left, then Connect.
5. In the dialog enter the "Device password" — the office computer's password, not your account password. Click Connect. The session opens in a new tab.
6. If the computer is offline and can be woken, there is Wake up. Waking goes through another BrowserDesk device in the same office network.

With the program instead of the browser: at home in BrowserDesk under Einstellungen › Fernzugriff (Settings > Remote access) sign in with your user and click Beitreten (Join). Your office computer then appears in the Adressbuch (Address book) (D3). If your account has a second factor, the window Zweiter Faktor (Second factor) asks for the code.

Set up the second factor

1. While signed in to "My devices", click Two-factor, then Set up.
2. Scan the QR code with the authenticator app. If that does not work, type the key shown below it into the app.
3. Enter the code from the app, then Activate. The page says "Second factor set up."
4. If your access requires the second factor, signing in walks you through Set up second factor by itself.

From now on every sign-in — in the browser and in the program — asks for a code from the app.

For the administrator

• Devices per person: in the console, at the access under users → the person's menu → Set devices. Default: all devices of the access (B5).
• Require the second factor: Second factor required for users in the access's policies.
• Phone lost: Reset second factor in the person's menu.

How you know it worked

The new tab shows your office computer's screen; the tab carries its name.

What the other side sees

Nobody is at the office computer. On Windows, a small session window with your user name appears there for the duration of the session (F2).

Good to know

• Two passwords: the account signs you in to "My devices". The device password opens the computer. They are separate.
• The sign-in applies only to this browser tab and lasts at most 8 hours. Sign out ends it at once.
• A code is valid only once. If you sign in twice in quick succession, wait for the app's next code.
• After setting up the second factor, the program also has to sign in again — with a code.
• Turning it off: Two-factor → enter the current code → Turn off. If your access requires the second factor, only the administrator can reset it.
• There are no recovery codes. If the phone is gone, the administrator resets it.

If it does not work

What it is for

Normally every connection goes through a relay — even when your computer and the device sit next to each other in the same network. If the internet is down, or the workshop has none at all, nothing works. With direct LAN you connect to the device directly by IP address or computer name. A fingerprint makes sure you really talk to the right device.

What you need

• The administrator's approval: in the console, Allow direct LAN connections (without relay) must be switched on for the device or the access. It is off by default. The approval cannot be set at the device itself.
• At the device: BrowserDesk version 20261010.43 or later on Windows, macOS or Linux, with the switch Direkte Verbindungen im eigenen Netz annehmen (Accept direct connections in the own network) switched on.
• On your side: the BrowserDesk program on your computer. Direct LAN does not work in the browser.
• Both in the same network: home or company network, also a cable straight between two computers. It does not work over VPN networks such as Tailscale.
• The device password (D2).
• Firewall: on Windows, TCP port 47420 has to be open in the private network. BrowserDesk does not change the firewall itself.

How to do it

How you know it worked

The session window with the device's screen opens — even without internet. The history lists the session as "Direkt …" (direct …) with the address.

What the other side sees

The same as via the relay: password, lock-out after failed attempts and the question Zugriff erlauben? (Allow access?) apply unchanged (F1).

Good to know

• The access's rules do not apply here. Without a relay nobody checks, for example, "control only from the own access". That is why the administrator's approval is needed. The rights at the device (control, files …) apply as usual.
• Log: the device records every direct connection locally and reports it to the relay as soon as the relay is reachable again.
• Only addresses from the own network are accepted. One session at a time.
• Reinstalled: after a reinstallation the device has a new fingerprint. BrowserDesk then warns you.
• Restarting BrowserDesk remotely is not available in direct mode.
• Approval withdrawn: the device closes direct access as soon as it signs in to the relay again.

If it does not work

What it is for

Four tills, six machine PCs or a training room: instead of opening each computer on its own, the control room ("Leitstand") shows them at once as tiles in a matrix. Every tile stays live. A click into a tile brings the computer up large in the usual session window; from there you return to the overview without the connection dropping. For a wall nobody operates there is the tour, which shows one computer after another full screen.

What you need

• Licence feature leitstand: - Own relay: a licence with the control room. You can test it once per installation for ten days (console → Licence → Try for 10 days). - Cloud: the control-room feature for your access (A6, prices). - Free: not available.
• BrowserDesk on a computer running Windows, Linux or macOS. There is no control room on phones or in the browser.
• The computers' passwords — most conveniently saved in the address book (D3).

How to do it

1. Open Leitstand (control room) in the sidebar. If the item is dimmed with a padlock, the feature is missing (see "If it does not work").
2. Choose the matrix at the top: 1×2, 2×1, 2×2 (default), 2×3 or 3×3.
3. In a free slot click Rechner wählen … (Choose computer …). The window Rechner für diesen Platz (computer for this slot) lists Geräte des Zugangs (devices of the access, online first) and below them your Adressbuch (address book). Filter with Name oder Kennung suchen … (search name or ID …), then pick a device.
4. Click Alle verbinden (Connect all) — or Verbinden (Connect) in a tile's menu. If your access keeps support reasons, BrowserDesk asks once for all slots. The password comes from the address book; if it is missing, a window "Zugriffskennwort — …" (access password — …) asks for each slot in turn.
5. Zoom in: click a connected tile. "Steuern wird beim Relay angefragt …" (asking the relay for control …) appears briefly at the bottom, then the session window opens. Control works as usual here.
6. Back: the orange button Zurück zum Leitstand (Back to the control room) on the right of the floating toolbar. The connection stays up.
7. Full screen: the button on the right of the header shows only the matrix across the whole screen. Vollbild verlassen (Leave full screen) or Esc returns.
8. Tour: next to the full-screen button there is the play icon and the seconds field (default 10, 3 to 600). Play switches to full screen and shows one connected computer after another. Rundgang beenden (End tour) stops it.
9. Disconnect: Trennen (Disconnect) in the tile's menu or Alle trennen (Disconnect all) at the top. Gerät wechseln … (Change device …) and Platz leeren (Clear slot) are in the same menu.

How you know it worked

• Every tile shows a live picture, a green dot, name, ID and latency.
• The sidebar shows "Leitstand · n" with the number of connected slots.
• During the tour the header says, for example, "Rundgang · 2 von 4 · alle 10 s" (tour · 2 of 4 · every 10 s).

What the other side sees

For each device it is a normal session: depending on the settings, the dialog Zugriff erlauben? (Allow access?) and, during the session, the session window (F1). As long as the tile is small, no input arrives from it.

Good to know

• Nothing is controlled in the matrix. Mouse and keyboard only reach the computer once you have zoomed in. The tour does not control anything either.
• Tiles are throttled (a few frames per second) so nine computers do not fill the line. Zoomed in, the full frame rate runs.
• "nur Ansicht" (view only) on a tile means: it is not being controlled right now.
• The matrix is remembered with its devices. When you open it again, BrowserDesk does not connect by itself.
• Switching pages in the program keeps the sessions running.
• A device appears only once in the matrix; ones already placed show as "schon in der Matrix" (already in the matrix) in the picker.
• Making the matrix smaller disconnects the slots that disappear. BrowserDesk asks first (Matrix verkleinern? — make matrix smaller?).

If it does not work

What it is for

The connection does not come about or drops. BrowserDesk almost always says why — in one sentence. This page translates every sentence: what it means and what you can do. Look for your sentence in the tables below.

What you need

• The sentence you see (best write it down or take a screenshot).
• For some remedies: the person at the device or the administrator of your access.

How to do it

1. Find the sentence. - In the program: the window Verbindung fehlgeschlagen (connection failed) states the reason. Close it with OK. If a running session ends, the window Verbindung beendet (connection ended) appears. - In the browser (D4): the reason is in the status line. Red means: final, the browser does not try again. Orange with "neuer Versuch (…)" (new attempt) means: it keeps trying by itself.
2. Look it up in the tables. The sentences are quoted word for word.
3. Is the error on the device itself? Then use the last table: the device is not even signed in at the relay.
4. Is it the network? In the program choose Einstellungen › Netzwerk (Settings > Network) → card Netzwerktest (Network test) → Test starten (Start test). The test checks step by step where the network gets stuck. Diagnose exportieren (Export diagnostics) creates a report for support.

Refusals at the device: password, consent, picture

Refusals by the relay: access, seats, licence

Device not reachable or network problems

On the device itself: "Dieser Rechner ist nicht angemeldet"

If the device cannot sign in at the relay, nobody can reach it. The device's program then shows, on the left under Dashboard in the card Ihr Desktop (Your desktop), a box "Dieser Rechner ist nicht angemeldet" (this computer is not signed in, red) or "Verbindungsproblem" (connection problem, yellow) with the reason. The box contains the button Neu registrieren (Register again).

How you know it worked

• The session opens and you see the device's screen.
• On the device, the box in the card Ihr Desktop has gone.

What the other side sees

• With a refusal because of password, licence, seats or network: nothing. The person at the device does not notice.
• With Zugriff erlauben? (Allow access?) they see your request. If they deny or do not answer, you get the sentence from the first table.

Good to know

• Some refusals are final: wrong password, lock, denial at the device, disconnection by the person, no access. The program then deliberately stops trying — repeating would only count further failed attempts.
• The browser repeats others by itself: device offline, Free session in use, relay update.
• Administrators see more: the administration shows for every device why it was rejected when signing in (G20).
• Some sentences still come in English ("unknown or offline host", "host is blocked") or say "Mandant" (tenant) instead of "Zugang" (access). They mean the same.

If it does not work

What it is for

If the computer you control has two or more screens, you first see the primary screen. In the session you switch to another one with two clicks — or you have all screens shown side by side in one picture.

What you need

• A running session (D2, D4).
• A device with at least two screens. With only one screen there is nothing to choose.
• Controlled system: switching is described and measured on Windows devices. It is not described separately for Mac and Linux.
• Viewer: the BrowserDesk program (Windows, Mac, Linux) and the browser. On a phone or tablet the same menu sits in the bar above the picture.

How to do it

In the program:

1. Click the Ansicht (View) icon in the bar at the top.
2. Under MONITOR every screen is listed with its resolution and a small preview above it. The primary screen has a star (★), the one currently shown a tick.
3. Click the screen you want.
4. All at once: choose Alle Monitore (All monitors). The entry shows the combined size of all screens.

In the browser: the same via the screen icon Ansicht → section "Monitor". There the entries are called "Monitor 1", "Monitor 2" … with resolution; the primary screen is marked "(Haupt)" (primary).

How you know it worked

• The picture shows the chosen screen; the menu shows the tick (browser: the entry is highlighted).
• The browser reports the chosen entry in its status line.

Good to know

• Screens are counted again and again. If someone at the device plugs a monitor in or out, or a monitor wakes from standby, it appears in the list after a few seconds. If the screen you are watching disappears, the picture jumps to the primary screen.
• Zoom and view position are reset when you switch.
• Resolution at the device: if you changed the resolution of a screen (E2), BrowserDesk restores it when you switch to another screen.
• "Alle Monitore" and H.264: with Alle Monitore the device never uses the graphics-card path (E4).
• In the browser, a second click on the same entry acts as a retry — useful when the switch did not get through on a poor connection.

If it does not work

What it is for

Virtual machines and computers without a monitor often run at 1024 × 768 or at a resolution that does not suit your window — the picture is tiny or blurry. You can change the device's resolution for the session. It is a temporary change: when the session ends, BrowserDesk restores the old resolution.

What you need

• Controlled system: Windows. It does not work on Mac and Linux devices yet.
• Viewer: the BrowserDesk program. The browser viewer does not have this item.
• You must be in control. Someone who only watches does not see the item.
• BrowserDesk version 20261010.27 or later on the device.

How to do it

1. In the bar click Ansicht (View), then Auflösung am Gerät … (Resolution on the device …).
2. The dialog Auflösung am Gerät lists the resolutions the screen offers, largest first. The original one is marked Original, the largest one that fits completely into your window passt in Ihr Fenster (fits your window).
3. Click a resolution — or An mein Fenster anpassen (Fit to my window).
4. Close the dialog with Schließen (Close).

Back to the old resolution: Ansicht → Auflösung am Gerät … → Zurück auf Original (Back to original). Otherwise this happens by itself (see below).

How you know it worked

• The picture rebuilds briefly and shows the screen at the new resolution.
• If you open the dialog again, it shows the button Zurück auf Original — it only appears while the resolution is changed.

What the other side sees

The screen at the device visibly changes its resolution. Windows and text there change size until the session ends.

Good to know

• The old resolution comes back when the last viewer leaves the session, on Zurück auf Original and when you switch to another monitor (E1). If BrowserDesk on the device ends unexpectedly before that, it restores the resolution at its next start.
• Only one screen at a time is changed. If you switch monitors, the previous one goes back.
• Nothing is stored permanently: the setting does not end up in the Windows configuration.
• Scaling stays: if the device is set to 150 %, for example, text looks large at a small resolution. That is a Windows setting.
• Without a monitor Windows often offers only 1024 × 768. The virtual monitor helps there (E25).
• Every change is recorded in the relay's log.

If it does not work

What it is for

On a weak connection the picture stutters or reacts late; on a good one it should be sharp. In the session you choose between three levels, switch off the wallpaper and animations on the device, and show a measurement panel that tells you what is being transmitted.

What you need

• A running session. The quality applies to all controlled systems (Windows, Mac, Linux).
• Background and animations off only works on Windows devices.
• Viewer: program, browser and the phone/tablet app have the quality levels. The analysis overlay exists in the program and in the browser.

How to do it

Quality in the running session (program):

1. Open Ansicht (View) in the bar.
2. Under QUALITÄT (quality) choose a level: - Bildqualität (picture quality) — sharp, needs the most data. - Ausgewogen (balanced) — the middle way. - Reaktion (20 fps, ½ Auflösung) (responsiveness — 20 fps, half resolution) — for weak connections: less data, 20 frames per second, half resolution from 1280 pixels width. The picture is deliberately less sharp then.
3. On a weak connection also click Hintergrund und Animationen aus (background and animations off). For the session the device shows no wallpaper and no window animations — fewer picture changes, less data.

Measurement panel: Ansicht → Analyse-Overlay (analysis overlay). A box with figures appears at the top right of the picture. Click again to hide it.

In the browser: the same under Ansicht: choose Qualität: Bildqualität, Qualität: Ausgewogen or Qualität: Reaktion (20 fps, ½ Auflösung), plus Hintergrund und Animationen aus and Analyse-Overlay.

Default for new sessions:

• Program: Einstellungen › Allgemein (Settings > General) → card Video & Verbindung (video & connection) → STANDARD-QUALITÄT (default quality). In the card Allgemein, Analyse-Overlay standardmäßig anzeigen (show analysis overlay by default) switches the panel on for every session.
• Browser: gear icon in the bar → Vorgaben für neue Sitzungen (defaults for new sessions) → choice "Qualität: …".
• Phone/tablet: tab Einstellungen (Settings) → Standard-Qualität (default quality).

How you know it worked

• The program briefly reports "Qualität: …" with the chosen level; the menu shows the tick.
• After Hintergrund und Animationen aus it reports "Hintergrund und Animationen am Host aus" (background and animations off on the host). The tick shows what the device actually applied.

Reading the analysis overlay

A line is missing when the device does not report the value — it never shows an invented zero.

Good to know

• The device adjusts by itself. If data backs up, it lowers the data rate and raises it again once the connection is free. The level sets the upper limit.
• Background and animations come back on the device when you switch the item off again. On Mac and Linux the item is greyed out and states the reason.
• Different names on the phone: in the app the default levels are called "Beste Qualität" (best quality), "Ausgewogen" (balanced) and "Geringe Bandbreite" (low bandwidth).
• The measurement panel blocks nothing: clicks on it go to the device.
• In full screen and on a phone the bar floats above the picture. If it covers something, move it by its handle; a double click on the handle puts it back at the top centre.

If it does not work

What it is for

Normally the device encodes the picture with the VP8 method on its processor. With H.264 the device's graphics card does this: measured on a Windows computer with an NVIDIA card, the processor load there dropped by about 95 %. The price: your own computer needs about twice as long to decode as with VP8. That is why you choose H.264 explicitly — the default "Auto" stays with VP8.

What you need

• Controlled system: Windows with a graphics card that can encode H.264. Mac and Linux keep sending VP8.
• Exactly one viewer in the session and no recording (E19).
• Viewer: the program or the browser. The item only appears if your device can decode H.264.
• Not with Alle Monitore (All monitors, E1).

How to do it

In the running session (program):

1. Open Ansicht (View) in the bar.
2. Under CODEC choose H.264 (GPU am Ziel) (H.264, GPU at the target).
3. Back: VP8 (schnell) (VP8, fast) or Auto.

In the browser: Ansicht → codec choice → H.264 (GPU).

Default for new sessions:

• Program: Einstellungen › Allgemein (Settings > General) → card Video & Verbindung (video & connection) → STANDARD-CODEC (default codec).
• Browser: gear icon → Vorgaben für neue Sitzungen (defaults for new sessions) → Codec: H.264 (GPU).
• Phone/tablet: Einstellungen (Settings) → Standard-Codec (default codec).

How you know it worked

• The program reports "Codec angefragt: …" (codec requested). Whether the device really sends H.264 is decided by the device.
• In the Analyse-Overlay (analysis overlay, E3) the "Host" line shows the codec the device actually uses.

Good to know

• "Auto" means VP8 — for every viewer available today. Every device can decode VP8, and the device adapts it to the connection during the session. H.264 only comes when chosen explicitly.
• With two or more viewers or during a recording it stays with VP8, even if you chose H.264.
• If decoding fails, your program switches the session back to VP8 by itself. The session continues.
• Only whoever is in control can change the codec.
• 60 frames per second: the device captures at 60 frames per second. Measured, 34 to 55 frames per second arrived with H.264 and 41 to 49 with VP8. How many you get also depends on how much changes on the screen.
• Only an NVIDIA graphics card has been measured. Intel and AMD graphics have not been measured.

If it does not work

What it is for

What you type should arrive at the device exactly as typed — including shortcuts, the Windows key and characters that need AltGr. The program, the browser and the phone take different paths for this. Here is what to watch out for.

What you need

• A session in which you are in control.
• For the Windows shortcuts in the menu: a Windows device. On Mac and Linux the group is missing.

How to do it

On a Windows computer (program): while the session window is in front, all keys and shortcuts go to the device — including the Windows key. Click into the picture if keys end up on your side instead of at the device.

On a Mac or Linux computer (program): shortcuts that your own system catches (for example the Super or Windows key) do not reach the device. The menu is there for that:

1. Open Eingabe (Input) in the bar.
2. Under WINDOWS-TASTE SENDEN (send Windows key) choose an entry: Windows (Start), Win + E (Explorer), Win + R (Ausführen) (Run), Win + D (Desktop) or Win + I (Einstellungen) (Settings).

In the browser: the browser cannot catch the Windows key itself. Eingabe → choice Windows-Taste senden… (send Windows key …) → choose an entry.

On a phone or tablet (app): at the bottom there is a bar with special keys: Bildschirmtastatur (on-screen keyboard), Strg (Ctrl), Alt, Shift, Win, Esc, Tab, the arrow keys and Entf (Del).

1. For a shortcut such as Ctrl+C: tap Strg — the key latches and lights up.
2. Then tap the second key (here "c"). Afterwards Strg releases by itself.
3. Tapping Win twice opens the device's Start menu.

Bildschirmtastatur shows and hides the phone's keyboard. The browser on a phone has a similar bar; if the on-screen keyboard does not open there, use Eingabe → Tastatur einblenden (show keyboard); if it covers the picture, Platz für Tastatur (room for keyboard).

How you know it worked

The character or action appears in the device's picture — for example the Start menu after Windows (Start).

Good to know

• The program sends keys, not characters. Which character results is decided by the keyboard layout on the device. Set the same layout on the device as on your side (for example both German).
• Exception AltGr (Windows program): characters you type with AltGr (@ { [ ] } \ ~ |) and the <> key next to the left Shift key are sent by the Windows program as finished characters. That way they also arrive correctly on a Mac, which puts these characters on other keys.
• The browser sends printable characters as characters. There the layout on the device does not matter.
• On-screen keyboard on a phone: it sends characters, umlauts included. An attached keyboard on an iPad sends keys like the program — then the layout on the device applies again.
• Mac as the device: Shift, Control and Option arrive reliably, also at the lock screen.
• Held keys are released by BrowserDesk when you leave the session, so nothing stays "stuck" on the device.
• Ctrl+Alt+Del only works via the menu: E6.

If it does not work

What it is for

Some things in Windows run on a protected screen: the lock and sign-in screen, the menu after Ctrl+Alt+Del and the User Account Control prompt ("Do you want to allow …"). With the BrowserDesk service on the device you can see and use these screens too. On Linux devices you reach the sign-in screen through a setting of its own.

What you need

• Windows device with the BrowserDesk service (C4). Without the service the protected screen stays hidden from you.
• Cloud or an own relay. Usually nobody sits at the lock or sign-in screen who could give consent; that only works with access without confirmation, so not with Free.
• Linux device: the setting "Zugang vor der Anmeldung" (access before sign-in, see below).
• Mac: there is no Ctrl+Alt+Del. You unlock a locked Mac by typing its password (E5).
• Viewer: program, browser and app have the item in the Eingabe (Input) menu.

How to do it

How you know it worked

• After Strg+Alt+Entf the viewer reports "Strg+Alt+Entf gesendet" (sent), and the Windows Ctrl+Alt+Del menu appears in the picture.
• Your clicks and keys work at the lock screen and in the UAC prompt.

What the other side sees

• The UAC prompt and the lock screen as usual — your input appears there.
• Linux: via "Zugang vor der Anmeldung" you get a remote session of your own, not the picture of the attached monitor. If you sign in this way, the screen on site shows "Sitzung läuft bereits" (session already running). After sign-in BrowserDesk shows the real screen again.

Good to know

• Why the service is needed: on Windows only a program with system rights can show and operate these screens. Even "run as administrator" is not enough.
• The switch takes a few seconds. A UAC prompt is only taken over once it has been up for a good second; the service checks every three seconds.
• On Mac and Linux devices Strg+Alt+Entf is greyed out and states the reason.
• Restarting, signing out and being reconnected afterwards: E17.

If it does not work

What it is for

On a laptop you scroll with two fingers on the trackpad — that should work on the device just like the mouse wheel. On a phone or tablet there is no mouse: there you move the pointer with your finger, click by tapping, zoom with two fingers and scroll with a mouse wheel at the edge of the picture.

What you need

• A session in which you are in control. The controlled system does not matter (Windows, Mac, Linux).
• Laptop trackpad: the BrowserDesk program, version 20260923.1 or later. Confirmed with a Windows laptop; a Mac as the viewer has not been tested.
• Gestures: the app on a phone or tablet, or the browser on a phone.

How to do it

On a laptop (program): swipe with two fingers on the trackpad, vertically or horizontally. The device scrolls where the pointer is. If the pointer is over the bar, nothing happens on the device.

On a phone or tablet (app): the default is trackpad mode — the phone display works like a trackpad:

• Switch: tab Einstellungen (Settings) → Trackpad-Modus (trackpad mode), or in the session Steuerung (Control) → Trackpad-Modus.
• Mouse wheel at the edge: a strip stands to the right of the picture. Dragging on it scrolls on the device. In the bar at the bottom, Mausrad ausblenden / Mausrad einblenden (hide / show mouse wheel) hides and shows it.
• Undo the zoom: 1× in the bar at the bottom.
• A single right click by tap: Eingabe (Input) → Rechtsklick (nächster Tipp) (right click — next tap); the next tap becomes a right click.

In the browser on a phone: a hint in the picture sums it up: sliding a finger moves the pointer, a tap clicks, a long press is a right click, two fingers scroll, two fingers apart zoom. Steuerung → Trackpad-Modus switches between moving the pointer and tapping directly.

How you know it worked

• The content on the device scrolls with your fingers.
• On the phone a ring shows where the next tap will click.

Good to know

• A two-finger gesture is either zoom or scroll, not both. The app decides once, shortly after the fingers touch down, and keeps that until you lift them. Afterwards the last finger lifted does not trigger a click.
• Pinch-zooming on the laptop trackpad has no effect in the program — only scrolling.
• On a Windows touch screen (program) there is only vertical scrolling, no zoom and no bar with special keys.
• Half a scroll step left over at the end of a movement is dropped; the picture does not jump afterwards.
• Special keys on the phone: E5.

If it does not work

What it is for

You want to give the device a file — an installer, a document — or fetch a file from it. There are two ways: Datei senden (send file) for the quick way to the device, and the Dateimanager (file manager), where you browse the folders on both computers and copy in both directions.

What you need

• A running session. The controlled system does not matter (Windows, Mac, Linux).
• File transfer must be allowed at the device: Einstellungen › Sicherheit (Settings > Security) → card Interaktion & Berechtigungen (interaction & permissions) → Dateiübertragung erlauben (allow file transfer).
• Viewer: program and browser can do both. On iPhone and iPad there is Datei senden via the system's file picker; not yet on Android phones.

How to do it

Quickly send a file to the device (program):

1. In the bar Dateien (Files) → Datei senden.
2. In the window Datei senden go to the file (Eine Ebene höher — one level up — leads up to the drive list) and click it.
3. Senden (Send). The file arrives in the Downloads folder of the user signed in at the device.

File manager (program), both directions:

1. Dateien → Dateimanager. On the left is Dieser Computer (this computer), on the right Entfernter PC (remote PC).
2. Go to the folder you want on both sides.
3. Select a file and copy it with the arrow in the middle: - to the right Zum entfernten PC senden (send to the remote PC) — into the folder open on the right; - to the left Auf diesen Computer holen (fetch to this computer) — into the folder open on the left.
4. The line at the bottom shows the progress and then the result.

In the browser:

• Dateien → Datei senden opens the browser's file picker; you can choose several files.
• Or drag files from Explorer or Finder into the session window. "Dateien hier ablegen" (drop files here) appears; the files go to the Downloads folder on the device.
• Dateien → Dateimanager: for the left side first click Ordner wählen… (choose folder …) — the browser may only show your folders once you grant one.

On iPhone or iPad: Dateien → Datei senden opens the system's file picker. Received files are in the Files app under BrowserDesk; the message afterwards offers Teilen (Share).

How you know it worked

• Program: at the bottom of the file manager "Gesendet: …" (sent) or "Datei übertragen (…)" (file transferred); after fetching, "Datei geladen: …" (file loaded) with the location.
• Browser: with several files the status line reports "… Dateien gesendet" (files sent).

What the other side sees

• The file appears in the Downloads folder or in the folder you chose in the file manager.
• The session window on the device has the switch "Datei" (file). If the person switches it off, no transfer goes through any more (F1).

Good to know

• Single files only, no whole folders. At most 500 MB per file; empty files are not transferred.
• Protected places: some files the device never hands out — such as BrowserDesk's own data, password stores, SSH keys and browser profiles. Nothing can be written into the Startup or Windows folder.
• Log: every transfer is recorded in the relay's log with file name and size.
• Files the person at the device puts out for you: E9. Copying with Ctrl+C / Ctrl+V: E11. A whole stick or folder as a drive: E22.

If it does not work

What it is for

The person at the device has a file you need — a photo, a log, a document. Instead of searching for it in the file manager, you show the drop ring on the device. The person drags the file onto it, and you download it on your side.

What you need

• Controlled system: Windows. The drop ring only exists there.
• File transfer must be allowed at the device (E8). You do not need control — someone who only watches may collect files too.
• Viewer: the program or the browser.

How to do it

How you know it worked

• The file is listed under Bereitgestellte Dateien.
• After downloading, the program reports "Datei geladen: …" (file loaded) with the location.

What the other side sees

The ring, as long as you show it. It disappears when you hide it or when the last viewer leaves the session.

Good to know

• The ring does not appear by itself — you show it when needed.
• Only what was dropped can be downloaded. You see nothing else of the file system.
• Remove from the list: in the program Aus der Freigabe entfernen (remove from sharing) next to the file.
• Log: every file provided is recorded with name and size in the relay's log.
• The same limits apply as when fetching in the file manager: at most 500 MB per file (E8).

If it does not work

What it is for

You copy some text on your side — a password, a command, an address — and want to paste it on the device, or the other way round. In the BrowserDesk program this works without a click. In the browser and on a phone you send or fetch the text with a menu item.

What you need

• A running session. The controlled system does not matter (Windows, Mac, Linux).
• The clipboard must be allowed at the device: Einstellungen › Sicherheit (Settings > Security) → card Interaktion & Berechtigungen (interaction & permissions) → Zwischenablage synchronisieren (sync clipboard).

How to do it

In the program (Windows, Mac, Linux):

1. Copy text on your side (Ctrl+C).
2. Click the target spot in the device's picture and paste (Ctrl+V).

The other way round works the same: what you copy on the device is in your clipboard shortly afterwards. By hand it works via Eingabe (Input) → Zwischenablage senden (send clipboard) or Zwischenablage holen (fetch clipboard).

In the browser: nothing syncs by itself here.

1. Copy text on your side, then Eingabe → Zwischenablage senden. Then paste on the device with Ctrl+V.
2. From the device to you: copy on the device, then Eingabe → Zwischenablage holen. The text is now in your clipboard.

On a phone or tablet (app): text you copy on the device arrives by itself. For the other direction, tap Zwischenablage senden in the bar at the bottom.

How you know it worked

• Program: in the bar next to Trennen (Disconnect) a message with a green dot appears briefly — "Zwischenablage vom Host übernommen" (clipboard taken from the host) or "Zwischenablage an Host gesendet (… Zeichen)" (clipboard sent to the host, … characters).
• Browser: "Zwischenablage gesendet (… Zeichen)" (clipboard sent) or "Remote-Zwischenablage übernommen (… Zeichen)" (remote clipboard taken).

What the other side sees

Nothing special. The session window on the device has the switch "Ablage" (clipboard). If the person switches it off, no clipboard is exchanged any more (F1).

Good to know

• iPhone and iPad only read the clipboard at the push of a button. iOS shows a notice on every read; that is why the app does not read by itself.
• The browser needs your permission and a secure connection (HTTPS) to read or write the clipboard. If it asks, allow it.
• Copied files and pictures also go through the clipboard in the program: E11.

If it does not work

What it is for

You select files in Explorer, Finder or a file manager, press Ctrl+C — and paste them on the other computer with Ctrl+V. The direction does not matter. The same applies to a copied picture, such as a screenshot or "Copy image" in a browser.

What you need

• Viewer: the BrowserDesk program on Windows, Mac or Linux. The browser can do it in a limited way (see below); phones and tablets cannot — there only text works (E10).
• Controlled system: Windows, Mac or Linux with BrowserDesk 20261002.8 or later (Mac 20261003.6 or later). Pictures from 20261008.17.
• Clipboard AND file transfer must be allowed at the device: Einstellungen › Sicherheit (Settings > Security) → Interaktion & Berechtigungen (interaction & permissions) → Zwischenablage synchronisieren (sync clipboard) and Dateiübertragung erlauben (allow file transfer). If either is off, only text works.

How to do it

From you to the device (program):

1. Select files on your side and press Ctrl+C (Mac: Cmd+C).
2. Up to 100 MB the device fetches them at once. Above that the bar shows the message "… ist groß für die Zwischenablage." (is large for the clipboard) with the button An Host übertragen (transfer to host) — only then do they go.
3. Click the target spot in the device's picture (e.g. a folder in Explorer) and press Ctrl+V.

From the device to you (program):

1. Select files in the device's picture and press Ctrl+C.
2. Up to 100 MB your program fetches them at once and reports "Vom Host in die Zwischenablage: … — mit Strg+V einfügen" (from the host into the clipboard — paste with Ctrl+V). Above that "Am Host kopiert: …" (copied on the host) appears with Übernehmen (take over).
3. Go to the target spot on your side and press Ctrl+V.

Pictures work the same way: copy, paste at the other end — for example into Paint, Word or an e-mail. The message then reads "Bild vom Host in der Zwischenablage (…) — mit Strg+V einfügen" (picture from the host in the clipboard).

In the browser:

• From the device to you: if someone copies files on the device, the browser reports "Am Host kopiert: … — „Zwischenablage holen“ lädt sie herunter" (copied on the host — "fetch clipboard" downloads them). Then Eingabe (Input) → Zwischenablage holen (fetch clipboard): the files arrive as downloads (folders without subfolders). A picture arrives as a PNG file.
• From you to the device: copy files on your side, click into the session picture and press Ctrl+V — the browser sends them to the Downloads folder on the device. Zwischenablage senden (send clipboard) sends a copied picture there too.

How you know it worked

In the bar next to Trennen (Disconnect) there is a message with a coloured dot: green done, yellow waiting for your decision, orange running, red error. After sending to the device, for example "… Dateien (…) liegen in der Zwischenablage des Hosts" (… files are in the host's clipboard).

Good to know

• Limits: at once up to 100 MB, above that only on your click; at most 2 GB in total, at most 500 MB per file, at most 2000 entries. A picture at most 64 MB.
• Only the receiver fetches. Large amounts never go over the line unasked — you always decide.
• Folders are copied with their content (in the program).
• Incomplete means nothing. If a transfer breaks off, nothing lands in the clipboard — better no files than half of them.
• Files come before pictures: if you copied a picture file in Explorer, it arrives as a file, not as a picture.
• Other side on an older version: a picture arrives there as a PNG file.
• Clipboard folder: received files sit in an intermediate folder until you paste them; it is emptied on the next receipt. Paste them with Ctrl+V to their destination instead of working there.
• Log: every transfer is recorded with name, number and size, never with content.

If it does not work

What it is for

Sometimes one sentence is enough: "Please save your file for a moment." Every session has a chat for that. The technician writes in the session window, the person at the device sees the message and can reply.

What you need

• A running session (D2, D1 or D4).
• Technician: the BrowserDesk program on a computer or web access in the browser.
• At the device: BrowserDesk on Windows, macOS or Linux. No licence and no right in the console are needed.

How to do it

How you know it worked

• Your own message is on the right of the chat panel.
• The reply of the person at the device appears on the left below it.

What the other side sees

The person at the device sees your message as a notice "Chat: …" in the BrowserDesk window. There is no history on that side — each message arrives on its own.

Good to know

• The person at the device can only reply. They cannot start a chat themselves.
• A message has at most 2000 characters. Control characters are removed, empty messages are not sent.
• A reply goes to everyone connected to the device at that moment.
• Messages count as activity: if the device disconnects idle sessions (E32), every message keeps the session open.
• With sound: if you would rather talk, see E13.

If it does not work

What it is for

Instead of a phone call on the side, the technician and the person at the device talk directly in the session. If wanted, the technician also hears what sounds on the device — an error beep, a video, a ringing.

What you need

• A running session that goes direct. Through the relay tunnel there is no sound (E33).
• Technician: BrowserDesk on a Windows, Mac or Linux computer or web access in Chrome or Edge, plus a microphone. Phones and tablets offer no sound.
• Device: BrowserDesk from version 20261010.22. The device's sound exists only on Windows devices.
• For the device's microphone: someone there who agrees. Only whoever is controlling can ask for the device's microphone.

How to do it

How you know it worked

• In the Ton menu the switched-on item has a tick, the icon is red.
• You hear the device's sound or the person at the device.

What the other side sees

• The question Mikrofon einschalten? with your name and the sentence that only you listen in this session and nothing is recorded.
• On Windows the system itself shows its microphone icon while the device's microphone is open.

Good to know

• Sound is never recorded — not even when the session is recorded (E19).
• No microphone without consent. No setting and no rule of the access can allow it in advance.
• The technician cannot agree on their own: while the question is open at the device, the device ignores their clicks and keys. They get a notice about it.
• After a "no" they can ask again only after 30 seconds.
• At the sign-in screen or with no user signed in, nobody can agree — the microphone stays off.
• A running conversation counts as activity for idle disconnection (E32).

If it does not work

If an item in the Ton menu is greyed out, the reason is shown next to it:

What it is for

"Click here" — and you show the spot without clicking yourself. With the laser pointer a red dot follows your mouse, with the pen you draw a red stroke around the spot. The person at the device sees it on their screen, you see it in the transmitted picture.

What you need

• A Windows device with BrowserDesk from version 20261010.21. Mac and Linux have no drawing layer.
• The control right in the session.
• Technician: BrowserDesk on a computer or web access. In the browser you draw with the mouse, not with a finger.

How to do it

1. Program: click the pen icon Zeichnen (Draw) in the session bar. Browser: menu Steuerung (Control) → selection "Zeichnen: …".
2. Choose a tool: - Laserpointer (browser: Zeichnen: Laserpointer) — the dot follows your mouse. - Stift (Pen; browser: Zeichnen: Stift) — draw with the mouse button held down.
3. Remove the drawing: Zeichnung löschen (Clear drawing).
4. Back to controlling: Wieder steuern (Zeichnen aus) (Control again — drawing off; browser: Zeichnen: aus (steuern)).

In the program the pen icon is red while drawing is on.

How you know it worked

You see the red dot or your strokes in the device's picture.

What the other side sees

• Red strokes and a red dot with a white rim above all windows (F15).
• The laser dot disappears 1.5 seconds after the last movement.
• The drawing only lies on top: the person at the device can keep clicking as usual.
• When the last connection ends, everything disappears.

Good to know

• In drawing mode no input reaches the device. Your mouse only draws. If "nothing happens", the pen is still on.
• At the sign-in or lock screen and in the Windows User Account Control dialog there is no drawing layer.
• Very long drawings are limited: the oldest strokes drop out.

If it does not work

What it is for

Sometimes the technician wants to show something on their own computer: "this is how it looks on my side", a guide, a form. Their screen then appears at the device in a window of its own — the session in the other direction keeps running.

What you need

• A Windows device with BrowserDesk from version 20261010.44, or a Mac or Linux device from 20261019.1, with a user signed in.
• A direct connection — not through the relay tunnel (E33).
• The control right in the session. Only one person can show at a time.
• Technician: BrowserDesk on a computer or web access in the browser. It does not work from a phone or tablet.
• Someone at the device who agrees.

How to do it

How you know it worked

The menu says "Das Gerät sieht Ihren Bildschirm.", the icon is red.

What the other side sees

A window with your screen, about three quarters of the size of the main screen, with a strip "Techniker zeigt seinen Bildschirm" and Schließen at the top. The own screen of the person at the device stays as it is.

Good to know

• You do not see the window in your picture of the device — you see what lies behind it. That avoids a "picture in a picture in a picture". On Linux you see a black area in its place. Windows versions before 10 (2004) and Linux with Wayland cannot do this; then you see the window as well.
• Better show a different screen from the one your session window is on — otherwise the person at the device sees their own desktop in your picture.
• You cannot agree on their behalf: while the question is open at the device, the device ignores your clicks and keys.
• After a "no" you can ask again only after 30 seconds.
• The window at the device closes when the session ends.

If it does not work