Only people you invite in to your team can sign in to VNC Viewer and discover your computers. (So only invite people you trust!) Note with a Professional or Enterprise subscription you can further restrict discovery by assigning permissions on the Computers page of your RealVNC account to precisely match computers with people.

If a person cannot discover your computers then they cannot possibly establish cloud connections to them; there’s no way to bypass our discovery service.

Note that if you have an Enterprise subscription and intend to establish direct connections, it is possible for a malicious entity to sniff the port you’ve opened in the remote computer’s firewall (5900 TCP by default). It’s much safer to use cloud connectivity over the Internet!

Only people in your team with permission to discover computers can sign in to VNC Viewer and attempt to connect to them.

To complete a connection, a team member must still enter the credentials expected by VNC Server running on that computer.

So computers are protected twice, by independent password mechanisms: the RealVNC account system controls discovery, and the VNC Server authentication scheme polices connectivity.

VNC Server has a unique digital signature designed to help keep you safe online. This is a hexadecimal representation of a 2048-bit RSA public key hash, which (in the real world) means it’s a six-word memorable catchphrase, for example “Omega Chris Chicago. Alabama arrow network”. Download our whitepaper for the technical details.

When you connect, the RealVNC services automatically verify this identity, and VNC Viewer additionally prompts you to check it yourself. If you’re subsequently warned that the catchphrase has changed, it might indicate that someone has tampered with the computer, or is trying to intercept your connection (a ‘man-in-the-middle’ attack).

Note that if you have an Enterprise subscription and establish a direct connection, then the RealVNC services cannot perform this automatic check, so you should do so yourself.

Yes. VNC Server password-protection is turned on permanently.

VNC Server's authentication scheme is completely separate from your RealVNC account, so even if a malicious entity learns your account credentials and signs in to VNC Viewer as you, they still cannot connect. And if they try to guess the VNC Server password (a 'brute force' or 'dictionary' attack), they’ll be blacklisted.

Note you can ask VNC Viewer to remember VNC Server passwords for you as a convenience. If you do, we recommend setting a master password on VNC Viewer's Preferences > Privacy page.

If you have a Home subscription, there’s only one VNC Server authentication scheme. Make sure the password you’re prompted to create when you install VNC Server is difficult to guess, and keep it safe. You must specify at least 6 case-sensitive letters, numbers, and special characters such as !@*#&, though we recommend more.

If you have a Professional or Enterprise subscription, then by default VNC Server is integrated into the credentialing mechanism of the remote computer, so you don’t have to create or remember yet another password. Simply connect using the same user name and password you normally use to log on to your user account on that computer. You can register other users with VNC Server so they can connect using their own familiar system account credentials if you wish.

If you have a Professional or Enterprise subscription, you can change the default system authentication scheme to specify multi-factor authentication for VNC Server.

If you have an Enterprise subscription and a suitable corporate network, you can set up single sign-on (SSO) for VNC Server.

The first time you use VNC Viewer to connect to a computer, you must enter the password expected by VNC Server.

Subsequently, you can ask VNC Viewer to remember this password so you don’t have to enter it each time. If you do, we additionally recommend setting a master password for VNC Viewer in case you lose or share your device:

VNC Viewer stores passwords locally and never syncs them to other devices via our cloud service (so you’ll have to remember them on each device you connect from). Download our whitepaper for the technical details.

Note you can sign out remotely from all VNC Viewer devices if you think your account has been compromised. Sign in to your RealVNC account and navigate to the Security page.

Your RealVNC account credentials (email address and password) are important; please do not share them with anyone! You need them them each time you:

• Sign in online to manage computers, people, billing and more.
• Sign in to VNC Server to apply your subscription.
• Sign in to VNC Viewer to discover team computers and sync your address book.

Your account password must be at least 8 characters long and should not be the same as a VNC Server password, nor that of any other online service you use.

Note that if you invite someone in to your team to share remote access, that person sets up their own RealVNC account in the process of accepting your invitation. They never need to know your RealVNC account credentials.

We recommend enabling 2–step verification on the Security page of your RealVNC account.

Yes.

For your RealVNC account, we recommend enabling 2-step verification on the Security page. Every time you sign in, you'll be prompted to enter a unique TOTP code generated by the Google Authenticator app on a convenient mobile device.

If you have a Professional or Enterprise subscription, we recommend setting up multi-factor authentication for VNC Server.

Yes. VNC Server automatically logs audit information, so you have a complete record of who’s connected, when, from where and, if the user successfully authenticated, the time of disconnection (so you can calculate session length).

The storage destination for this information differs depending on the platform and VNC Server mode. General information about logging is available here.

Note you can quickly dial up the logs to debug level if you need.

Security is at the heart of our business so we publish information about potential vulnerabilities as soon as we find them.

Follow the instructions below. Note if you have an Enterprise subscription, you can perform bulk operations on computers remotely using policy. This has the additional security benefit of locking down computers and preventing change by users.

1. Buy an Enterprise subscription.
2. Choose a complex RealVNC account password and turn on 2-step verification on the Security page.
3. If you wish to share remote access, only invite people you trust in to your team.
4. Insist these people choose complex passwords for their own RealVNC accounts, and also turn on 2-step verification.
5. Assign permissions on the Computers page of your RealVNC account to restrict discovery appropriately.
6. For each remote computer:
• Install VNC Connect in a secure location (such as C:\Program Files), and turn on update notifications.
• Upgrade to 256-bit AES session encryption.
• Turn off direct connectivity. Only establishing cloud connections means no holes need be opened in firewalls.
• Enable multi-factor authentication for VNC Server.
• Restrict session permissions appropriately, perhaps to make particular users view-only.
• Harden blacklisting.
• Lower the idle timeout.
• If the owner will be physically present to approve connections, turn on query connect.
• Lock the remote desktop when the last user disconnects.
7. Review connection logs on a regular basis.