Latch by Bardbro
Download

Latch 4.1.0 Remote desktop over Tailscale Release notes

Your machines,
on any of your machines.

Latch streams a whole desktop, full screen, over your own Tailscale network. Mac, Windows, Linux and a VPS container run the same app: each one lists the others, and each one can share its own desktop.

Download 4.1.0 Source on GitHub
The Latch window on its Machines tab, listing four machines: MacBook-Pro, this Mac, shared; Gaming-PC, a Windows PC, relayed via Tokyo at 210 ms; Office, a Windows PC that is asleep, with a Wake and connect button; and Den, a Linux machine without Latch. Below, the next stream: 2560 × 1600, 60 fps, 50 Mbps.
Fig. 1 The machine list. Every machine on your Tailscale account, and what it can do right now.

01Session

Open Latch. Click Connect. The desktop appears.

Every install lists every other machine on your Tailscale account and can open its desktop. There is no host or client role to choose.

  1. Step 1

    Set up sharing.

    On the computer you want to reach, open the Sharing tab. On Windows, Set up as administrator takes one administrator prompt: it installs the streaming engine as a service, opens the control port to your tailnet only, turns Fast Startup off and arms the network card for Wake-on-LAN. A Mac asks for Screen Recording once.

    The Sharing tab of Latch on a Windows PC named GAMING-PC, marked Shared. It lists the PC's Tailscale address, the streaming engine running on an NVIDIA encoder, a hard NAT note, Wake-on-LAN ready over Ethernet, and a missing game-controller driver with an Install controller driver button. Below are two paired devices, MacBook-Pro and Studio, and options such as letting other machines sleep, restart or shut the PC down.
    Fig. 2 A Windows PC, shared and ready.

  2. Step 2

    Connect. It pairs by itself.

    The first time, Latch picks a PIN and sends it over Tailscale to Latch on the other machine, which enters it for you. That machine’s certificate is pinned from then on. If a Windows PC is asleep, Latch wakes it and waits.

    Latch while connecting. A card reads Pairing with Gaming-PC and shows the PIN 4 8 2 1 in four boxes, with a note that this happens once per machine and that Latch on the other machine enters the PIN itself. A Cancel button is below.
    Fig. 3 First connection. Nothing to type.

  3. Step 3

    The desktop, and nothing else.

    Full screen by default. Click the picture and the mouse is captured, as in a game, so games that read raw mouse movement work. Ctrl+Alt (Control-Option on a Mac) is the host key, as in a hypervisor: it frees the mouse and drops this toolbar over the picture. The text clipboard follows you both ways.

    The stream toolbar: Gaming-PC, 1920×1080, 60 fps, HEVC; Relayed via Tokyo, 210 ms; the keys control and option hide this bar; then Mouse, Keys, Stats, Full screen, PC, Stream settings and Disconnect.
    Fig. 4 The stream toolbar on a Mac, as Control-Option drops it.
    1. Stream Machine, size, frame rate and codec as negotiated. The dot is blue while connecting, green while the stream is healthy and amber when the connection is poor.
    2. Path Direct, through your own relay or through Tailscale’s, with the round trip. Amber when Tailscale’s shared relays carry it.
    3. Host key Control-Option on a Mac, Ctrl+Alt elsewhere. Press it to free the mouse and show or hide this bar.
    4. Mouse Captured for raw movement, or free, where the cursor’s position is sent 1:1.
    5. Keys Ctrl+Alt+Del, Windows key, Alt+Tab, Esc, Print Screen, and what ⌘ does.
    6. Stats Bitrate and frame rate against what was asked for, round trip, packet loss and decode times.
    7. PC Sleep, restart and shut down, when the PC allows it.
    8. Stream settings Change resolution, frame rate, bitrate or codec; applying reconnects in a second or two.

02Network

Tailscale is the path and the identity check.

A machine answers only peers signed in to the same Tailscale account. There is no Latch account or password, and the control port is open to your tailnet only.

FromThis machine

  1. 1Direct WireGuard, peer to peer, when Tailscale can get through both routers
  2. 2Your peer relay A VPS you run with the relay kit. Needs Tailscale 1.86 or later
  3. 3DERP Tailscale’s shared relays, the last resort

ToYour other machine

Fig. 5 Tailscale picks the path in this order. Latch asks for the same picture on every path: a relay adds delay, not blur.
Control port
TCP 47850. It answers loopback and Tailscale addresses that tailscale whois puts on your account. Everyone else gets a 403.
Stream
The GameStream protocol, encrypted, inside WireGuard, with certificate pairing on top. The other machine’s certificate is pinned after the first pairing.
Firewall
Windows setup opens the control port to 100.64.0.0/10, Tailscale’s address range, and the streaming ports to your tailnet.
Accounts
None. The engine login Latch generates stays on the machine that shares.
Wake
Wake-on-LAN from the PC’s own network, or from anywhere if its router forwards UDP 9. Test wake tells you which applies.
Power
Sleep, restart and shut down from another machine. The PC can switch remote power actions off.

Run your own peer relay

03Specifications

What Latch asks the other machine for.

These are the settings Latch 4.1.0 offers, not benchmarks. What you get depends on both machines and the path between them.

Latch stream settings. Quality: Recommended, selected, Smooth, Balanced, Sharp or Custom. Resolution: Match screen, 2560 × 1600. Frame rate: 60 fps. Bitrate: a slider at 50 Mbps. Codec: Auto, HEVC or H.264. Below, the next stream, 2560 × 1600, 60 fps, 50 Mbps, and an Apply and reconnect button.
Fig. 6 Stream settings, as the toolbar opens them. Settings has the same controls.
Resolution

Match screen, this display’s own pixel size, by default.

  • 1080p 1920 × 1080
  • 1440p 2560 × 1440
  • 4K 3840 × 2160

The PC switches its display to the size asked for, and back when you disconnect.

Frame rate

30, 60, 90, 120, 144, 165 or 240 fps. 60 by default.

Above 60 needs a display on the sharing machine that runs that fast.

Bitrate

2 to 150 Mbps. The encoder aims at it while the picture moves; a still screen uses less.

50 Mbps by default, on every path.

Quality
  • Recommended Match screen · 50 Mbps
  • Smooth 1080p · 60 fps · 20 Mbps
  • Balanced Match screen · 60 fps · 50 Mbps
  • Sharp Match screen · 60 fps · 100 Mbps

Custom sets all three yourself.

Codec

HEVC when both ends can use it, H.264 otherwise. Either can be forced.

Decoding
  • macOS VideoToolbox, hardware, HEVC and H.264
  • Windows, Linux OpenH264, software, H.264
Encoding

The streaming engine on the sharing machine: AMD, NVIDIA or Intel GPU encoders on Windows, software on a VPS with no GPU.

Audio

Opus, played on this machine’s default output.

Input

Captured mouse with raw movement, or free. ⌘ acts as Ctrl on a PC by default.

Clipboard

Text, both ways, up to 32 KB.

Transport

Tailscale (WireGuard): direct, your own peer relay, or DERP.

1184-byte packets, sized for the tunnel’s 1280-byte MTU.

Updates

The Mac app checks GitHub about every six hours, verifies the SHA-256 and code signature, and installs when no stream is running.

It sends new Latch Host builds to Windows PCs over the control port.

Built with

Rust. The stream protocol is moonlight-common-c; the streaming engine is Sunshine.

GPL-3.0-or-later.

04Platforms

One app on every machine.

Each install lists the others and can connect to them. Every machine needs Tailscale, signed in to the same account.

macOS

Requires
macOS 13 or later on Apple Silicon
Get it
Prebuilt app, or one command in Terminal
Connect
Yes. Hardware HEVC and H.264 decoding
Share
Yes. Grant Screen Recording once; setup downloads the streaming engine
Mac guide

Windows

Requires
Windows 10 1809 or later, or Windows 11, 64-bit. An AMD, NVIDIA or Intel GPU to share
Get it
Prebuilt zip with the streaming engine
Connect
Yes. Software H.264 decoding
Share
Yes. The engine runs as a service, so the sign-in screen streams after a restart
Windows guide

Linux

Requires
Rust, CMake and a C compiler to build it
Get it
Build from source
Connect
Yes. Software H.264 decoding
Share
Yes, with the streaming engine installed on the system
Build instructions

Docker

Requires
Docker with Compose and a Tailscale auth key
Get it
Compose kit in the repository, arm64 or amd64
Connect
No. It is a headless machine to connect to
Share
A virtual 1920 × 1080 desktop with its own Tailscale identity. Several containers are several machines
Container guide

05Download

Latch 4.1.0

Released 2 October 2026. First install Tailscale on each machine and sign in with the same account. A copy of an earlier version that is already installed updates itself and keeps its settings, pairings and streaming engine.

Release notes Latest release All releases

macOS

Apple Silicon · macOS 13+

In Terminal. Downloads the latest release, checks its SHA-256 and signature, installs it in Applications and opens it.

Terminal 
curl -fsSL https://raw.githubusercontent.com/MrBeldum/latch/main/scripts/install-macos-release.sh | bash

Downloaded the archive in a browser instead? The app is ad-hoc signed, so unpack it and clear the quarantine flag first: xattr -dr com.apple.quarantine Latch.app

Download for macOS latch-macos-arm64.tar.gz

Windows

x64 · Windows 10 1809+

  1. Unzip, then run latch-host.exe, or install-host.ps1 for shortcuts and start at logon.
  2. Open the Sharing tab and click Set up as administrator. One administrator prompt sets up the bundled streaming engine.
Download for Windows latch-windows-x64.zip

Docker

Linux VPS · arm64, amd64

Put a Tailscale auth key and a hostname in .env, then start the container.

Shell 
git clone https://github.com/MrBeldum/latch
cd latch
cp deploy/node/env.example deploy/node/.env
# paste a Tailscale auth key, pick TS_HOSTNAME
docker compose -f deploy/node/docker-compose.yml up -d --build

Container guide

Source

Linux, macOS, Windows

Needs Rust, a C compiler and CMake. On Linux this is the way in; on a Mac, scripts/install-macos.sh builds, bundles and installs.

Build instructions