Latch
Download

Latch 5.0.1 Remote desktop over Tailscale Release notes

Your machines,
on any of your machines.

Latch streams a whole desktop, full screen, over your own Tailscale network. Mac, Windows, Linux and a VPS container run the same app: each one lists the others, and each one can share its own desktop.

Download 5.0.1 Source on GitHub
The Latch window on its Machines tab, listing four machines: MacBook-Pro, this Mac, shared; Gaming-PC, a Windows PC, relayed via Tokyo at 210 ms; Office, a Windows PC that is asleep, with a Wake and connect button; and Den, a Linux machine. Below, the next stream: 1280 × 800, 60 fps, 50 Mbps.
Fig. 1 The machine list. Every machine on your Tailscale account, and what it can do right now.

01Session

Open Latch. Click Connect. The desktop appears.

Every install lists every other machine on your Tailscale account and can open its desktop. There is no host or client role to choose.

  1. Step 1

    Set up sharing.

    On the computer you want to reach, open the Sharing tab. On Windows, Set up as administrator takes one administrator prompt: it opens Latch’s port to your tailnet only, turns Fast Startup off and arms the network card for Wake-on-LAN. A Mac asks for Screen Recording and Accessibility once. The streaming engine is part of Latch; there is nothing else to install.

    The Sharing tab of Latch on a Windows PC named GAMING-PC, marked Shared. It lists the PC's Tailscale address, the streaming engine running on an NVIDIA encoder, a hard NAT note, Wake-on-LAN ready over Ethernet and the PC's LAN address. Below are options: letting other machines sleep, restart or shut the PC down, keeping it awake, installing updates other machines send, and starting Latch at log-in.
    Fig. 2 A Windows PC, shared and ready.

  2. Step 2

    Connect. Nothing to pair.

    Tailscale already knows who you are. The other machine checks your identity with tailscale whois, so there is no PIN to type and no certificate to accept. If a Windows PC is asleep, Latch wakes it and waits.

    Latch while connecting. A card reads Connecting to Gaming-PC, Measuring the path, with a Cancel button. There is no PIN.
    Fig. 3 Connecting. Nothing to type.

  3. Step 3

    The desktop, and nothing else.

    Full screen by default. Click the picture and the mouse is captured, as in a game, so games that read raw mouse movement work. Ctrl+Alt (Control-Option on a Mac) is the host key, as in a hypervisor: it frees the mouse and drops this toolbar over the picture. The text clipboard follows you both ways.

    The stream toolbar: Gaming-PC, 1920×1080, 60 fps, HEVC; Relayed via Tokyo, 210 ms; the keys control and option hide this bar; then Mouse, Keys, Stats, Full screen, PC, Stream settings and Disconnect.
    Fig. 4 The stream toolbar on a Mac, as Control-Option drops it.
    1. Stream Machine, size, frame rate and codec as negotiated. The dot is blue while connecting, green while the stream is healthy and amber when the connection is poor.
    2. Path Direct, through your own relay or through Tailscale’s, with the round trip. Amber when Tailscale’s shared relays carry it.
    3. Host key Control-Option on a Mac, Ctrl+Alt elsewhere. Press it to free the mouse and show or hide this bar.
    4. Mouse Captured for raw movement, or free, where the cursor’s position is sent 1:1.
    5. Keys Ctrl+Alt+Del, Windows key, Alt+Tab, Esc, Print Screen, and what ⌘ does.
    6. Stats Bitrate and frame rate against what was asked for, round trip, packet loss and decode times.
    7. PC Sleep, restart and shut down, when the PC allows it.
    8. Stream settings Change resolution, frame rate, bitrate or codec; applying reconnects in a second or two.

02Network

Tailscale is the path and the identity check.

A machine answers only peers signed in to the same Tailscale account. There is no Latch account or password, and the control port is open to your tailnet only.

FromThis machine

  1. 1Direct WireGuard, peer to peer, when Tailscale can get through both routers
  2. 2Your peer relay A VPS you run with the relay kit. Needs Tailscale 1.86 or later
  3. 3DERP Tailscale’s shared relays, the last resort

ToYour other machine

Fig. 5 Tailscale picks the path in this order. Latch asks for the same picture on every path: a relay adds delay, not blur.
Control port
TCP and UDP 47850. It answers loopback and Tailscale addresses that tailscale whois puts on your account. Everyone else gets a 403.
Stream
Latch’s own stream protocol over UDP, inside WireGuard, with Reed-Solomon forward error correction. A lost packet is rebuilt, not waited for.
Firewall
Windows setup opens port 47850, TCP and UDP, to 100.64.0.0/10, Tailscale’s address range, and nothing else.
Accounts
None. No Latch account, no password, no pairing. Your Tailscale sign-in is the only one.
Wake
Wake-on-LAN from the PC’s own network, or from anywhere if its router forwards UDP 9. Test wake tells you which applies.
Power
Sleep, restart and shut down from another machine. The PC can switch remote power actions off.

Run your own peer relay

03Specifications

What Latch asks the other machine for.

These are the settings Latch 5.0.1 offers, not benchmarks. What you get depends on both machines and the path between them.

Latch stream settings. Quality: Recommended, selected, Smooth, Balanced, Sharp or Custom. Resolution: Match screen, 2560 × 1600. Frame rate: 60 fps. Bitrate: a slider at 50 Mbps. Codec: Auto, HEVC or H.264. Below, the next stream, 2560 × 1600, 60 fps, 50 Mbps, and an Apply and reconnect button.
Fig. 6 Stream settings, as the toolbar opens them. Settings has the same controls.
Resolution

Match screen, this display’s own pixel size, by default.

  • 540p 960 × 540
  • 720p 1280 × 720
  • 900p 1600 × 900
  • 1080p 1920 × 1080
  • 1440p 2560 × 1440
  • 4K 3840 × 2160

The sharing machine’s desktop follows the size asked for, and goes back when you disconnect.

Frame rate

30, 60, 90, 120, 144, 165 or 240 fps. 60 by default.

Above 60 needs a display on the sharing machine that runs that fast.

Bitrate

2 to 150 Mbps. The encoder aims at it while the picture moves; a still screen uses less.

50 Mbps by default, on every path.

Quality
  • Recommended Match screen · 50 Mbps
  • Smooth 1080p · 60 fps · 20 Mbps
  • Balanced Match screen · 60 fps · 50 Mbps
  • Sharp Match screen · 60 fps · 100 Mbps

Custom sets all three yourself.

Codec

HEVC between two Macs, H.264 everywhere else. Either can be forced.

Decoding
  • macOS VideoToolbox, hardware, HEVC and H.264
  • Windows Media Foundation, hardware when the GPU has it, H.264
  • Linux Latch’s own decoder, software, H.264
Encoding

Built into Latch on the sharing machine: VideoToolbox on a Mac, the GPU’s encoder through Media Foundation on Windows, Latch’s own H.264 encoder on Linux and a VPS with no GPU.

Audio

Lossless, 48 kHz stereo, played on this machine’s default output.

Input

Captured mouse with raw movement, or free. ⌘ acts as Ctrl on a PC by default.

Clipboard

Text, both ways, up to 32 KB.

Transport

Tailscale (WireGuard): direct, your own peer relay, or DERP.

1200-byte datagrams, sized for the tunnel’s 1280-byte MTU.

Updates

The Mac app checks GitHub about every six hours, verifies the SHA-256 and code signature, and installs when no stream is running.

It sends new Latch Host builds to Windows PCs over port 47850.

Built with

Rust, top to bottom: the streaming engine, the protocol and the H.264 codec are Latch’s own. No C or C++.

GPL-3.0-or-later.

04Platforms

One app on every machine.

Each install lists the others and can connect to them. Every machine needs Tailscale, signed in to the same account.

macOS

Requires
macOS 13 or later on Apple Silicon
Get it
Prebuilt app, or one command in Terminal
Connect
Yes. Hardware HEVC and H.264 decoding
Share
Yes. Grant Screen Recording and Accessibility once
Mac guide

Windows

Requires
Windows 10 1809 or later, or Windows 11, 64-bit
Get it
Prebuilt zip
Connect
Yes. Media Foundation H.264 decoding
Share
Yes. Latch runs as a service, so the sign-in screen streams after a restart
Windows guide

Linux

Requires
x64 or arm64, glibc 2.39 or later (Ubuntu 24.04), an X11 desktop
Get it
Prebuilt latch-host, or build from source
Connect
Yes. Software H.264 decoding
Share
Yes, under systemd
Linux guide

Docker

Requires
Docker with Compose and a Tailscale auth key
Get it
Compose kit in the repository, arm64 or amd64
Connect
No. It is a headless machine to connect to
Share
A virtual 1920 × 1080 desktop with its own Tailscale identity. Several containers are several machines
Container guide

05Download

Latch 5.0.1

Released 29 October 2026. First install Tailscale on each machine and sign in with the same account. A copy that is already installed updates itself and keeps its settings.

Release notes Latest release All releases

macOS

Apple Silicon · macOS 13+

In Terminal. Downloads the latest release, checks its SHA-256 and signature, installs it in Applications and opens it.

Terminal 
curl -fsSL https://raw.githubusercontent.com/MrBeldum/latch/main/scripts/install-macos-release.sh | bash

Downloaded the archive in a browser instead? The app is ad-hoc signed, so unpack it and clear the quarantine flag first: xattr -dr com.apple.quarantine Latch.app

Download for macOS latch-macos-arm64.tar.gz

Windows

x64 · Windows 10 1809+

  1. Unzip, then run latch-host.exe, or install-host.ps1 for shortcuts and start at logon.
  2. Open the Sharing tab and click Set up as administrator. One administrator prompt opens the port to your tailnet and readies Wake-on-LAN.
Download for Windows latch-windows-x64.zip

Docker

Linux VPS · arm64, amd64

Put a Tailscale auth key and a hostname in .env, then start the container.

Shell 
git clone https://github.com/MrBeldum/latch
cd latch
cp deploy/node/env.example deploy/node/.env
# paste a Tailscale auth key, pick TS_HOSTNAME
docker compose -f deploy/node/docker-compose.yml up -d --build

Container guide

Linux

x64, arm64 · glibc 2.39+

latch-host for an X11 desktop, run under systemd, with a .sha256 beside each archive. Or build it from source: Latch needs nothing but Rust.

Linux guide