Desktop Client
Waylo's client is normally just the web page the server serves. The optional desktop app adds the thing a browser can't: a list of the machines you connect to, their credentials, and several sessions open side by side.
It doesn't reimplement the streaming client. Each session tab loads the Waylo UI from the server it is connecting to, so the client always matches that server's version — the app supplies the connection list, the login and the certificate trust around it.
Installing it
| Platform | Download |
|---|---|
| Linux | AppImage (runs anywhere) or deb |
| Windows | Installer .exe — per-user, and you can pick the location |
| macOS | not published yet — build it on a Mac, below |
Checksums are at
SHA256SUMS, which lists
each file under both its -latest- and its versioned name:
wget https://waylo.site/waylo-desktop-latest-linux-x86_64.AppImage
wget -qO- https://waylo.site/waylo-desktop-latest-SHA256SUMS | sha256sum -c --ignore-missing
chmod +x waylo-desktop-latest-linux-x86_64.AppImage
./waylo-desktop-latest-linux-x86_64.AppImage
The -latest- URLs are repointed on each release; the versioned filenames they
point at stay put, so link those if you need a fixed version.
The Windows installer isn't code-signed, so SmartScreen warns the first time — More info → Run anyway.
Or run it from a checkout:
cd desktop
npm install
npm start
On Linux the .deb pulls in libsecret-1-0, which is what the app needs to
reach your keyring; the AppImage assumes it is already there, as it is on any
normal GNOME or KDE desktop.
Building installers
From desktop/:
npm run dist:linux # AppImage + deb
npm run dist:win # NSIS installer — needs wine when built from Linux
npm run dist:mac # dmg + zip — must run on macOS
Artifacts land in desktop/release/. Packaging is
electron-builder, configured in
desktop/electron-builder.yml. scripts/publish-desktop.sh builds and uploads
them to waylo.site in one step, repointing the -latest- links and verifying
every upload against its local checksum.
macOS is the gap: electron-builder only makes a .dmg on macOS, so nothing is
published for it yet. Running scripts/publish-desktop.sh --mac on a Mac adds
it alongside the others.
Saved connections
A connection holds everything the login screen would otherwise ask for:
- Host, port, and whether to use HTTPS
- Username, and optionally the password
- Frame rate and quality tier
- The start-with toggles — audio, fullscreen, all monitors, auto-capture, low effects, lock on exit
Clicking a card opens a session on those settings; a dot on each card shows whether anything is answering on that port.
Stored credentials
Passwords are encrypted with Electron's safeStorage, which uses the operating
system's keyring — gnome_libsecret or KWallet on Linux, Keychain on macOS,
DPAPI on Windows. Settings live in connections.json under the app's data
directory (~/.config/waylo-desktop/ on Linux), written 0600.
The app is straight with you when that protection isn't real: with no keyring available, Linux falls back to a well-known key — which obfuscates rather than protects, and the connection list says so. Where no secure storage exists at all, the password field is disabled and each session asks for it.
A stored password is never handed to the app's own UI or exposed to the remote page's JavaScript. The main process decrypts it and passes it to the session's preload script, which types it into the login form from an isolated world.
Signing in automatically
Sign in automatically fills the login form and submits it as the session opens. It fires on the first load only. Disconnecting from the toolbar reloads the page, and signing straight back in would make disconnecting impossible — so reconnecting is always a deliberate act (Try again on the tab, or Ctrl+Alt+R).
Certificates
Waylo serves HTTPS with a self-signed certificate, so no authority can vouch for it. Rather than turning TLS checking off, the app pins on first use: it shows the fingerprint once and stores it with the connection when you accept. After that the session connects silently, and anything else stops and asks again — calling out a certificate that changed rather than one merely unknown.
Check the fingerprint against the server before accepting it:
openssl x509 -in ~/.local/share/waylo/certs/waylo.crt -noout -fingerprint -sha256
The pin covers the wss:// stream as well as the page load. "Forget this
certificate" in the connection's settings clears it.
Several sessions
Every connection opens in its own tab, on its own storage partition — cookies, login preferences and remembered pop-out monitor positions stay per machine. Sessions keep streaming while another tab is in front.
Because a connected session forwards nearly every keystroke to the remote desktop, the app's own shortcuts sit on Ctrl+Alt, which GNOME leaves free:
| Shortcut | Does |
|---|---|
| Ctrl+Alt+H | Back to the connection list |
| Ctrl+Alt+← / → | Previous / next session |
| Ctrl+Alt+W | Close the current session |
| Ctrl+Alt+R | Reconnect the current session |
Fullscreen inside a session takes the whole window with it, so Waylo's system-key capture still works — Alt+Tab, Super and Ctrl+W drive the remote desktop rather than the app.