Desktop Client
WayLo's client is normally just the web page the server serves. The optional desktop app adds the thing a browser can't: a list of the machines you connect to, their credentials, and several sessions open side by side.
It doesn't reimplement the streaming client. Each session tab loads the WayLo UI from the server it is connecting to, so the client always matches that server's version — the app supplies the connection list, the login and the certificate trust around it.
Installing it
| Platform | Download |
|---|---|
| Linux | AppImage (runs anywhere) or deb |
| Windows | Installer .exe — per-user, and you can pick the location |
| macOS | not published yet — build it on a Mac, below |
Checksums are at
SHA256SUMS, which lists
each file under both its -latest- and its versioned name:
wget https://waylo.site/waylo-desktop-latest-linux-x86_64.AppImage
wget -qO- https://waylo.site/waylo-desktop-latest-SHA256SUMS | sha256sum -c --ignore-missing
chmod +x waylo-desktop-latest-linux-x86_64.AppImage
./waylo-desktop-latest-linux-x86_64.AppImage
The -latest- URLs are repointed on each release; the versioned filenames they
point at stay put, so link those if you need a fixed version.
The Windows installer isn't code-signed, so SmartScreen warns the first time — More info → Run anyway.
Or run it from a checkout:
cd desktop
npm install
npm start
On Linux the .deb pulls in libsecret-1-0, which is what the app needs to
reach your keyring; the AppImage assumes it is already there, as it is on any
normal GNOME or KDE desktop.
Building installers
From desktop/:
npm run dist:linux # AppImage + deb
npm run dist:win # NSIS installer — needs wine when built from Linux
npm run dist:mac # dmg + zip — must run on macOS
Artifacts land in desktop/release/. Packaging is
electron-builder, configured in
desktop/electron-builder.yml. scripts/publish-desktop.sh builds and uploads
them to waylo.site in one step, repointing the -latest- links and verifying
every upload against its local checksum.
macOS is the gap: electron-builder only makes a .dmg on macOS, so nothing is
published for it yet. Running scripts/publish-desktop.sh --mac on a Mac adds
it alongside the others.
Saved connections
New connection opens the connection form. It is the same login form the web client shows, with the address added on top:
- Host, port, whether to use HTTPS, and an optional name
- Username, and optionally the password
- Frame rate and quality tier
- The start-with toggles — audio, fullscreen, all monitors, seamless mouse, low effects, lock on exit
- Sign in automatically
Save keeps it with the connection. Connect saves and opens the session, signing in once with what is on the form even when Sign in automatically is off. To change a connection later, pick Edit from its card's ⋯ menu — the same form, filled in; leave the password blank to keep the saved one.
Clicking a card opens a session on its saved settings; a dot on each card shows whether anything is answering on that port. The ⋯ menu also holds Install WayLo there, Forget saved password, Forget certificate, and Delete.
Inside a session, the machine's own login page has a Save button beside Login too, so login and stream settings can be changed without leaving the tab. That button is part of the login page, which each server ships itself, so it appears once that server runs a WayLo version that has it. The page can only hand over its own form fields for the connection it was opened from — never the address or the pinned certificate — and reads nothing back.
Stored credentials
Passwords are encrypted with Electron's safeStorage, which uses the operating
system's keyring — gnome_libsecret or KWallet on Linux, Keychain on macOS,
DPAPI on Windows. Settings live in connections.json under the app's data
directory (~/.config/waylo-desktop/ on Linux), written 0600.
The app is straight with you when that protection isn't real: with no keyring available, Linux falls back to a well-known key — which obfuscates rather than protects, and the connection list says so. Where no secure storage exists at all, Save keeps everything but the password and each session asks for it.
A stored password is never handed to the app's own UI or exposed to the remote page's JavaScript. The main process decrypts it and passes it to the session's preload script, which types it into the login form from an isolated world.
Signing in automatically
Sign in automatically fills the login form and submits it as the session opens. It fires on the first load only. Disconnecting from the toolbar reloads the page, and signing straight back in would make disconnecting impossible — so reconnecting is always a deliberate act (Try again on the tab, or Ctrl+Alt+R).
Certificates
WayLo serves HTTPS with a self-signed certificate, so no authority can vouch for it. Rather than turning TLS checking off, the app pins on first use: it shows the fingerprint once and stores it with the connection when you accept. After that the session connects silently, and anything else stops and asks again — calling out a certificate that changed rather than one merely unknown.
Check the fingerprint against the server before accepting it:
openssl x509 -in ~/.config/waylo/certs/waylo.crt -noout -fingerprint -sha256
(Installs made by the older installer, WayLo 0.4.25 and earlier, keep it in
~/.local/share/waylo/certs/; updating copies it to ~/.config/waylo/certs/
unchanged.)
The pin covers the wss:// stream as well as the page load. Forget
certificate in the card's menu clears it.
Several sessions
Every connection opens in its own tab, on its own storage partition — cookies, login preferences and remembered pop-out monitor positions stay per machine. Sessions keep streaming while another tab is in front.
Because a connected session forwards nearly every keystroke to the remote desktop, the app's own shortcuts sit on Ctrl+Alt, which GNOME leaves free:
| Shortcut | Does |
|---|---|
| Ctrl+Alt+H | Back to the connection list |
| Ctrl+Alt+← / → | Previous / next session |
| Ctrl+Alt+W | Close the current session |
| Ctrl+Alt+R | Reconnect the current session |
Fullscreen inside a session takes the whole window with it, so WayLo's system-key capture still works — Alt+Tab, Super and Ctrl+W drive the remote desktop rather than the app.