Help & user manual

1. Sign up on this site (you're already past this step).
2. On the machine you want to control, run miniVnc.exe. Open minivnc.json and set:

   "relay": true,
   "relay_url": "wss://minivnc.core-jmp.org/vnc-relay/server",
   "email": "your-account-email",
   "password": "your-account-password",
   "server_name": "HomePC",
   "tls": true

   Then run miniVnc.exe --relay (or install as a Windows service; see the project README).
3. Back here, the Dashboard will show the server within ~10 s. From there you have two ways to view:
   • Open in browser — noVNC opens in a new tab.
   • Share link — a one-shot URL you paste into clientVnc.exe → Connection → "Connect via Relay…" → "Paste share URL".

Minimal minivnc.json for relay-mode:

{
  "relay": true,
  "relay_url": "wss://minivnc.core-jmp.org/vnc-relay/server",
  "email": "you@example.com",
  "password": "your-relay-password",
  "server_name": "HomePC",
  "device_id": "win-laptop-1",
  "tls": true,
  "vnc_password": "secret123",
  "view_only": false,
  "session.idle_timeout_min": 30
}

Important fields

• "tls": true — REQUIRED for end-to-end protection. Without it, the relay operator sees plaintext (the server will refuse to start unless you set "relay.allow_no_e2e_tls": true).
• "vnc_password" — second password (in addition to your relay account password), asked to whoever connects. Choose something a viewer would have to know. The default value 123456 is rejected at start-up.
• "server_name" — display name in the Dashboard.
• "session.idle_timeout_min" — auto-disconnect idle session after N minutes (0 = no timeout).
• "view_only": true — viewer can see pixels but can't send mouse/keyboard. Useful for kiosks.

Running as Windows service

Install once with miniVnc.exe --install (elevated cmd). Uninstall with --uninstall. The service runs as SYSTEM so it can capture the login screen / UAC prompts.

Two ways to connect:

Direct connection (same network)

Connection → New connection → enter host:port + password. Saved to Recent. Requires no relay.

Connecting through this relay

Two paths:

1. Share link: paste a relay URL the server's owner sends you. Connection → Connect via Relay → "Paste share URL". No account needed. One-shot, valid 60 s.
2. Account-based: Connection → Connect via Relay → "Sign in to relay" → enter your account email + password. You see your own servers in the list.

Useful view options

• View → Server Stats… — live FPS, traffic, encode times for the current session.
• View → Stream Audio — pipe the server's audio out to your speakers.
• View → Select Monitor — multi-monitor host: pick which display to view.
• View → Zoom & Full Screen shortcuts.

File transfer

Drag-and-drop a file from your local explorer onto the viewer window to upload it to the remote. The remote sees a download prompt (unless auto_accept_files is enabled). Big files are streamed in 64 KB chunks, AES-256-GCM-encrypted independently of the TLS layer.

FAR Manager-style file panel

F2 in the viewer opens a dual-pane file browser (local ↔ remote). F5 copies between panes; F8 deletes; F7 makes a folder; F4 / F3 edit / view in your local Notepad and writes back when you save.

The viewer's Network menu forwards TCP traffic through the authenticated, TLS-encrypted VNC session — no extra ports, no second connection. Three modes, all disabled on the server by default; the server owner enables them in minivnc.json.

Server side (minivnc.json)

SOCKS5 and HTTP proxy require a user list and an allowed-subnet list (fail-closed). Port Map only needs an enable flag, optionally restricted to specific remote ports:

"socks5": {
  "enabled": true,
  "allowed_subnets_0": "10.0.0.0/8",
  "users_0.user": "alice",
  "users_0.password_bcrypt": "<DPAPI blob from --encrypt-password>"
},
"proxy": {
  "enabled": true,
  "allowed_subnets_0": "192.168.1.0/24",
  "users_0.user": "alice",
  "users_0.password_hash": "pbkdf2sha256:200000:<salt>:<key>"
},
"portmap": {
  "enabled": true,
  "log_file": "portmap.log",
  "allowed_ports_0": 22,
  "allowed_ports_1": "130-150"
}

Generate a proxy password hash on the server with miniVnc.exe --hash-proxy-password "YourPass" (or the bundled hash-proxy-password.bat). SOCKS5 passwords use the same DPAPI scheme as the master VNC password: miniVnc.exe --encrypt-password "YourPass".

Viewer side

Open Network → SOCKS5 Tunnel… / Proxy Tunnel… / Port Map…, fill in the fields, then Save + Start. The dialog auto-closes a second after a successful start; the tunnel keeps running until you re-open it and press Stop. Saved settings (passwords DPAPI-encrypted) persist for next time.

# SOCKS5 — your app needs NO credentials; the viewer injects them:
curl -x socks5h://127.0.0.1:1080 http://internal.host/

# HTTP proxy:
curl -x http://127.0.0.1:8080 https://10.20.30.40/

# Port Map — mapping 2222:22 in the dialog, then:
ssh -p 2222 user@127.0.0.1      # reaches the server's own sshd

Security: tunnels reach into the server's network, so the server owner controls access. SOCKS5/proxy require per-user credentials; Port Map relies on the VNC session itself (you already have desktop access to the box). Always use TLS for the VNC session. Viewer listeners bind to 127.0.0.1 only.

• Profile — edit your personal data, change your password, change your email.
• Audit log — every action on your account (sign-in, agent-connect, ticket-issue, etc.) plus relay-wide security events visible to all operators (rate-limit blocks, failed auth attempts).
• Forgot your password? Contact a site administrator — self-service password reset is on the roadmap.

• End-to-end VeNCrypt TLS — when "tls": true is set in minivnc.json, RFB traffic is encrypted between the server and viewer. Even this relay can't see what's on your screen — the relay only sees ciphertext.
• TOFU certificate pinning — the first time clientVnc connects to a server it shows the server's SHA-256 fingerprint and asks you to trust it. Subsequent connections verify the same fingerprint; a mismatch shows a warning.
• Rate limit + ban — 10 connections / 10 s per IP; 5 failed auth attempts → 30-minute ban (defaults — admin can change).
• Audit chain — every server session is recorded to a .vncf file with a SHA-256 hash chain so the log can't be silently rewritten.

Server doesn't appear in Dashboard

Check the miniVnc.exe console output for "Relay: online" log line. If you see "Relay auth rejected", the email or password is wrong. If you see "ratelimit-block", you've hit the rate-limit — wait a minute.

"Banned" message at sign-in

An admin has banned your account. Contact an administrator.

Password failed but I'm sure it's right

Two passwords are involved: the account password (this site) and the VNC password (asked once after the relay pairs you). Don't mix them up.

Slow / laggy video

Open View → Server Stats and look at the Encode time histogram. If >50% are in the ≥66 ms bucket, the bottleneck is the network or TLS — try the "lower bandwidth" option in Options.

"Email verification" loop

The link expires after 24 h. If you missed it, use the "Resend" form on the verify-email page.