Remote Access

Reach the XHack Web Console from anywhere with one permanent private link to your own computer or server. No port forwarding, no domain, no certificate. Encrypted end-to-end and only approved devices can bring the link online.

Remote Access

Remote Access gives you one permanent private link to the XHack web console running on your own computer or server. Open it on a phone, a tablet or a laptop, sign in, and you are driving the same agent as you would at your desk.

Nothing is in the cloud except the encrypted tunnel that hands the request through to your machine. The agent, your sessions and your findings never leave it.

This page is the short overview. Each piece of Remote Access has its own page:

What your link looks like

On a paid plan you get one permanent link that looks like:

https://yourname-a1b2c3.xhack.site

The first part is your username. The six random characters make the link hard to guess. The link is created the first time you turn Remote Access on, and it stays the same every time after that.

Open it in any browser, on any device, to use the XHack console running on your own machine.

How it stays private

End-to-end encryption. The tunnel runs over HTTPS, so what passes through it is never in the clear.
Only the web console is reachable. Nothing else on your computer is exposed. Remote Access is not a general-purpose VPN into the machine.
Each device is approved by you. The first time a computer or server tries to attach to your link, you have to approve it on xhack.io with a pairing code read from that device. See Approve a device.
One device at a time. Your link points to one approved device. Turn Remote Access on somewhere else and the link moves to that device; the previous one goes offline.
Your login is separate. Opening the link lands on the web console's own sign-in page, with its own username and password. Your xhack.io account is not reachable from the link.

Nothing to set up on your network: no router or firewall changes, no port forwarding, no domain to buy, no certificate to install.

When your link works

Your link is online only while all of these are true:

Requirement	Why
You are on an active paid plan	Free trials do not include Remote Access.
XHack is running on the device (the desktop app, or `xhack tunnel` on a server)	The link connects to your own machine. If the machine is off, the link is offline.
Remote Access is turned on	From Settings → Remote in the app, or with `xhack tunnel`.
The device has been approved by you	Each new computer or server is approved once on the XHack website.

If the machine sleeps, shuts down or loses internet, the link goes offline. It comes back on its own when XHack is running and online again.

Three ways to use it

How	Best for	Guide
From the XHack desktop app	Most people. A couple of clicks, no terminal.	Turn it on from the desktop app
On a VPS with the `xhack tunnel` CLI	Servers without a screen, and anywhere a terminal is easier.	Deploy it on a VPS
On a laptop that stays with you	Your own machine is the agent. Open the link from a phone when you need it.	Turn it on from the desktop app

What happens when your plan changes

Your paid plan ends. Your link goes offline right away and is kept for 10 days. Renew within those 10 days and you get the same link back.
After 10 days without renewing. The link is permanently deleted. If you subscribe again later you get a new link. Old links are never reused or given to anyone else.
Trial accounts. Remote Access is not available. Upgrade to a paid plan to use it.

Not the same as hosting the console yourself

Remote Access and running the web console on a VPS the old way are two different things.

Remote Access gives you a managed private link through XHack's tunnel, with device approval and nothing to configure on the network.
Hosting the console yourself means opening a port, setting up a reverse proxy or an SSH tunnel, and running your own TLS. It is more work and more exposure.

Remote Access is the default for most people. The other guide is still there if you need to run a public endpoint yourself.