Remote Access
One permanent private link to your XHack agent, reachable from any browser on any device. No port forwarding, no domain, no certificate. End-to-end encrypted, and only the devices you approve can bring the link online.
Your Agent, One Private Link Away
With a paid plan you get one permanent private link to the XHack web console running on your own computer or server. It looks like this:
https://yourname-a1b2c3.xhack.site
Open it from a phone on the train, a laptop in a hotel, or a tablet at a client site. You are driving the same agent as you would at your desk, with the same sessions and findings.
Your link is created the first time you turn Remote Access on, and it stays the same every time after that.
Nothing to Configure on Your Network
No port forwarding. No router or firewall changes. No domain or TLS certificate to buy. XHack opens an outbound tunnel from your machine and hands requests through to the local web console.
The tunnel is encrypted end-to-end over HTTPS. Only the XHack web console is reachable through your link. Nothing else on the machine is exposed.
Only Approved Devices Bring the Link Online
The first time a computer or server tries to attach to your link, it has to be approved by you:
- The device shows a pairing code (in the desktop app or in the terminal).
- You approve on
xhack.io → Settings → Remote access. - You type the code there to prove you are at the device.
The website never shows the pairing code. If someone signs in to your account they still cannot attach a new machine to your link.
One device holds the link at a time. Turn Remote Access on somewhere else and the link moves there; the old device goes offline. Revoke a device from the website and it is locked out until you approve it again.
Works With the Desktop App, or From a Terminal on a VPS
Two ways to switch it on:
- In the XHack desktop app, under Settings → Remote. One click to turn on, one click to copy the link, and an Approve this device window walks you through the first-time pairing.
- On a server, with
xhack tunnel. The CLI pairs the device on first use, keeps running in the background, and prints the link. On Linux,xhack tunnel --install-servicekeeps Remote Access up across reboots.
Either way the login for the web console is a separate strong username and password. XHack can generate one for you and show it once, so the credential that fronts your link is never the weak one.
Secure by Default
- End-to-end encrypted HTTPS tunnel.
- Only the web console is reachable through the link, not the rest of the computer.
- Device approval with a pairing code on first use, denied and revoked devices locked out.
- Separate web console login, rotatable in one click, with a sign-out-everywhere control that drops every session.
- Encrypted transport and a strong login are the default, not an opt-in.
- Turn it off and your link goes offline right away.
When Your Plan Changes
Your link is yours while your plan is active. Cancel, and it goes offline but is kept for 10 days so a renewal restores the same link. After that it is deleted, never reused and never given to anyone else. Free trials cannot use Remote Access.
Learn More
Try it on your own stack
Run this against a target you own and judge it on what it finds, not on a description.
Try XHack AIQuestions about this?
You get a researcher on the call, not a sales engineer reading the same page back to you.
Contact supportMore in XHack AI
Capabilities that sit alongside this one.