How can we help?

On the Mac, open System Settings, General, Sharing, and turn on:

• Remote Login for Terminal and Files (SSH).
• Screen Sharing for Screen.

A Mac's screen signs in with an account on that Mac. Which accounts may connect is set under Screen Sharing's info button. With Remote Login on as well, Conn carries the screen over SSH, encrypted.

On Raspberry Pi OS, turn on VNC (and SSH for Terminal and Files): Raspberry Pi Configuration, Interfaces, or sudo raspi-config, Interface Options.

Conn signs in to the Pi's screen with the name and password of an account on the Pi: the one you log in with at its desktop. A Pi's screen usually encrypts itself, so it doesn't need SSH to be private.

1. In Conn, go to Keys, New Key, then Copy Public Key.
2. On the server, add that line to the account's ~/.ssh/authorized_keys:

   mkdir -p ~/.ssh && chmod 700 ~/.ssh
   echo 'PASTE-THE-PUBLIC-KEY-HERE' >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys

3. In Conn, choose the key as the host's sign in.

A key you already have can be added in Keys, Add Existing Key, from a file or the clipboard.

• Tailscale: if a machine is on your tailnet, Conn can reach it from anywhere, encrypted by Tailscale. Conn shows when a link goes over Tailscale, and only after the connection proved it.
• SSH: with Remote Login (or any SSH server) on, Conn carries the screen inside SSH, encrypted.
• Connect Directly goes straight to the screen's port, not encrypted unless the screen encrypts itself (as a Raspberry Pi's usually does). Conn asks first, and keeps the choice for that address only. Edit Host, Screen lists those addresses, with Forget.

In Edit Host, Screen, Connection: Automatic uses Tailscale, SSH, or a screen that encrypts itself, and asks before going direct. SSH always uses SSH. Direct always goes straight to the screen.

Never open a screen's port on a router. Use Tailscale, or let Conn carry the screen over SSH.

Conn signs in with a password, or an Ed25519 or ECDSA key, and speaks VNC, not RDP (Windows Remote Desktop). When a key or a server needs something Conn doesn't do, its message says what, and what to try.

Every message is explained in Troubleshooting, keys you already have in Adding a key, and the full technical detail is in What Conn supports.

Conn needs Local Network access for that. On iPhone and iPad: Settings, Privacy & Security, Local Network, Conn. On a Mac: System Settings, Privacy & Security, Local Network, Conn.

A machine Conn doesn't find can always be added by its address.

Fold the inner display halfway, like a laptop, in portrait:

• Screen: with the Trackpad style, the picture is on the top half and the pad on the bottom half.
• Terminal: with the keyboard up, the terminal stays on the top half.

There's no switch: it follows the fold. Opened flat, Conn goes back to its usual layout.

With iCloud sync on, your hosts, groups and snippets appear on the new device. Passwords and keys don't move, on purpose: they stay in the Keychain of the device they were saved on.

• Type each saved password again on the new device the first time you connect.
• Make a new key on the new device and add its public key to your servers. A Secure Enclave key can never leave the device it was made on.

Delete a host in Conn to remove it and its saved passwords, and forget a key in Keys. Deleting Conn removes the rest of what it keeps on the device.

The system's Keychain can keep items after an app is deleted, so delete hosts and keys in Conn first if you want everything gone. With iCloud sync on, delete hosts while sync is on to remove them from your iCloud too.

Purchases are made through Apple, so refunds are too: reportaproblem.apple.com.