This article explains the encryption technologies RealVNC Connect uses, the available encryption levels, how RealVNC Server and RealVNC Viewer negotiate encryption, and how to configure the level that suits your security requirements.
RealVNC does not process, store, or have any access to data accessed during a remote session. It remains encrypted end-to-end and cannot be deciphered by RealVNC or anyone else.
Where to configure encryption
Every RealVNC Connect remote access session is encrypted, protecting your data in transit between RealVNC Viewer and RealVNC Server.
RealVNC Connect v8
Open RealVNC Connect and navigate to Settings > Inbound > Security. Select the encryption level from the Encryption dropdown.
RealVNC Server v7
Open the RealVNC Server application and navigate to Options > Security. Select the encryption level from the Encryption dropdown.
You can also set the encryption level in bulk across many devices using the Encryption parameter via policy, or on the Expert settings page.
Encryption levels
The level of encryption applied to a connection is determined by the Encryption parameter on both RealVNC Server and RealVNC Viewer.
RealVNC Server controls what the remote device offers, and RealVNC Viewer controls what the connecting device requests. The two negotiate to determine the final encryption level for each session.
| Encryption method | Encryption level | Applies to |
|---|---|---|
| AlwaysMaximum | 256-bit AES, mandatory. Connections that cannot negotiate 256-bit encryption are refused. | Cloud and direct |
| AlwaysOn (default) | 128-bit AES, mandatory. Sessions are encrypted end-to-end. This is the out-of-the-box default. | Cloud and direct |
| PreferOn | Encryption is preferred but not enforced. Unencrypted connections are accepted from legacy viewers. | Direct only |
| PreferOff | Encryption is available but not preferred. Encrypted only if the Viewer specifically requests it. | Direct only |
| AlwaysOff | Encryption is disabled. All session data is transmitted in plaintext. Not recommended. | Direct only |
Note: We strongly recommend keeping encryption at AlwaysOn or higher. Setting encryption to PreferOff or AlwaysOff means session data may be readable if intercepted. Cloud connections are always encrypted end-to-end.
How Server and Viewer negotiate
When a connection is established, the final encryption level is determined by the stricter of the two settings:
| Server setting | Viewer setting | Result |
|---|---|---|
| AlwaysOn | AlwaysMaximum | 256-bit AES (Viewer's higher request is granted) |
| AlwaysMaximum | AlwaysOn | 256-bit AES (Server requires maximum) |
| AlwaysOn | AlwaysOn | 128-bit AES |
| AlwaysOn | AlwaysOff | Connection fails (Server requires encryption, Viewer refuses) |
| PreferOn | AlwaysOff | Unencrypted (Server does not enforce) |
Comments
Article is closed for comments.