--- title: How we built a secure RDP client | daily.dev description: Teleport describes the architecture behind its browser-based RDP client, built to avoid the security weaknesses of typical remote desktop tools. Instead of... canonical: https://daily.dev/posts/how-we-built-a-secure-rdp-client-sc3hyigbc twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: How we built a secure RDP client | daily.dev og:description: Teleport describes the architecture behind its browser-based RDP client, built to avoid the security weaknesses of typical remote desktop tools. Instead of... og:url: https://daily.dev/posts/how-we-built-a-secure-rdp-client-sc3hyigbc og:image: https://api.daily.dev/og/posts/sc3HYigBc.png og:image:alt: How we built a secure RDP client og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # How we built a secure RDP client **[Teleport](https://daily.dev/sources/teleport)** · 7 min read · 0 upvotes · 0 comments ## Summary Teleport describes the architecture behind its browser-based RDP client, built to avoid the security weaknesses of typical remote desktop tools. Instead of exposing port 3389 or relying on passwords, the client runs in Rust (based on the rdp-rs crate), streams sessions through a browser sandbox, and authenticates using an emulated virtual smart card that issues short-lived, per-session certificates and cryptographically random PINs. Feature gaps (clipboard, file sharing) were closed using the browser's Clipboard API and File System Access API, and performance was improved by moving PNG encoding from Go to Rust, with a planned migration to IronRDP for RemoteFX codec support. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does Teleport's RDP client authenticate to Windows hosts without using passwords? It emulates a virtual smart card rather than proxying a physical device, issuing a fresh short-lived certificate for every session instead of reading credentials from real hardware. It also generates a cryptographically secure, maximum-length per-session PIN that Teleport sends automatically during the RDP connection sequence, so the smart card is never useful again after login, even to the user it was issued to. _daily.dev surfaces engineering deep dives like this for teams designing passwordless authentication systems._ ### Why did Teleport choose Rust instead of using FreeRDP to build an RDP client? Rust was chosen because it is memory-safe, avoiding the risk of pulling in thousands of lines of unsafe C code from FreeRDP despite that library's maturity and performance. The client was built as a naive, minimal RDP implementation on top of the rdp-rs crate, deliberately implementing only the smallest protocol subset needed for remote desktop sessions to keep the security surface area small. _developers weighing memory-safe rewrites versus mature C libraries can track these tradeoffs on daily.dev._ ### How can a browser-based remote desktop client support clipboard and file sharing without native OS access? Clipboard sharing is powered by the browser's Clipboard API, and directory sharing is implemented using the File System Access API to mount a local directory, both accessed from within the browser sandbox rather than through native OS integrations. This approach was reported to be the first browser-based remote desktop client to offer this kind of functionality. _daily.dev helps developers building sandboxed browser clients stay on top of web API capabilities like these._ ## Similar posts on daily.dev - [Chrome Remote Desktop is an okay TeamViewer alternative, this free, open-source tool is better than both](https://daily.dev/posts/chrome-remote-desktop-is-an-okay-teamviewer-alternative-this-free-open-source-tool-is-better-than--7caca841a) · XDA Developers · 0 upvotes · 0 comments - [How We Added WebAuthn to a Browser-Based RDP Client](https://daily.dev/posts/how-we-added-webauthn-to-a-browser-based-rdp-client-l9f13e4p7) · Unit 42 · 0 upvotes · 0 comments - [GitHub - nakagami/grdpwasm](https://daily.dev/posts/github---nakagami-grdpwasm-uuru7e4g7) · Hacker News · 0 upvotes · 0 comments - [This free remote desktop tool is TeamViewer on steroids and I can’t recommend it enough](https://daily.dev/posts/this-free-remote-desktop-tool-is-teamviewer-on-steroids-and-i-can-t-recommend-it-enough-spdi1qnot) · XDA Developers · 2 upvotes · 1 comments - [RustDesk Pulls Ahead of TeamViewer, AnyDesk with Wayland Multi-Scaled Display Support](https://daily.dev/posts/rustdesk-pulls-ahead-of-teamviewer-anydesk-with-wayland-multi-scaled-display-support-ckjw4ntmr) · It's Foss · 83 upvotes · 2 comments --- Tags: [#authentication](https://daily.dev/tags/authentication), [#rust](https://daily.dev/tags/rust) [View this post on daily.dev](https://daily.dev/posts/how-we-built-a-secure-rdp-client-sc3hyigbc) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"How we built a secure RDP client","url":"https://daily.dev/posts/how-we-built-a-secure-rdp-client-sc3hyigbc","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/how-we-built-a-secure-rdp-client-sc3hyigbc"},"datePublished":"2026-08-23T12:22:58.613Z","dateModified":"2026-08-23T12:50:08.478Z","description":"Teleport describes the architecture behind its browser-based RDP client, built to avoid the security weaknesses of typical remote desktop tools. Instead of...","image":"https://media.daily.dev/image/upload/s--2-1xRawN--/f_auto/v1722860399/public/Placeholder%2011","thumbnailUrl":"https://media.daily.dev/image/upload/s--2-1xRawN--/f_auto/v1722860399/public/Placeholder%2011","isAccessibleForFree":true,"articleSection":"Teleport","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Teleport","logo":"https://media.daily.dev/image/upload/s--Dw-Bbw6O--/c_limit,w_256/f_auto,q_auto/v1787487494/logos/teleport?_a=BAMAMicg0","url":"https://daily.dev/sources/teleport"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/how-we-built-a-secure-rdp-client-sc3hyigbc","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"authentication,rust","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Teleport","item":"https://daily.dev/sources/teleport"},{"@type":"ListItem","position":3,"name":"How we built a secure RDP client"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/how-we-built-a-secure-rdp-client-sc3hyigbc#faq","mainEntity":[{"@type":"Question","name":"How does Teleport's RDP client authenticate to Windows hosts without using passwords?","acceptedAnswer":{"@type":"Answer","text":"It emulates a virtual smart card rather than proxying a physical device, issuing a fresh short-lived certificate for every session instead of reading credentials from real hardware. It also generates a cryptographically secure, maximum-length per-session PIN that Teleport sends automatically during the RDP connection sequence, so the smart card is never useful again after login, even to the user it was issued to. daily.dev surfaces engineering deep dives like this for teams designing passwordless authentication systems."}},{"@type":"Question","name":"Why did Teleport choose Rust instead of using FreeRDP to build an RDP client?","acceptedAnswer":{"@type":"Answer","text":"Rust was chosen because it is memory-safe, avoiding the risk of pulling in thousands of lines of unsafe C code from FreeRDP despite that library's maturity and performance. The client was built as a naive, minimal RDP implementation on top of the rdp-rs crate, deliberately implementing only the smallest protocol subset needed for remote desktop sessions to keep the security surface area small. developers weighing memory-safe rewrites versus mature C libraries can track these tradeoffs on daily.dev."}},{"@type":"Question","name":"How can a browser-based remote desktop client support clipboard and file sharing without native OS access?","acceptedAnswer":{"@type":"Answer","text":"Clipboard sharing is powered by the browser's Clipboard API, and directory sharing is implemented using the File System Access API to mount a local directory, both accessed from within the browser sandbox rather than through native OS integrations. This approach was reported to be the first browser-based remote desktop client to offer this kind of functionality. daily.dev helps developers building sandboxed browser clients stay on top of web API capabilities like these."}}]} ```