CLIAnywhere has two parts: an open-source daemon that runs on your Windows, macOS, or Linux PC and owns your terminal sessions, and a client app on your phone or browser that attaches to them. You install the daemon once, link your device with an access key, and connect — peer-to-peer DTLS when a direct path is available, an encrypted relay when it is not. Commands always run on the PC; your phone is a window onto the session.
The whole system, end to end. Each step is expanded below.
Everything starts on the computer you want to reach. The CLIAnywhere daemon is a small open-source program that runs on Windows, macOS, and Linux — as a desktop app, or as a headless CLI build on machines with no display. It owns the shell sessions, spawns bash, zsh, fish, cmd, pwsh, and powershell as you open them, and keeps them alive.
You sign in with your account so your devices can find each other, and the daemon generates a Security Code locally on that machine. Signed builds are available from GitHub Releases, and because the source is published, you can also build it yourself. The full walkthrough lives in the setup guide.
Next, you pair a client — the iOS or Android app, or the Web App — with that computer. The daemon displays a QR code you can scan, or an access key you can paste into the app. Either way, the key is used only to authenticate the SPAKE2 key exchange between your computer and the app; it is never uploaded to our servers.
Each PC also has its own Security Code, generated and stored locally on that machine and never uploaded anywhere. You are asked for it whenever you connect, which adds a layer of protection that works even if your account credentials are compromised.
When you tap a computer in the app, CLIAnywhere first tries to establish a direct peer-to-peer link between your devices, encrypted with DTLS. When no direct path is available — strict NATs, corporate firewalls, hotel Wi-Fi — traffic falls back to an encrypted WSS relay. It is a secure transport either way, and all connections are outbound from your computer.
That outbound-only design is why there is nothing to configure: no port forwarding, no router rules, no public IP address or DDNS. For more on that trade-off, see remote access without port forwarding.
This is the part that changes how the terminal feels. The session lives on the PC, under the daemon — not in the app. Close the app, lock your phone, ride through a tunnel: the shell keeps running, with its processes, its scrollback, its environment. Reconnect and the same session is waiting.
It also means every client sees the same session. Start work at your desk, check on it from your phone while you are away, open it again later from a browser — you are always looking at one terminal, not three copies of one. This model is covered in depth in how persistent terminal sessions work.
On top of the terminal, two things ride the same connection. A file browser lets you walk the host's file system and download files straight to your phone. And because the daemon runs on your PC, it can reach services bound to localhost or your LAN — a dev server on localhost:5173, a router admin page, a NAS dashboard — and expose them to your phone from anywhere.
Both use the same end-to-end encrypted channel as the terminal itself. For the specifics, see how to access localhost web apps from your phone.
What CLIAnywhere supports, at a glance.
| Windows host | Yes |
|---|---|
| macOS host | Yes |
| Linux host | Yes — desktop UI or headless CLI |
| iOS client | Yes |
| Android client | Yes — Google Play |
| Web client | Yes — webapp.clianywhere.com |
| Shells | bash, zsh, fish, sh, cmd, pwsh, powershell |
| Persistent sessions | Yes |
| Desktop–mobile session switching | Yes |
| File browser and download | Yes |
| Localhost / LAN web access | Yes |
| P2P direct connection | Yes — DTLS |
| Encrypted relay fallback | Yes — WSS |
| End-to-end encryption | SPAKE2 + AES-256-GCM |
| Port forwarding / public IP required | No |
| Open-source daemon | Yes |
| Account model | One account, multiple PCs, per-PC local Security Code |
Short, direct answers to the questions people ask most.
Install the daemon, link your phone, and you are three steps in already.