Keep terminal contents private.
Encryption is on by default. Your computer encrypts terminal data and authorized browsers decrypt it. MCP grants deliberately add a separate decryption path.
On this page
Use the generated password
A normal session generates a random ten-character base64url password. The CLI prints it with the share link. The QR code includes it for one-scan access.
For sensitive or longer-lived work, use a longer unique password through SHELL_ONLINE_E2EE_PASSWORD. Do not reuse an account password or put the value in logs.
Recover an active password
On the host computer, retrieve the password from its local session record. If you enabled your account’s personal vault, a sealed copy may also be available there.
shell password <ID>- Reveal one session password deliberately. The service has no recovery backdoor if all owner-held copies are lost.
Rotate without restarting the task
Rotation changes the password, URL salt and cipher generation. Current viewers disconnect, old MCP grants are revoked, and persistent state and the owner’s vault copy are updated.
shell password rotate <ID>- Share the new complete link and password only with people who should retain access.
How keys are made
The link’s #salt= fragment contains a random salt. The host and browser derive the AES-256-GCM frame key locally using PBKDF2-HMAC-SHA256 with 600,000 iterations.
URL fragments are not part of HTTP requests. The QR’s password remains sensitive to anyone who sees the QR. Ten random base64url characters provide 60 bits of randomness; a longer unique password is preferable for sensitive, long-lived sessions.
Encrypted content and visible metadata
Terminal input, output, snapshots and latency probes are authenticated ciphertext. Current envelope-v2 frames bind direction, sender stream and sequence so receivers reject duplicate or stale frames.
The relay can still delay or drop traffic. It sees timing, addresses, encrypted sizes, labels and lifecycle metadata. Grid dimensions travel in plaintext control messages: terminal_size to viewers, the host's own terminal_grid, and a viewer's grid_request.
MCP changes who can decrypt
A host-issued MCP grant supplies the server with the authority to decrypt in memory for that grant’s lifetime. The controller receives plaintext output. This is why the browser visibly says server-side decryption is authorized.
Revoking grants removes future MCP access; it does not erase results already received. Create or revoke a grant.
Vault and browser storage
The optional vault keeps encrypted password copies per account. Unlocking happens in the browser. A vault password, supported PRF passkey or recovery key is needed; team membership alone is not enough.
The current browser password cache is memory-only. A reload needs the vault or password again. A legacy password blob may remain as a read-only migration source until it can be migrated safely; this does not mean new passwords are written there.
Turning encryption off
--no-e2ee is an explicit compatibility/debugging choice, not the default. The relay can then read terminal contents. It conflicts with password overrides and persistence. Avoid it for private work.