brocodedThe short version
- End-to-end encrypted. Keys are made on your phone and computer when you pair. The private halves never leave them.
- We cannot read your work. Our relay forwards data it cannot open. It sees connection times and message sizes.
- Pairing is guarded. A one-time code, five minutes, and an Allow prompt on the Mac.
- No open ports. Both devices connect out to the relay.
Who is trusted with what
| Party | Trusted with |
|---|---|
| Your computer’s Brocoded app | Everything. It runs your sessions. |
| Your paired phone | Full control of that computer’s sessions and inbox. |
| The relay | Nothing. It forwards encrypted frames and knows who connected and when. |
| The network | Nothing. |
| Other apps on your computer | Nothing. The local agent receiver needs a per-session secret. |
Threats and answers
Someone reads or edits traffic between your devices
Everything about a session is end-to-end encrypted between your phone and your computer. A tampered or replayed message drops that phone’s link.
A stranger tries to pair with your computer
Pairing needs a one-time 256-bit token that is valid for 5 minutes and works once. The window closes after repeated wrong guesses. In the Mac app you must also press Allow on the computer, seeing the phone’s name and code.
A stranger dials your computer by guessing its address
An unpaired device can only send a pairing token, and only while a pairing window is open.
You lose a phone
Remove it from Devices. It is cut off within a second, including live connections.
A paired phone, or a bug in it, floods your computer
Each phone has a frame limit and is cut off when it goes over. The relay also caps message size, buffering and phones per computer.
Another program on your computer fakes agent reports
The local receiver for agent reports listens on 127.0.0.1 only, and every report needs a per-session secret that the agent receives through its environment.
You approve the wrong thing
Cards show the full command, which you can copy. Open approvals cannot be dismissed, only answered. The first answer, from the phone or the computer, wins and the other side is told.
Secrets leak into logs or alerts
Logs remove tokens, passwords, pairing codes and URL credentials, and never record commands, questions or terminal output. Alerts are empty pushes with fixed wording.
Keys are stolen from disk
Private keys go to the operating system’s keychain when it is available, otherwise to files only you can read, with a warning.
What is not covered
- A compromised computer, or an unlocked and compromised phone. Either one has full control by design.
- Denial of service by someone who can reach the relay.
- Metadata. The relay sees connection times and message sizes.
- Alerts depend on the phone makers’ push services, which learn that your phone received a push, and when. The push has no content.
Status and review
The way the encryption is put together has not yet had an external cryptography review, and we would rather say so than imply otherwise. Brocoded is in early access. Not every platform has had the same amount of real-device testing, which is why the docs list supported platforms explicitly.
What data we handle, and which providers hold it, is in the privacy policy.
Report a problem
If you find a security problem, email [email protected] with the details. Please give us a reasonable chance to fix it before you share it publicly.