Pairing & Trust

Let a new device in once, from the host's web console, and it reconnects on its own after that. There are no accounts and nothing leaves your network.

Approve it from the console (no PIN)Copy Anchor Link

1. On the new device, pick the host and choose Request access.
2. In the console, open Devices. The device is listed under Waiting for approval.
3. Click Approve, set its access, enter your Console password and click Approve. The device is now paired, even while another device is streaming. Pick the host on it to start streaming.

Deny only dismisses the request; the device can ask again. Requests expire after 10 minutes.

Pair with a PINCopy Anchor Link

1. In the console, open Devices, click Pair a device, enter your console password and click Show PIN. It shows a 4-digit PIN for two minutes.
2. On the device, pick the host, choose Pair with PIN… or Use a PIN instead…, and type the PIN.
3. The host now shows as paired. Pick it again to start streaming.

If the PIN runs out, click Pair a device again. A punktfunk:// link can't pair a device.

Moonlight works the other way round: Moonlight shows the PIN and you type it into the console. See Connect with Moonlight → Pair.

Choosing access when you admit a deviceCopy Anchor Link

• Access level: Full control, Controller only or View only. Advanced opens the individual permissions (Access levels).
• Access expires: Never, Until they disconnect, 1, 4 or 8 hours, or Custom….
• Approve as guest: Controller only, for 4 hours. Use it for a friend's device.

Pair a device has the same two controls; they apply to whichever device uses the PIN.

Until they disconnect removes the device a minute after its last session ends. To come back, it pairs again.

A device that asked From the internet can't be approved: its name proves nothing. Click Arm PIN on its row to make a PIN only that device can use, and pass the PIN on. See Friends over the internet.

Managing paired devicesCopy Anchor Link

Devices lists every paired device with its access and any expiry countdown. Edit access in its row changes its access or expiry; Unpair cuts it off at once, even mid-stream. On a phone they sit in the row's ⋯.

Moonlight clients all report the same name. Name one as you enter its PIN, or later with Rename in its row.

Can't pair at all? See Troubleshooting → Pairing is rejected.

How it worksCopy Anchor Link

The host has a stable certificate; each side pins the other's fingerprint. The PIN exchange is SPAKE2: someone without the PIN gets one online guess and nothing to attack offline. If a host's fingerprint changes, the client refuses it and asks you to pair again. To run without pairing on a fully trusted network, see Security → Pairing policy. To pair from a script, use punktfunk pair.