Web client
Use your computer's sessions in a browser, from any network at app.kettu.sh, or on your own network, a VPN or an SSH forward with no account.
The web client is Kettu in a browser. A browser on a phone, a tablet or another computer pairs with your computer like any other device, and then works with its sessions as the window does: the same sessions, settings, themes and artifact previews. There is nothing to install.
It opens in two ways:
- From any network, at app.kettu.sh, signed in to your Kettu account. See From any network.
- On your own network, a VPN or an SSH forward, served by Kettu on your computer, with no account. See On your own network.
From any network
At app.kettu.sh, the browser reaches your computer through the Kettu relay, wherever each of them is: no VPN, no port forwarding and no port open on the computer. The relay only passes on what the browser and the computer encrypt end to end, so it cannot read your sessions.
It works once both are signed in to the same Kettu account:
- On the computer, open Settings › Account and sign in, then keep Use the Kettu relay on in Settings › Remote access.
- In the browser, sign in with that same account. The browser counts as one of the account’s devices.
Open app.kettu.sh and click Sign in. The Kettu website asks you to sign in, or only to confirm when you already are, and brings you back.
On the computer, open Settings › Remote access, click Add device… and keep App under Open with.
Scan the QR code with the device’s camera, or open the link in the browser. Where the Kettu app is not installed, the link opens app.kettu.sh with the code.
On the computer, Kettu asks Add this device?. Choose Add.
A pairing link opened before you sign in works too: the page asks you to sign in first, then goes on pairing. The relay connects a browser only to computers signed in to the same account, so use the account the computer is signed in to.
Without a Kettu account, or with the relay off on the computer, open the page the computer serves instead, on the same network, over a VPN or through an SSH forward, as below. That page connects straight to the computer, and nothing passes through Kettu’s servers.
On your own network
Kettu on your computer serves the web client on its remote access port, with no account. Turn on Settings › Remote access first. The page is there only while Kettu runs on the computer.
On the computer, open Settings › Remote access, click Add device… and choose Browser under Open with.
Scan the QR code with the device’s camera, or open the link in a browser on a device on the same network or VPN. The link looks like http://192.168.1.20:47821/pair#…, with one of the computer’s addresses and its port. When the computer has more than one address, such as its Wi-Fi address and its Tailscale address, Address picks the one the link uses.
The page connects and reads Confirm where the code is shown. On the computer, Kettu asks Add this device? with a name such as Safari · iPhone. Choose Add.
The page reads Added. Opening Kettu… and opens Kettu.
In a browser not paired yet, the page opened without a code shows Use Kettu in this browser with a Pairing link field: paste a link from Add device, the Browser link or the App link, and click Pair. A browser already paired can add another device too, from Settings › Remote access › Add device… in its own Settings.
A browser keeps its pairing per address. The same browser opened at the computer’s local address, at its Tailscale name and at an SSH forward’s localhost is paired once for each, and the computer lists it as that many devices. After the port changes, add the browser again at the new port.
Reaching the computer
The browser connects to the address it opened the page at, so that address has to reach the computer.
On the same Wi-Fi or wired network, open the link with the computer’s private address, picked under Address when there is more than one.
With both devices on the same VPN, such as Tailscale, pick the computer’s VPN address under Address before you scan or copy the link.
When you can sign in to the computer over SSH, forward its remote access port, the one in Settings › Remote access › Port, on the device you browse from:
ssh -L 47821:localhost:47821 you@your-computer Then open http://localhost:47821 in that device’s browser and paste the link from Add device. A page on localhost shows no warning about plain http, and notifications work there.
Plain http
Opened at a network address, the page comes over plain http, and it shows This page is not protected on the network.
Your conversation stays end-to-end encrypted, but the page itself arrives unprotected: someone who can change traffic on that network could change the page, and a changed page sees what you see in it. On a network you do not trust, open the page through an SSH forward to localhost, or over HTTPS, such as Tailscale’s. On https and on localhost the warning does not show, and the browser keeps this browser’s key so that the page cannot read it out.
If you think a page you used was changed, remove that browser in Settings › Remote access on the computer, as you would a lost device.
Working in the browser
A paired browser can do what any paired device can: follow sessions live, send messages, answer permission requests, start and rename sessions, attach files, open images, videos and project files, and see the project’s changes. Terminals open only while Allow terminal is on.
Where the window would open a folder picker, such as Open project, the browser asks for a path on the computer. Type a full path, or start with ~ for your home folder. Tab completes a name, ↑ and ↓ move through the list, and Enter takes the one picked.
When Kettu on the computer is updated, the page reads Kettu on the computer was updated. with Reload.
Settings in the browser
The browser shows every section of the window’s Settings, without what only the desktop app does: no Browser section, since the built-in browser runs in the desktop app; no Ask before quitting while agents or terminal commands are running, Run in the background or Open at login in General; no Zoom, since the browser zooms the page itself; no count on the Dock icon or taskbar button in Notifications; and no Third-party notices in About.
Settings come in two kinds:
| Kind | Settings | Where a change goes |
|---|---|---|
| The computer’s | Write titles for new sessions, Agents, Terminal › Shell, Git, MCP servers, Advanced › Proxy, Remote access and its devices, Sharing, and updates in About | Made on the computer, so it shows in the window and on every other paired device |
| This browser’s | The language, Appearance, Notifications, the terminal’s Font size and the rest | Kept in this browser only, as each window keeps its own |
In Settings › Remote access, this browser is marked This browser. Turning remote access off from the browser disconnects every device, this page too, until it is turned on again on the computer.
Settings › Hosts shows the computer this page connects to and whether it is online. Under This browser on and the computer’s name, Name is how the computer lists this browser, which can be changed while the page is connected. Forget… clears what this browser keeps to connect and goes back to pairing; the computer still lists the browser among its devices until you remove it there.
Themes
Themes work as in the window, with the theme files on the computer:
- Any paired browser can use the themes installed on the computer, and install more from the catalog or a file.
- Which theme shows is each browser’s own. A theme installed or chosen in a browser shows only there, and the window on the computer keeps its theme.
- A theme’s menu has Copy path, its file’s path on the computer, in place of showing it in Finder or Explorer.
- Remove… deletes the theme’s file on the computer, so it goes for every window and browser.
Color mode, Text size and Reduce motion are this browser’s own too.
Notifications
While the page is open and not in front, even in a background tab, the browser shows Kettu’s notifications, for the same events as the window’s and by the switches in this browser’s Settings › Notifications. Click one to go to its session. A closed page gets none.
Browsers give notifications only to pages on https or localhost. On a page opened over plain http, Settings › Notifications says so: open the page through an SSH forward to localhost, or over HTTPS such as Tailscale’s, to get them.
Send a test notification asks the browser for permission the first time. If the browser blocks notifications for the page, allow them in the browser’s settings for that site and try again.