Parsec security
built around privacy

The security model behind Parsec software

Security in remote desktop software is often discussed in terms of features — encryption, MFA, access controls. But the most meaningful security property of the Parsec app isn't any individual feature — it's the architectural decision to route media traffic peer-to-peer rather than through a central server. That decision has compounding security benefits that go well beyond what any individual feature layer can provide.

Why peer-to-peer means better privacy than you might expect

When you make a video call through most consumer services, your video travels through the service provider's servers. The provider can see — in principle — what you're transmitting. They typically don't, and encryption in transit protects against casual interception, but the provider's infrastructure is in the data path. If you're connecting through Parsec software, this isn't the case.

After authentication through the parsec login system, Parsec's servers step out of the connection entirely. Your video and input data travel directly between your client device and the host machine over an encrypted channel. The keys for this channel are negotiated between the two endpoints using Diffie-Hellman key exchange — the signaling server never learns them. Even in the theoretical scenario where Parsec's infrastructure was compromised, the attacker would see only encrypted blobs with no ability to decrypt them.

Parsec login security: what happens at authentication

The parsec login process is designed to be secure against both credential stuffing attacks and session hijacking. Passwords are stored using bcrypt hashing with per-user salts, and the authentication endpoint implements rate limiting and CAPTCHA challenges to prevent automated attack tools from being effective. If you enable MFA on your parsec login — which we recommend — even a leaked password can't be used to compromise your account without the second factor.

For enterprise users with SSO configured, the parsec login doesn't use a Parsec-managed password at all — authentication happens entirely through the identity provider. This means your Parsec credentials are subject to all the security controls that your IdP enforces, including conditional access policies, geographic restrictions, device compliance checks, and session duration limits.

Host-side security controls in the Parsec app

The host machine's operator has granular control over what connected guests can do during a session. These controls exist because Parsec software is often used for scenarios where the host and guest have different trust levels — for example, a contractor accessing a client's machine, or a student accessing a school's GPU cluster. The ability to restrict clipboard sharing, disable file transfer, limit application visibility, and block input pass-through means that high-trust and low-trust access scenarios can coexist within the same Parsec for Teams deployment.

Application visibility controls are particularly notable. In Parsec for Teams and Enterprise, admins can configure a host machine to only show specific applications to connected guests — a guest connecting to do color grading might see only the color software, without access to the filesystem, email client, or other applications running on the same machine. This kind of application-level isolation is unusual in remote desktop software and makes Parsec practical for scenarios that would otherwise require complex VDI deployments.

Parsec software and network security

Parsec app connections use UDP for media transmission, which is standard for real-time media protocols. The specific UDP port range (8000–8100 by default) can be configured in the Parsec software settings, and the app supports custom port ranges for environments with restrictive firewall policies. For enterprise deployments where UDP is blocked entirely, the Enterprise relay server provides a TCP-based fallback pathway while keeping traffic within the organization's own network perimeter.

On local networks, Parsec software uses mDNS discovery to find host machines directly, without routing through the signaling server. This means that on-campus or within-studio connections can be established and maintained even if internet access is unavailable. It also means that the security perimeter for these connections is entirely within your own network — there's no external dependency to manage.

What Parsec can and cannot see

Transparency about what a software provider can access is increasingly important to security-conscious users and compliance teams. Here's a plain statement of what Parsec's infrastructure has access to: account information (email, username, subscription status), machine registration data (machine names, online/offline status), and connection metadata (who connected to which machine, when, and for how long). Parsec's infrastructure does not have access to the content of remote sessions, the video stream of what's on the host's screen, the input events typed or clicked during a session, or any files that exist on host or client machines.

This is a meaningful distinction from many remote desktop and screen sharing tools, where the provider's infrastructure is in the media path and could theoretically capture session content. The peer-to-peer architecture of the Parsec app is the technical mechanism that enforces this separation — and the SOC 2 Type 2 audit provides external validation that the actual system behavior matches this description.

Keeping your Parsec account secure: practical recommendations

Enable multi-factor authentication on your parsec login if you haven't already. The session-sharing capabilities of the Parsec app mean that a compromised account isn't just a loss of data — it could mean unauthorized access to your host machines. MFA is the single most effective control against account takeover for individual users.

Review your connected machines periodically. The Parsec app's My Computers panel shows every machine currently registered to your account. If you see a machine you don't recognize — perhaps an old laptop you no longer use — remove it from the list. A deregistered machine can't be connected to even if someone has your account credentials.

For Parsec for Teams admins, audit the guest access list regularly and revoke access for users who no longer need it. The connection logs in the admin panel make it straightforward to identify inactive accounts and users whose access patterns seem unusual. Combining periodic access reviews with SSO-enforced session expiry gives you a strong layered approach to access management.

Parsec web security considerations

Using parsec web in a browser introduces some security considerations that differ from the native Parsec app. Browser-based access means the parsec login credentials are processed by the browser's credential storage, which may be shared across multiple websites if you're using a browser profile without strict sandboxing. For sensitive enterprise use, it's worth considering whether browser-based parsec web access should be permitted from unmanaged devices.

The parsec web client uses WebRTC for its media channel, which inherits the same end-to-end encryption guarantees as the native client. The browser doesn't have access to the media stream content — it renders the decoded video locally. However, browser extensions could potentially capture screen content, so users on shared machines should be aware of what extensions are installed before initiating a session through parsec web.

For Teams and Enterprise deployments, admins can restrict parsec web access entirely if the security posture requires it, forcing all connections through the managed native Parsec app instead. This provides a stricter access control surface and ensures that connection events are always captured in the connection audit log.