Remote access is one of those tools nobody thinks about until the invoice arrives. For years the default answer was TeamViewer, and for years that was fine — until the licence costs grew, the commercial-use detection started interrupting legitimate sessions, and the question “where exactly is this session being relayed?” started appearing in security reviews.
RustDesk is the open-source answer that has picked up the most momentum. It is a remote desktop tool written in Rust, licensed under AGPL-3.0, and — the part that actually matters — you can run the whole thing on your own server.
What RustDesk actually is
At its simplest, RustDesk behaves the way you would expect: install the client, read off a numeric ID and a one-time password, and someone else can connect. It runs on Windows, macOS, Linux, Android and iOS, and there is a browser client, so the technician's platform does not have to match the user's.
The project is unusually active. The client repository has over 126,000 stars on GitHub, with version 1.5.0 released at the end of September 2026. The self-hosted server is a separate repository, currently at 1.1.16. Both are AGPL-3.0.
That licence matters more than it looks. AGPL means that if you modify RustDesk and offer it as a network service, you have to publish your changes. For almost every business simply using the software internally, this has no practical effect — but it is worth knowing before anyone starts building a product on top of it.
The real argument: self-hosting
Out of the box, RustDesk uses public rendezvous and relay servers, the same model as any commercial tool. The difference is that you do not have to.
The self-hosted server is two small components:
- hbbs, the ID and rendezvous server, which is how clients find each other
- hbbr, the relay, which carries traffic when a direct peer-to-peer connection cannot be established
Both run comfortably on a modest VPS. Once your clients are pointed at your own server, remote sessions for your organisation stop depending on anyone else's infrastructure, and stop appearing in anyone else's logs. For a company handling client systems under a confidentiality obligation — an accountancy practice, a medical clinic, a law firm — that is not a nice-to-have. It is often the difference between a tool you can justify and one you cannot.
Connections are end-to-end encrypted using NaCl, so the relay forwards traffic it cannot read. When a direct connection is possible, the relay is bypassed entirely.
What you give up
This is where most write-ups go quiet, so let us be direct about it.
The free server is plumbing, not a product. RustDesk Server OSS does one job: it brokers IDs and relays traffic. There is no web console, no user accounts, no role-based permissions and no audit log. If your compliance position depends on being able to show who connected to which machine and when, the open-source server alone will not give you that.
The management layer is commercial. RustDesk Server Pro is proprietary, self-hosted software that adds the web console, central device management and address book you would expect from a managed tool. It is licensed on the number of login users and managed devices. It is still far cheaper than most per-seat commercial alternatives, but it is not free, and anyone budgeting on the assumption that “RustDesk is open source” should know where that line falls.
There is no independent security audit. RustDesk has no SOC 2 certification and no published third-party audit. The code is open, which means it can be inspected — that is genuinely different from a closed product — but “open source” is not the same as “audited”, and a regulator or an enterprise procurement team will not treat it as such.
The defaults need hardening. An unattended RustDesk install with a weak permanent password is a remote access service with a weak permanent password. The software will not stop you doing that.
Who it suits
RustDesk is a strong fit if you are an internal IT team or a service provider supporting a known set of machines, you have somewhere to run a small server, and the cost of commercial per-technician licensing has become hard to justify. It is a particularly good fit where data residency is a real requirement rather than a preference.
It is a weaker fit if you need audit trails and access reviews out of the box without paying for Server Pro, if your procurement process requires a certified vendor, or if you have no one who can look after a server. Remote access software that nobody is patching is a liability, whoever wrote it.
Deploying it sensibly
If you do go ahead, treat it as infrastructure rather than an app install:
- Host the server yourself and point every client at it, so no session silently falls back to public infrastructure.
- Pin the public key in the client configuration, so clients refuse to talk to a server that is not yours.
- Never use a shared permanent password. Use one-time passwords for ad-hoc support, and per-machine credentials where unattended access is genuinely needed.
- Restrict unattended access to the machines that actually require it, and review that list on a schedule.
- Keep clients and server on the same version and patch them deliberately. This is remote access; an old build is not a cosmetic problem.
- Decide the logging question early. If you need a connection record, budget for Server Pro rather than discovering the gap during an incident.
The short version
RustDesk is not a like-for-like replacement for a managed commercial product, and anyone presenting it as a free swap for TeamViewer is skipping the interesting part. What it is — a well-maintained, cross-platform, end-to-end encrypted remote access tool that you can run entirely on your own infrastructure — is genuinely valuable, and for a lot of organisations it is a better answer than paying per technician for a service that relays their sessions through somebody else's data centre.
The decision usually comes down to one question: do you have someone to run it properly? If the answer is yes, it is well worth evaluating. If the answer is no, that is the problem to solve first.
Livezen Technologies deploys and manages self-hosted remote access and IT infrastructure for businesses across Sri Lanka, the UAE, the UK and the USA. If you are weighing up a move away from per-seat remote access licensing, talk to our team and we will walk through what it would take in your environment.