panosync

brew install msbayindir/tap/panosync      # macOS and Linux; or, without Homebrew:
curl -fsSL https://raw.githubusercontent.com/msbayindir/panosync/main/install.sh | sh

panosync keeps the clipboard in sync between your macOS, Linux and Windows machines, even when they are on different networks. Everything is end-to-end encrypted on your devices; the small relay server you host in between only forwards bytes it cannot read.

• One small binary per side. The client is a single 3.1–4.5 MB executable with no runtime; the relay is about 1.4 MB.
• Self-hosted relay in one step. A Dockerfile that Coolify (or any Docker host) builds as-is, or a prebuilt image on ghcr.io.
• No accounts, no web UI. One command on the first device prints the one command to run on the others.
• Text only, on purpose. Copy on one machine, paste on another. That's it.

Contents: How it works · Quick start · Commands · Security model · Compared to alternatives · Troubleshooting · Development · License

How it works

   macOS                          relay (your server)                     Ubuntu
 ┌───────────────┐   wss://      ┌─────────────────────┐   wss://      ┌───────────────┐
 │ Cmd+C         │               │                     │               │               │
 │ encrypt with  │ ────────────► │ forwards ciphertext │ ────────────► │ decrypt,      │
 │ your key      │               │ to the other devices│               │ write to the  │
 │               │ ◄──────────── │ on the same channel │ ◄──────────── │ clipboard     │
 └───────────────┘               │                     │               └───────────────┘
                                 │ sees: IPs, timing,  │
     Windows ◄─────────────────► │ message sizes       │
                                 │ never: the key or   │
                                 │ the text            │
                                 └─────────────────────┘

1. panosync setup on the first device generates a random 32-byte key.
2. From that key, each device derives (with BLAKE3) an encryption key and a separate channel id.
3. Devices connect to the relay at /ws?channel=<channel id>. The relay groups connections by channel id and forwards each message to the other devices in it.
4. Every message is encrypted with XChaCha20-Poly1305 before it leaves the device.

The full protocol and threat model are in docs/architecture.md.

There are two programs:

Program	Runs on	Does
panosync	your macOS / Linux / Windows machines	watches the clipboard, encrypts and sends changes, writes incoming text to the clipboard
panosync-relay	a server (Docker, Coolify, any VPS)	the relay

Quick start

You need a relay reachable over wss:// (WebSocket over TLS) and the client on each machine.

1. Run the relay

The relay speaks plain ws:// on port 8080 and expects a reverse proxy in front of it for TLS. The short version is below; docs/self-hosting.md covers Coolify, Docker, systemd, Caddy, nginx and local-network-only setups in detail, with what each was tested with.

Coolify (TLS is handled for you)

1. Fork this repository (or point Coolify at it directly) and create a new resource from it.
2. Build Pack: Dockerfile · Ports Exposes: 8080 · Domains: https://panosync.example.com
3. Deploy, then open https://panosync.example.com/health. It should answer ok.

No domain? Coolify's sslip.io addresses work too (e.g. https://panosync.1.2.3.4.sslip.io).

Docker

docker run -d --name panosync-relay --restart unless-stopped -p 8080:8080 ghcr.io/msbayindir/panosync-relay:latest

Put any TLS reverse proxy in front of it. With Caddy, the whole config is:

panosync.example.com {
    reverse_proxy localhost:8080
}

For nginx, the WebSocket Upgrade headers are required; see docs/self-hosting.md.

From source: cargo run --release -p panosync-relay (set PORT to change the port).

2. Install the client

Homebrew (macOS and Linux)

brew install msbayindir/tap/panosync

The formula installs the same prebuilt binaries as the release page, and brew services start panosync starts panosync at login.

Install script (macOS and Linux)

curl -fsSL https://raw.githubusercontent.com/msbayindir/panosync/main/install.sh | sh

The script picks the right binary for your OS and CPU, checks its SHA-256 against the release's SHA256SUMS, and installs it to ~/.local/bin (override with PANOSYNC_INSTALL_DIR=/usr/local/bin, pin a version with PANOSYNC_VERSION=v0.1.0). Read it first if you like: install.sh.

Windows: download panosync-x86_64-pc-windows-msvc.zip from the latest release, unzip it and put panosync.exe somewhere on your PATH.

Manual download: every release has archives for aarch64-apple-darwin, x86_64-apple-darwin, x86_64-unknown-linux-gnu, aarch64-unknown-linux-gnu and x86_64-pc-windows-msvc, plus SHA256SUMS. The binaries are not code-signed. On macOS, if you downloaded with a browser, clear the quarantine flag once: xattr -d com.apple.quarantine ./panosync.

cargo-binstall: cargo binstall --git https://github.com/msbayindir/panosync panosync downloads the prebuilt binary for your platform from the release (panosync is not on crates.io, hence --git).

From source: cargo install --git https://github.com/msbayindir/panosync panosync (Rust 1.88+).

3. Pair your devices

On the first device, run setup without a key. A new key is generated:

panosync setup --server wss://panosync.example.com

It prints the exact command to run on every other device:

This is the beginning of the README. Read the rest at the original. Read the full README ↗