VNC Moves Into the Browser With Zero Trust Built In
Cloudflare has extended its browser-based remote access offerings to cover Virtual Network Computing (VNC), letting teams reach graphical desktops from any device without installing client software. The new Browser VNC feature runs across Cloudflare's entire edge network — more than 200 cities — and is built on Cloudflare Workers for near-instant session startup.
The VNC client is delivered as a fully browser-rendered experience with Zero Trust controls baked in, mirroring the company's earlier browser-based SSH terminal. Instead of maintaining separate VNC viewer software on each user's machine, administrators can now point users at a URL.
Why VNC Deployments Are Painful
VNC is a platform-independent desktop sharing protocol built on top of the Remote Frame Buffer protocol. It gives administrators a way to expose a GUI to users who aren't comfortable with a command line, or for tasks that require a visual interface. Common business use cases include creating "clean room" environments where users can interact with sensitive data that shouldn't leave a secure server.
Traditional VNC deployments require installing viewer software on every end-user machine, which brings along operating system compatibility issues, security update management, and general overhead. Controlling that software typically means Mobile Device Management (MDM) or asking users to configure their own machines — a problem compounded when contractors or external users need access.
Security monitoring is another hurdle. Tracking when a user connects to a VNC server and what they do during a session requires significant network configuration. And unlike SSH, where OpenSSH dominates both server and client sides, the VNC ecosystem is fragmented across many commercial and free implementations with varying quality and security postures.
Rendering VNC at the Edge
The biggest technical challenge for a browser-based VNC client is latency — if mouse movements or keystrokes lag, the interface becomes unusable. Cloudflare addresses this by terminating VNC connections at its edge via Cloudflare Tunnel, which puts the service within 50 ms of 99% of Internet users.
Browsers can't natively handle raw TCP connections, so a VNC-over-WebSocket proxy is normally required. Because Cloudflare Tunnel already provides that TCP-level proxy through cloudflared, the team could connect to existing TCP tunnels and deliver an entirely in-browser VNC session. The connection is end-to-end encrypted between the web client and the VNC server inside the customer's network.
Authentication runs through Cloudflare Access. Once a user's identity is verified, they receive a cookie that is checked on every subsequent request to the VNC server.
The Shift Away From Installed Clients
Moving VNC into the browser eliminates most of the traditional overhead. Users need only an Internet connection and a URL — no PuTTY-style clients or standalone VNC viewers for SSH and VNC sessions respectively.
Legacy VNC servers are a known attack vector because they're hard to keep patched and monitored. A browser-based client lets Cloudflare push security updates instantly and lean on the sandboxing and other security features already built into modern browsers.
Observability also improves. The platform already logs every time a user accesses a VNC or SSH server via the browser, and future releases will add session screen recording and network request logging for a fuller picture of what happened during a session.
Availability and Roadmap
Browser VNC is available now in every Cloudflare for Teams plan. Teams of up to 50 users can start at no cost. Cloudflare says it will soon announce support for additional protocols that previously required on-premises deployments, and is soliciting feedback from the Cloudflare Community on which protocols to prioritize. A step-by-step tutorial is available for teams ready to set up a VNC client in the browser today.
