A Deep Dive Into How Terminal-Sharing Tools Put Your Shell in a Browser

When you are debugging an issue on a box and your teammate asks you to just show them your screen, you usually end up screen sharing a 4K monitor over a video call so they can squint at 11px monospace text compressed into an unreadable mess. Fortunately, a better way has existed for years.

Tools like ttyd, TermPair, and sshx put your actual terminal directly into someone else's browser with real text and real selection. Curious about how they pull this off, the creator of git-lrc cloned all three codebases and read through them, discovering that they solve the exact same problem in three fascinatingly different ways.

Stock photo for illustration only, not from the actual event

Before any web-related concepts make sense, you first need to grasp the pseudoterminal, or PTY. When you run bash in your terminal app, bash isn't actually talking to your keyboard. Instead, the kernel sets up a pair of linked file descriptors to impersonate a physical teletype from 1965, with one end acting as the master and the other as the slave.

Your terminal emulator holds the master end while bash holds the slave, completely unaware that it is being catfished. Anything you write to the master shows up as keyboard input to bash, and anything bash prints comes back out of the master. Terminal-sharing tools simply act as programs that hold the master end and forward those bytes somewhere more interesting than your local laptop window.

ttyd represents the straightforward, no-nonsense implementation built as a single C process on top of libwebsockets and libuv. It acts as both the web server and the terminal host with no relay, no separate client, and no key exchange. Its protocol is refreshingly simple: '0' plus your keystrokes goes up, and '0' plus terminal output comes down.

It also features PAUSE and RESUME mechanisms so that if a massive file is dumped rapidly, the client can apply backpressure instead of crashing. The Preact and xterm.js app is bundled, gzipped, and inlined directly into a C byte array, resulting in a single executable with no static files to misplace, though modifying source files requires rebuilding the C binary.

By default, ttyd is read-only unless you pass the -W flag to allow viewers to type. Its threat model assumes you trust the server because it runs entirely on your local machine, and traffic remains plaintext unless TLS is enabled.

The moment you want to share a terminal across the internet, however, you need a middleman with a public IP, which introduces the security risk of that middleman reading everything you type. TermPair and sshx solve this by making the server a blind relay that routes ciphertext between the host and browsers without having any capability to decrypt it.

Because the client encrypts and the browser decrypts, both require the key, but the server must not have it. Since the browser itself is served by that same server, the developers pass the secret securely using URL hashes such as https://sharemyclau.de/s/abc123#key-goes-right-here. Everything after the hash symbol is never sent in HTTP requests and stays safely in the browser's address bar.

Source: Dev.to