Windows Guides
Connect to a Mac from Windows with TightVNC over SSH
TightVNC can be part of a secure Mac remote-access workflow when the VNC session travels through an SSH tunnel instead of reaching port 5900 directly.
At a glance
- Use SSH to reach the Mac first; use TightVNC against the local tunnel port second.
- With VNC lockdown enabled, TightVNC should connect to localhost, not the Mac LAN IP.
- The VNC password belongs to the screen layer; the SSH key passphrase belongs to the tunnel layer.
The two-layer connection
A secure TightVNC-to-Mac workflow has two layers. First, Windows opens an SSH tunnel to the Mac. Second, TightVNC connects to a local VNC address exposed by that tunnel, often localhost:5901.
That local address can feel strange at first. TightVNC is running on Windows, but localhost:5901 is the Windows side of the tunnel. The tunnel then lands on the Mac and reaches the Mac screen service from there.
What to prepare on the Mac
The Mac needs Screen Sharing enabled, an SSH endpoint available, and a key that is allowed to open the VNC tunnel. The safest version of the key is not a normal shell login. It should be limited to the connection path it needs.
If legacy VNC authentication is required by the viewer, create or copy the VNC password from the Mac-side tool that manages the screen-sharing compatibility layer. Store it separately from the SSH key passphrase.
What to do on Windows
Run the prepared Windows tunnel script or SSH command. If the private key is encrypted, enter the SSH key passphrase when prompted. Once the tunnel is open, start TightVNC Viewer.
In TightVNC, set the remote host to localhost:5901 unless your tunnel script prints a different local port. Do not enter the Mac IP as the VNC host when VNC lockdown is enabled. The Mac IP belongs to the SSH side, not the VNC side.
- SSH side: Mac host, HearthGate SSH port, private key.
- VNC side: localhost:5901, then the VNC password if prompted.
- Router side: forward SSH only if internet access is needed.
Where HearthGate helps
HearthGate can generate the Windows script, package the private key, show the connection state, report the active tunnel, and keep the VNC port protected behind SSH. TightVNC stays the viewer. HearthGate owns the Mac-side gateway posture.
That separation is useful: keep using the Windows viewer you know, but do not make the Mac screen port the thing Windows reaches directly.
Want the Mac-side gateway for this model?
HearthGate packages secure VNC over SSH, restricted keys, firewall VNC lockdown, connection bundles, and session visibility into one native Mac app.
Explore HearthGate