Run Claude Code on your Mac from your iPhone. No cloud VM, no monthly bill, no exposed ports. Just your devices, connected.
$0
Monthly cost
15m
Setup time
2x
Encryption layers
01 — What
What Is This?
This setup lets you run Claude Code (or any terminal session) on your Mac — from your iPhone. From anywhere. Couch, coffee shop, bed, commute — anywhere you have a signal.
Your Mac stays plugged in and awake. Your phone becomes a window into its terminal. One command, you're in. Close the app, walk away, come back hours later — session is exactly where you left it.
Tailscale
Private encrypted network between your devices. No open ports needed.
cost: $0
Termius
SSH client for iPhone. Full terminal experience on your phone.
cost: $0
tmux
Keeps sessions alive when you disconnect. Pause button for terminals.
cost: $0
SSH
The actual connection protocol. Built into macOS since forever.
cost: $0
02 — Why Not Remote
Why This Over Claude Code Remote?
Anthropic offers Claude Code as a CLI and a web app. You can also run it on a cloud VM. Each approach has tradeoffs. Here's how they compare for mobile access.
✓ Full terminal — git, vim, docker, everything
✓ 15-minute one-time setup
Cloud VM
EC2 / VPS / Codespaces
× $20–100+/month for a decent VM
× Separate environment to maintain
× Port 22 exposed (even with security groups)
~ Extra hop through data center
✓ Persistent sessions (with tmux/screen)
× Requires internet
✓ Full terminal access
~ 30–60 min setup + maintenance
claude.ai/code
Browser-based
✓ Included with Pro subscription
× Runs in Anthropic's sandbox
✓ No infra to manage
~ Depends on Anthropic's servers
× Session doesn't persist across tabs
× Requires internet
× No access to your local filesystem
✓ Zero setup
💡
Bottom line: If you already have a Mac and want to code from your phone, this approach gives you full access to your own machine for free. Cloud VMs make sense for teams and CI/CD. The web app is great for quick prompts. This is for when you want your terminal, your files, from your phone.
03 — How
How It Works
Here's what happens when you open Termius and type cc:
📱
iPhone
Termius SSH client
→
🔐
Tailscale
WireGuard tunnel
→
💻
Mac
tmux + Claude Code
Tailscale gives both devices a fixed private IP (like 100.x.y.z) that works over any network. Devices talk directly peer-to-peer via WireGuard encryption.
SSH establishes an encrypted terminal session over that tunnel. Your Mac's port 22 is only reachable through Tailscale — invisible to the public internet.
tmux is a session living in your Mac's RAM. SSH just "attaches" to it — like plugging a monitor into a running computer. Disconnect? tmux keeps going. Reconnect? Right back where you were.
The Journey of a Single Keystroke
You tap 'l' on your iPhone keyboard
Termius encrypts it SSH · AES-256
iOS sends via Tailscale WireGuard · ChaCha20
Packet travels: Phone → Internet → Router → Mac
Mac's Tailscale decrypts the WireGuard layer
Mac's SSH daemon decrypts the SSH layer
Plaintext 'l' arrives at tmux → Claude Code
Response travels back the same way, encrypted twice
At no point does your keystroke travel unencrypted. Not on coffee shop WiFi, not on cellular, not anywhere.
04 — Setup
Setting It Up
One-time setup. About 15 minutes if you type at a normal human speed.
Tailscale — the network layer
On Mac:
Terminal
brew install tailscale
sudo brew services start tailscale
sudo tailscale login# Browser opens → sign in with Google/Apple/GitHub# Grab your Tailscale IP:sudo tailscale status# Note the 100.x.x.x address
⚠️
On corporate VPN? Disconnect it first. Most corporate VPNs override all network routing and will block Tailscale's tunnel.
On iPhone: App Store → download Tailscale → sign in with the same account. Done.
Enable SSH on Mac
System Settings → General → Sharing → Remote Login → ON
Verify
ssh localhost
# Password prompt → logs in → you're good
Termius on iPhone
App Store → download Termius → add a new host:
• Hostname: your Tailscale IP (100.x.x.x)
• Username: the output of whoami on your Mac
• Password: your Mac login password
Tap connect — you're inside your Mac's terminal from your phone.
tmux — persistent sessions
Install + Alias
brew install tmux
# Set up the shortcut (run once):echo"alias cc='tmux attach -t claude || tmux new -s claude'" >> ~/.zshrc && source ~/.zshrc
Now cc = instant Claude Code session. Attaches if one exists, creates if it doesn't.
Keep Mac awake
System Settings → Battery → Options → "Prevent automatic sleeping on power adapter" → ON
Or via terminal
sudo pmset-c sleep 0 disksleep 0 displaysleep 5
If your Mac sleeps, SSH connections drop and tmux becomes unreachable. Keep it plugged in.
Daily Usage
Once set up, this is your workflow from any device, anywhere:
🛋️
Couch, phone only
Termius → cc
💻
At your desk
Terminal → cc
☕
Coffee shop
Termius → cc
🚆
Commute
Termius → cc
🏠
Different room, same house
Termius → cc
tmux Shortcuts
Ctrl+B, DDetach session
Ctrl+B, CNew window
Ctrl+B, NNext window
Ctrl+B, PPrevious window
Ctrl+B, WWindow picker
tmux lsList sessions
05 — Safety
Security Model
This setup has a smaller attack surface than most production deployments. Here's why.
What's NOT Happening
✕
Mac exposed to the internet
No open ports
✕
Unencrypted traffic
Double encrypted
✕
Bots scanning your machine
Invisible to internet
✕
Anyone can discover your Mac
Only your Tailscale devices
✕
Tailscale reads your traffic
End-to-end encrypted
Encryption Layers
Layer
Encryption
Auth
Track Record
Tailscale
WireGuard (ChaCha20-Poly1305)
Curve25519 keys
Formally verified
SSH
AES-256-GCM
Password / Ed25519
Since 1995
Attack Requirements
For an attacker to gain access, they would need all three simultaneously:
1. Compromise your Tailscale account (OAuth provider + 2FA)
2. Know your Tailscale IP (only visible to your own devices)
3. Crack your SSH credentials (Mac password or Ed25519 private key)
🛡️
This is more secure than direct SSH with port forwarding, which exposes port 22 to the public internet and attracts automated brute-force attacks. With Tailscale, your Mac has zero open ports. To the outside world, it doesn't exist.
06 — Troubleshooting
Common Issues
Solutions to the most frequent problems, in order of how often they come up.
Tailscale needs to be running on both devices. Open the Tailscale app on your iPhone and confirm it's connected. On your Mac, check the menu bar icon or run sudo tailscale status. If both show "online" but you still can't connect, try tailscale ping <your-mac-ip> from Termius. If the ping fails, both devices may be on networks that block WireGuard — Tailscale will fall back to relay, but it can take a few seconds.
Most likely your Mac fell asleep. Check your pmset settings — you want sleep 0 on the power adapter. Watch out for clamshell mode: a closed lid will trigger sleep unless an external display is connected or you're running caffeinate -s in the background. Pro tip: caffeinate -s & in your tmux session keeps the Mac awake as long as the session exists.
Your Mac restarted. tmux sessions live in RAM — they don't survive reboots. macOS can restart automatically for updates. Check System Settings → General → Software Update → Automatic Updates and disable "Install macOS updates" to prevent surprise reboots. Run cc again to start a fresh session.
The shell hasn't loaded your aliases. Run source ~/.zshrc and try again. If it's still missing, verify the alias exists: grep "alias cc" ~/.zshrc. If not, re-run the echo command from Step 4. Using bash instead of zsh? Use ~/.bashrc instead.
Your traffic is probably routing through Tailscale's DERP relay servers instead of a direct peer-to-peer connection. Run tailscale status and look for "relay" next to the other device. Direct connections are significantly faster. Try switching between WiFi and cellular on your phone to trigger a new connection attempt. If you're stuck on relay, consider Mosh (see Level Up section).
Some carriers block WireGuard's UDP traffic (port 41641). Tailscale should automatically fall back to DERP relay servers over HTTPS, but this can take a few seconds. If it never connects, force-close and reopen the Tailscale app on your phone.
On your Mac (the server) — yes. Tailscale and commercial VPNs coexist fine since they use separate network interfaces. Corporate VPNs (Cisco AnyConnect, GlobalProtect, Zscaler) can be trickier — they sometimes override all routing.
On your iPhone — no. iOS only allows one VPN tunnel at a time. Enabling a VPN will disconnect Tailscale.
Workaround: Run the VPN on your Mac instead. Your phone connects to your Mac via Tailscale, and your Mac's traffic goes through the VPN.
tmux doesn't enable mouse support by default. Add set -g mouse on to ~/.tmux.conf on your Mac, then reload with tmux source ~/.tmux.conf. Also add set -g history-limit 10000 for a decent scrollback buffer.
07 — Not on iPhone?
Platform Alternatives
This guide assumes iPhone + Mac, but the core idea works on any combination. Here's how to adapt it.
🤖
Android
Termux has a built-in SSH client — no extra app needed. Or use JuiceSSH for a polished UI. Install Tailscale from the Play Store. Same setup, different apps.
🪟
Windows (server)
Enable OpenSSH Server in Settings → Apps → Optional Features. Install Tailscale for Windows. Same IP, same SSH workflow. Use Windows Terminal with keep-alive settings instead of tmux.
🐧
Linux (server)
sudo systemctl enable sshd and install Tailscale via your package manager. tmux works natively. You probably already know all this.
📱
iPad
Termius works great on iPad. Pair with a Bluetooth keyboard for an even better experience. Some people add a Magic Trackpad and never look back.
💡
The core pattern is the same everywhere: Tailscale + SSH + tmux. Only the apps change. If your device can run an SSH client and Tailscale, it works.
08 — Level Up
Power User Configuration
The basics are working. These refinements improve security, reliability, and comfort.
SSH key authentication
security
Generate an Ed25519 key pair on your phone (ssh-keygen -t ed25519 in Termius or Termux), copy the public key to your Mac's ~/.ssh/authorized_keys, and disable password auth in /etc/ssh/sshd_config. No more typing passwords on a phone keyboard, and brute-force attacks become mathematically infeasible.
Tuned .tmux.conf
comfort
Add set -g mouse on for scroll support (essential on phone). Set setw -g mode-keys vi for vim-style navigation. Remap the prefix from Ctrl+B to Ctrl+A (easier to reach on mobile). Search "tmux sensible" on GitHub for a solid starting config.
Mosh for unstable connections
reliability
If you're frequently on flaky connections (cellular, train WiFi), Mosh handles network switches, high latency, and temporary disconnects gracefully. Install on Mac with brew install mosh, use Blink Shell on iPhone (it has built-in Mosh support). Your session won't die when you switch from WiFi to cellular.
Named tmux sessions
workflow
Run multiple projects simultaneously: tmux new -s work, tmux new -s personal, tmux new -s claude. Switch with tmux attach -t work. Create aliases for each: alias sw='tmux attach -t work || tmux new -s work'. List all sessions with tmux ls.
TL;DR
$0 setup, 15 minutes, works from anywhere with a signal
Double encrypted (WireGuard + SSH), zero open ports
One command (cc) on any device = Claude Code
Your Mac, your files, your environment — no cloud VM required
More secure than direct SSH port forwarding or a cloud VM with exposed ports