Is it safe to have VNC port 5900 open to the internet?

No. VNC gives full control of a computer's screen, keyboard and mouse. Exposed VNC servers are scanned for constantly, some have no password at all, and classic VNC passwords are limited to 8 characters. Put VNC behind a VPN or SSH tunnel, or use a remote-access service that doesn't need an open port.

How can I tell if my VNC server has no password?

Run nmap -p 5900 --script vnc-info your-server from outside your network. If the security types listed include 'None', anyone can connect without a password.

How do I use VNC remotely without opening port 5900?

Connect over a VPN first, or use an SSH tunnel such as ssh -L 5901:localhost:5900 user@server and point your VNC viewer at localhost:5901. Some VNC products also offer cloud-brokered connections that need no open port.

High risk Port 5900 · VNC remote desktop

VNC port 5900 is open: what it means and how to fix it

By Stephane Meus, CEH, PenTest+ · Updated 11 October 2026 · 5 minute read

Short answer: port 5900 is VNC, a way to see and control a computer's screen from somewhere else. Open to the internet, it lets anyone try to take over that screen. Some VNC servers ask for no password at all, and classic VNC passwords can only be 8 characters long.

The fix: close port 5900 to the internet. For remote access, connect through a VPN or SSH tunnel, or use a remote-access service that doesn't need an open port.

What is port 5900?

VNC (Virtual Network Computing) shares a computer's desktop over the network, so you can see the screen and use its keyboard and mouse remotely. It works on Windows, Mac, Linux and Raspberry Pi, and it's built into many other devices. Port 5900 is the first VNC screen. A second screen on the same machine uses 5901, a third 5902, and so on.

Where it usually comes from:

VNC software such as RealVNC, TightVNC, UltraVNC or TigerVNC, installed so someone could work from home or provide support.
Mac Screen Sharing, which uses VNC on port 5900.
Raspberry Pi and other small computers with VNC turned on for remote setup.
Equipment screens, such as control panels for building systems, manufacturing machines and point-of-sale terminals, often set up by an installer.

Why an open port 5900 is high risk

It's full control. Whoever gets in sees everything on screen and can type, click, open files and install software as the logged-in user.
Some servers have no password. VNC can be set to allow connections with no login at all. Security researchers regularly find thousands of these exposed online, including control screens for industrial equipment.
Short passwords. Classic VNC authentication only uses the first 8 characters of the password, which makes guessing much easier than with a normal login.
Often unencrypted. Many VNC setups send the screen and keystrokes without strong encryption.
Software flaws. In 2019, Kaspersky reported 37 vulnerabilities across four popular open-source VNC projects, some allowing remote code execution. TightVNC 1.x was never patched, because it's no longer supported.

How it looks in your report your-office-ip

5900 VNC Often unauthenticated or weakly authenticated remote desktop High

Any High finding caps your exposure grade at D

How to confirm it, and whether it has a password

Check from outside your network. A free FreshScanSentry Basic Scan of your public IP address shows whether port 5900 answers.
Or use Nmap from another connection, such as a phone hotspot, and include the next few VNC ports:
```
nmap -p 5900-5910 -sV --script vnc-info your-public-ip
```
vnc-info lists the security types the server accepts. If it shows None, anyone can connect without a password. Treat that as an emergency and close the port now.
Find the computer. In your router, look for a port forward for 5900 (or 5800, VNC's old web viewer) and note the inside IP address it points to, or check whether a device is in the DMZ.

Only scan addresses you own or have written permission to test.

How to fix it

1. Close the port to the internet

Delete the router's port forward for 5900 (and any 5901+ or 5800), and turn off DMZ mode if it's on.
In the cloud, remove any inbound rule allowing 5900 from 0.0.0.0/0 or "Any".

2. Give remote users a safer way in

VPN: connect to the office VPN first, then use VNC as normal on the inside network.
SSH tunnel (for Linux, Mac or Raspberry Pi with SSH turned on):
```
ssh -L 5901:localhost:5900 you@your-server
```
Then point your VNC viewer at localhost:5901 on your own computer.
Cloud-brokered remote access: some VNC products, and most remote-support tools, can connect through the vendor's service, so no inbound port needs to be open. Turn on multi-factor authentication for the account.

3. Lock down the VNC server

Require authentication and never allow "no password" or "None" security.
Use your computer's normal login if the software supports it (some VNC products call this "system authentication") instead of a separate 8-character VNC password.
Turn on encryption if the product offers it, and update to the latest version. Replace TightVNC 1.x and other unsupported versions.
Listen on the local network only. Many VNC servers have a setting to accept connections only from your own network, or only from localhost when you use an SSH tunnel.

4. If you don't use it, turn it off

Mac: System Settings → General → Sharing, then turn off Screen Sharing (and Remote Management if you don't use it).
Raspberry Pi: run sudo raspi-config, go to Interface Options → VNC and disable it.
Windows: uninstall the VNC program from Settings → Apps if no one needs it.
Equipment screens: ask the installer or vendor to remove internet exposure and provide remote support through a VPN instead.

5. Re-scan to confirm

Run another external scan. Port 5900 should no longer appear, and your exposure grade should go up.

If you think someone already got in

Signs include the mouse moving on its own, programs opening by themselves, new software you didn't install, or changed settings and passwords. Disconnect the computer from the network, change passwords from a different, clean device, and have the machine checked by an IT professional before reconnecting it.

Common questions

Is VNC the same as Windows Remote Desktop?

They do the same job, but they're different protocols. Windows Remote Desktop uses port 3389 and has its own guide: Port 3389 (RDP) open. The advice is the same, though: keep remote desktop off the open internet.

We set a strong VNC password. Is that enough?

It helps, but classic VNC only uses the first 8 characters, and a password doesn't protect against flaws in the VNC software itself. A VPN or tunnel removes the exposure entirely.

An installer set this up for remote support.

Ask them to switch to a VPN or a remote-support tool with multi-factor login. Most can do this, and it protects them as well as you.

Sources: RFC 6143 (the VNC protocol) · Kaspersky: 37 vulnerabilities in open-source VNC systems · Nmap vnc-info · Apple: turn Screen Sharing on or off