# Browser quickstart

Go from a signed-in account to a private terminal or desktop without installing a remote-access client.

## 1. Sign in

Open [Security.Run](/) and choose **Sign in**. Continue with GitHub, or create an account with email and password. For email signup, follow the confirmation link before launching. **Forgot password?** starts the password-reset flow.

Your sessions and credits belong to the signed-in account. Use that same account when opening a saved session link.

## 2. Add credits

Open [Credits](/billing/). Choose **Activate free trial** to verify a card with Stripe and receive 200 credits. Card verification does not charge you or enroll you in automatic payments. Each account/card can claim the trial once.

You can also buy 1,000, 2,500, 5,000, or 10,000 credits. After Stripe confirms your purchase, the balance updates. If confirmation is still pending, you may leave and return to Credits; do not repeat a purchase just because a redirect is slow.

## 3. Launch a system

1. Return to the [OS gallery](/).
2. Filter by Linux or Windows, or press **Cmd+K** / **Ctrl+K** to focus the system search.
3. Choose the session length and transfer budget. Trial accounts can use up to 30 minutes; funded accounts can use up to four hours.
4. Choose a basic Linux terminal, a Windows desktop, or a preconfigured security desktop: Parrot, SIFT, REMnux or FLARE-VM. The [catalog reference](/docs/#available-systems) lists all 16 systems.

The startup screen shows progress while your fresh VM is prepared. The terminal or desktop appears automatically when the browser connection has received its first screen. Startup time varies by operating system and capacity; `ready` in the API may precede the first browser frame. Allow several minutes for FLARE-VM’s Windows configuration on a new VM. Its session lifetime includes startup, so use the default 30-minute session or longer.

## Work in the session

Click inside the terminal or desktop to send keyboard input to the VM. The browser's security restrictions can reserve some operating-system shortcuts, so not every system-level shortcut can be forwarded.

| Action | How it works |
| --- | --- |
| Copy or paste on macOS | Use Cmd+C / Cmd+V while the VM is focused. |
| Copy or paste in a Linux terminal on Windows/Linux | Use Ctrl+Shift+C / Ctrl+Shift+V. Ctrl+C remains the terminal interrupt. |
| Copy or paste in a desktop | Use the normal Ctrl+C / Ctrl+V shortcuts; macOS Command shortcuts are mapped for the remote desktop. |
| Copy or paste in a terminal app inside a Linux desktop | Use Ctrl+Shift+C / Ctrl+Shift+V, or Cmd+Shift+C / Cmd+Shift+V on macOS. |
| Clipboard fallback | Open **Clipboard**, enter shared text, and choose **Paste into VM**. Use **Copy to my computer** for remote text. |
| Expand the session | Choose the expand icon to fill the browser window. It does not put your computer into native full-screen mode. |
| Resize the session | Resize the browser or open/close a side panel. The remote resolution follows the available space. |
| Reconnect | Use the reconnect control if the browser connection drops. Reconnection uses the existing VM if it has not expired. |

Browser clipboard permissions can affect automatic copy/paste. Clipboard text is accessed when you copy or paste, not merely because the page receives focus. Terminal paste inserts text; review multiline commands before pasting them.

## Upload and download files

Open **Files** or drag a file onto the workspace to upload it. The browser transfer limit is **100 MiB per file**.

- **Linux:** files transfer over SFTP into the session user’s home directory (`/home/runner`, `/home/sansforensics` for SIFT, or `/home/remnux` for REMnux).
- **Windows:** open the **SecurityRun** redirected drive in File Explorer to find transferred files.
- **Download:** choose a remote file in Files, wait for transfer completion, then select **Save** to save it to your computer.

Downloads are saved as files rather than opened as active content in the page. Files on the VM disappear when the session ends. Windows redirected-drive files also disappear after cleanup and may be lost if the browser gateway is replaced. Keep your own downloaded copy of anything important.

For larger files, use [native SSH/SFTP or RDP](/docs/cli/#connect-with-ssh-or-rdp) from an approved network.

## Connection details and saved links

**Connection details** shows the IP, port, protocol, and native credentials. **My sessions** lists your sessions; you can reopen an active one there.

A session URL is not a public sharing link. The browser checks that the signed-in account owns the session. Native SSH/RDP credentials are separate from browser authentication and work only from a network permitted by the deployment.

## End the session

Choose **Destroy session** when finished. Wait for the destroyed state before treating cleanup as complete. Compute billing stops at confirmed termination. Final outbound-data measurements can take several minutes to arrive; only measured usage is deducted.

Closing the page does not stop the VM. If you forget to destroy it, it still expires at the session deadline. Open **Credits** to review the session's usage and remaining balance.

## Sizes and idle cleanup

Linux launches use Small (2 vCPU, 2 GiB RAM, 10 credits/hour) by default. Use the Linux size selector above the gallery to choose Standard (4 GiB, 40 credits/hour). Windows remains 4 GiB at 15 credits/hour.

Browser-launched sessions end after 15 minutes without keyboard, mouse, or file-panel activity. A warning appears during the final two minutes. Select **Continue session** to reset the idle timer, or enable **Keep running without activity** for an unattended job or native SSH/RDP use. Your chosen session expiry and credit limits still apply. Closing the browser does not immediately destroy the VM, but the backend still enforces the idle deadline. Save files before the session ends. Existing and CLI/SDK-launched sessions retain their selected lifetime unless idle cleanup is explicitly enabled.


## Security desktops

Search for Parrot, SIFT, REMnux or FLARE-VM in the gallery. These images open a full desktop and include their analysis tools before you launch. Linux security desktops require Standard size (4 GiB); the basic Linux size selector does not reduce their memory.

Parrot, SIFT and REMnux also expose key-only SSH. Open **Connection details** for the SSH key, desktop password and IP. FLARE-VM runs on Windows Server 2022 and has Microsoft Defender disabled as required by its analysis tools. Npcap and the Windows Nmap bundle are not included. Use Wireshark for saved captures and ProcDot for Procmon graphs. Live packet capture and ProcDot’s WinDump integration are unavailable. These are disposable analysis systems with the same network access rules as other sessions; they are not an offline malware containment lab.