Mobile companion

Pairing, direct controls and optional remote desktop over your local network.

The Windows Mobile companion page enables phone pairing and manages access to the PC. Check the Android download section for public package availability before starting.

Requirements

You need a compatible Arsenal Companion Android client, Arsenal running on the Windows PC, and a private network where the phone can reach that PC.

Pair a phone

1. Open Mobile companion in the Windows sidebar.
2. Choose Allow network access and approve the Windows prompt. Existing rules may need Update network access.
3. Scan the PC’s QR code in the companion client, or use discovery or the displayed manual address and six-digit code.
4. Pair before the code expires. It lasts five minutes or one successful use; Generate a new code replaces it.

The QR contains the PC address, pairing code and certificate fingerprint. It is not a link to install the Android app.

Controls exposed by Windows

The Windows bridge exposes telemetry and supported performance, GPU, display, battery, lighting, peripheral, automation and settings actions. Available controls depend on the PC and client. Some operations require confirmation, administrator access or a Windows restart.

Remote control

Current Windows and Android builds also have a separate remote desktop mode. In Mobile Companion → Remote control, turn on Allow remote control if a paired phone should see the PC screen. A request normally prompts on the PC and expires if nobody answers. You can grant view-only access, or turn off Keyboard and mouse so every session is view only.

Stable Windows app Remote control settings with sample choices. Remote access requires a compatible paired Android client.

Start without asking permits any paired phone to begin a session without a prompt on the PC. Leave it off unless you need unattended access. Sound, text clipboard, file transfer and locking the PC when a session ends each have their own switch. The Windows page can end all sessions and clear phones previously told not to ask again.

The phone can choose a monitor and a quality preset. Remote screen, input and file traffic stays on the direct paired connection; Arsenal does not relay it through a hosted service. This feature depends on a compatible Android client. Check the Android package status before relying on it.

Battery report on your phone

The Android client can ask Windows to read its battery report and show health, capacity, cycles, estimated runtime and capacity history on the phone. The PC remains responsible for generating the Windows report. See Battery report for the Windows view.

Connection security

The connection uses HTTPS with TLS 1.2/1.3, the paired PC’s certificate identity and per-device credentials. The firewall rules are scoped to Arsenal and private-network access. No Arsenal account or cloud relay is needed.

From Arsenal 1.1.8 the bridge answers only a device on a network this PC is also on, rather than relying on the firewall profile alone — a network someone has marked private, such as a hotel or a cafe, no longer puts the bridge within reach. The test is whether the caller shares a network with one of this machine’s own interfaces, so a phone on the same IPv6 network still connects normally.

The bridge also holds at most 32 connections at a time and gives each ten seconds to make its request, so nothing can occupy it without presenting a credential. Device credentials are wrapped to your Windows account rather than stored in readable form. See Security and privacy.

Manage paired devices

Connected devices lists paired phones and their status. Use Revoke for one phone or Revoke all devices to remove paired access. Revoked clients need to pair again.

Keep the PC available

The bridge starts after network access is allowed. Keep Arsenal running and the PC reachable; quitting the Windows app stops the bridge.

If pairing fails

• Check that the phone can reach the current address shown on the desktop.
• Guest Wi-Fi and client isolation can block discovery or the connection.
• Generate a new code if the old one expired.
• Use the network-access button to set up the private-profile rules. HTTPS uses TCP and discovery uses UDP on port 51117.
• If the PC’s certificate identity changed, verify the PC and pair again.