See your Canaries from anywhere. Pay nobody.
Every other camera company sells this back to you monthly. It costs nothing, takes about ten minutes, and — done the way this page describes — puts nothing of yours on the public internet. There's a popular way to do it and a correct way to do it, and they aren't the same one, so this page blesses exactly one path instead of handing you a menu to pick wrongly from.
First: you may already be done
Three different things get called "remote access," and mixing them up is how most people end up doing something risky they never needed to do.
| What you want | What it needs | What it costs |
|---|---|---|
| To be told when something happens | Nothing coming in — the hub reaches out to you | Free, and already working. Alerts reach your phone from anywhere with no setup on this page. |
| To look at the hub yourself, from away | A way in. This page. | Free. Ten minutes, once. |
| Someone else's cloud holding your footage | — | Not sold here at any price. Footage never leaves your device — that's the whole product, not a tier. |
The one way in
Put your phone and your hub on the same private encrypted network — a WireGuard mesh, using Tailscale. Your phone talks to your hub directly through a tunnel that both ends dial out to create. Nothing at your house sits waiting for strangers, so a scan of your address finds exactly what it found before you started: nothing. The free personal tier covers far more devices than a home has.
-
Install it on the hub.
On Home Assistant OS: Settings → Add-ons → Add-on store → Tailscale → Install → Start. On a Raspberry Pi or Debian hub, two commands do it.
-
Install it on your phone, sign in with the same account.
That's the pairing. There's no certificate to buy, no DNS name to register, and nothing to change on your router.
-
Open the hub's address.
Use the address
tailscale ip -4printed on the hub. It works the same on hotel Wi-Fi as it does on your sofa. -
Turn off key expiry for the hub.
In the Tailscale admin console, open the hub's machine and disable key expiry. Skip this and the hub silently drops off the network months later — which you'll discover from a hotel, because that's when you look.
curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up
tailscale ip -4 # the address you'll use from away
For makers: if you'd rather not use a third party at all
Headscale — the same protocol with a coordination server you host yourself, so nobody outside your house sees even which of your devices are online. The cleanest option on principle; costs you one more service to keep patched.
Plain WireGuard on your router — no account anywhere. This does need one inbound UDP port, which sounds like it contradicts everything below, and the distinction matters: a WireGuard port does not answer an unauthenticated packet at all. To a scanner it looks closed. That is a different thing from a web server that greets every stranger with a login form.
Cloudflare Tunnel — only with Cloudflare Access policy in front of it. Without one you've simply published your login page with extra steps. Worth knowing even when it's set up right: Cloudflare terminates the encryption, so they can read the traffic.
⚠️ And the ways that go wrong
Every one of these is recommended somewhere on the internet, usually cheerfully. Each one ends with your home reachable by anyone who looks — and nothing tells you it happened.
| Don't | What actually happens |
|---|---|
| Forward port 8123 | Your hub's login form is now on the public internet. Scanners index it within hours — not eventually, hours — and automated password-guessing against it is continuous rather than occasional. |
| Add a certificate and a dynamic-DNS name to that | The most-recommended dangerous setup there is, and the padlock is the trap: encryption protects the conversation, not the door. You've made the chat between a stranger and your front door private. The door is just as open. |
| Leave UPnP switched on | You never chose a hole — a device chose one for you. UPnP lets anything on your network open an inbound port with no confirmation and no notification. This is why the checker below asks your router directly instead of trusting anyone's memory. |
| Forward the camera or message ports | That's live video and every event the hub knows about, usually with nothing asking for a password. |
| "Just for a week" | There's no such thing. Nobody ever comes back to close it. Setting up the safe path takes less time than the port forward did. |
Don't take our word for it — check
A guide is advice, and advice gets misremembered. Run this on the hub and get a verdict instead. It reads what's listening, asks your own router what it is actually forwarding, and looks for the encrypted network from step one.
FAIL — something here is reachable from the internet. Encrypted overlay : none found Router forwards : 1 active inbound mapping(s) Services watched : 2 listening on sensitive ports [FAIL] Your router forwards TCP port 8123 from the internet Inbound TCP/8123 is forwarded to 192.168.1.50:8123 (this hub). That port is Home Assistant — the hub UI and its login form. The mapping has no description, which usually means UPnP opened it automatically rather than a person choosing it. Fix: Delete this port forward in your router's admin page, and turn off UPnP so it cannot come back.
- 🔒It never contacts the internet. It reads the hub and asks your own gateway — that's all. Using an outside "am I exposed?" scanning service would mean telling a stranger your address and what runs behind it, which is the exact trade this project refuses everywhere else.
- 🙈It prints its own blind spot. It sees what your router admits to forwarding. It cannot see a hole punched further upstream — your provider's network, a second router, or a tunnel dialing out from inside. It says so rather than implying it checked.
- 🤖It exits 0 or 1, so you can run it monthly from a cron job and only hear from it when something changed.
Full instructions, both commands, and the reasoning behind every line above: docs/away_access.md.
So what would a subscription buy?
Worth being straight about, since it's probably why you're reading. Home Assistant's own cloud subscription is the honest comparison — it's the good one, run by the people who build Home Assistant.
| What a subscription sells | Do you need to pay for it? |
|---|---|
| Remote access to the hub | No. The path on this page is free and exposes less — there's no public address at all. |
| Push notifications | No. Already free, and they were never behind the paywall. |
| Voice transcription and speech | No. Both run on the hub itself now. |
| Alexa / Google Assistant | This one is real. Doing it yourself means a cloud developer account and — importantly — a publicly reachable address, which lands you right back in the table above. If you want voice assistants, paying is the sane choice. |
| Funding Home Assistant's development | Also real, and the best reason on this list. If you use it every day, it's cheap. |
Notice what isn't on that list: security. Money isn't what moves you between the safe setup and the dangerous one — the free path is either the safest option available or the worst, depending only on which one you follow. That's why this page exists, and why we'd rather hand you the instructions than the invoice.
Why we give this away
Reaching your own devices isn't a feature we're entitled to rent back to you. The project's stated line is that privacy is never paywalled; the hardware carries the margin instead.
Where the checker lives
tools/away_access_check.py in the securaCV repo, with its verdicts
pinned by tests in CI — including the rule that it refuses to fetch anything off your
own network, so the no-internet promise is enforced by code rather than by intention.
What we don't claim
No setup makes a system untouchable, and this page doesn't pretend otherwise. It removes the public door, which is the failure that actually happens to people. The checker names what it can't see.
Not a Home Assistant manual
We deliberately don't restate their documentation here — it would rot and we'd be the last to know. For anything Home Assistant-specific, theirs is the authority.