Headless Raspberry Pi: SSH, VNC or RDP?

You flashed a Pi, tucked it behind the TV with no monitor or keyboard, and now you need to reach it. You found a VNC tutorial, followed it to the letter — and it failed, because it told you to "enable RealVNC," which the current Raspberry Pi OS quietly removed. Meanwhile a dozen other guides cheerfully tell you to forward a port to the internet, which is how Pis end up in botnets.

Here's the version that's current and safe: which remote method fits which job, how to reach a Pi with zero peripherals, and how to connect from anywhere without opening a hole.

TL;DR

SSH for servers and quick fixes, VNC (wayvnc) or RDP (xrdp) when you need the actual desktop, Raspberry Pi Connect for zero-config access over the internet.
Raspberry Pi OS Bookworm switched to Wayland, so the old RealVNC server is gone — the built-in VNC is now wayvnc, enabled in `raspi-config`.
Set up a headless Pi entirely from Raspberry Pi Imager's advanced options (Ctrl+Shift+X): hostname, SSH, user, and Wi-Fi before first boot.
Never port-forward 22, 5900, or 3389 raw to the internet. Use SSH keys, an SSH tunnel, a VPN, or Pi Connect.
Use SSH keys, not passwords — it's the single biggest security win and takes two minutes.

Which method for which job

All three protocols reach the Pi, but they give you different things. Pick by what you actually need to do, not by which tutorial you found first:

Method	What you get	Best for	Default port	Safe to expose raw?
SSH	A terminal	Servers, quick fixes, automation, scripts	22	Keys only — still prefer a VPN
wayvnc (VNC)	The Pi's actual desktop (mirrors the screen)	GUI work on the real session	5900	No — tunnel or VPN
xrdp (RDP)	A separate desktop session, Windows-native client	Windows users, a private session	3389	No — tunnel or VPN
Raspberry Pi Connect	Screen and shell over the internet, no setup	Zero-config access through NAT	relay	Yes — official relay

The distinction that trips people up: wayvnc mirrors the physical screen (what a monitor plugged into the Pi would show), while xrdp gives you your own login session independent of the console. For a headless server you rarely want either — SSH is lighter, scriptable, and always the right first tool.

Tip

Most "I need VNC on my Pi" problems are actually "I need to run one command." Reach for SSH first; add a desktop protocol only when you genuinely need a GUI, like configuring a graphical app.

Headless first boot: reach it with zero peripherals

You don't need a monitor at all. Raspberry Pi Imager bakes the whole setup into the SD card before first boot. On the final screen, open the advanced options with Ctrl+Shift+X and set:

#Imager advanced options (Ctrl+Shift+X)
- Hostname:        pi-server.local
- Enable SSH:      use password OR paste your public key
- Username/pass:   set your own (there is no default 'pi' user anymore)
- Wireless LAN:    SSID + password + your country
- Locale:         timezone + keyboard

Flash, boot, and the Pi joins your Wi-Fi and answers SSH on its own — no screen ever attached. From another machine:

ssh [email protected]

Note

Modern Raspberry Pi OS removed the old default `pi`/`raspberry` login. If a guide tells you to `ssh pi@...`, it predates that change — use the username you set in Imager. This is the same "old guide, new OS" trap that breaks the RealVNC instructions below.

The VNC change everyone trips on

This is the one that wastes an afternoon. When Raspberry Pi OS moved to the Wayland display stack in Bookworm, the bundled RealVNC server was replaced by wayvnc, and the old `vncserver-x11-serviced` service no longer exists. Every tutorial that says "turn on RealVNC in raspi-config" is describing an OS that shipped years ago.

The current path is short. Enable it over SSH:

sudo raspi-config
#Interface Options -> VNC -> Yes  (this enables wayvnc)

Then connect with any VNC viewer (RealVNC Viewer or TigerVNC both work) to the Pi's address on port 5900. That's it — no account required for the built-in server, and it mirrors the Pi's real desktop.

Warning

wayvnc serves the desktop session — it needs the Pi booted to the graphical desktop, not to the console-only "Lite" target. If VNC connects but shows a black screen, the Pi almost certainly booted to CLI; set it to boot to desktop in `raspi-config`.

SSH the right way: keys, not passwords

A password-only SSH login on the internet is a slot machine for bots. Switch to key authentication once and you never type a password again — and brute-force attempts become pointless.

#on your computer: create a key if you don't have one, then copy it
ssh-keygen -t ed25519
ssh-copy-id [email protected]

#then on the Pi, turn off password login
sudo nano /etc/ssh/sshd_config
#set:  PasswordAuthentication no
sudo systemctl restart ssh

KEY-STAT: 3389 and 5900 — the RDP and VNC ports — among the most relentlessly scanned on the internet, which is exactly why you never forward them raw

Never expose it raw: the security part

Here is the rule that most guides skip and that actually matters: do not port-forward 22, 5900, or 3389 from your router to the Pi. An exposed RDP or VNC port is found by automated scanners within hours. You have three good ways to reach the Pi from outside your home instead:

Option 1 — the SSH tunnel. Reach VNC through an SSH connection you already trust. Nothing but SSH (key-protected) ever touches the internet:

#forward the Pi's VNC port over SSH, then point your viewer at localhost:5900
ssh -L 5900:localhost:5900 [email protected]

Option 2 — a VPN. Put the Pi behind WireGuard and your laptop or phone joins the home network as if it were local. This is the cleanest option for reaching several devices; our WireGuard vs OpenVPN comparison covers which to self-host and why WireGuard usually wins on a Pi.

Option 3 — Raspberry Pi Connect. The official free service relays both a screen share and a shell through Raspberry Pi's servers, so you get remote access with no port forwarding at all. It's the least-effort route for a single Pi you just want to reach from anywhere.

Warning

"It's only my Raspberry Pi, who'd bother" is exactly the assumption behind most compromised home devices. Scanners don't care what's behind the port — an open 3389 is an open 3389. Tunnel, VPN, or Pi Connect; never a raw forward.

The honest verdict

For a headless server — the whole point of a Pi tucked out of sight — SSH with keys is the answer 90% of the time: light, scriptable, and safe to build automation on. Add wayvnc or xrdp only when you truly need a graphical desktop, and reach either through an SSH tunnel or VPN rather than an exposed port. When you just want to poke a single Pi from your phone on the train, Raspberry Pi Connect is the zero-config path.

Get remote access right once and it becomes invisible infrastructure — the foundation every other project sits on. If you're building out from here, our homelab beginner's guide shows where remote access fits among the other decisions, and if a single Pi starts feeling cramped, a small mini PC home server runs the exact same SSH-first playbook with more headroom.

FAQ

How do I access a headless Raspberry Pi?

Bake it into the SD card: in Raspberry Pi Imager press Ctrl+Shift+X to set the hostname, enable SSH, create your user, and enter your Wi-Fi. After first boot the Pi joins the network and answers SSH with no monitor ever attached.

Does RealVNC still work on Raspberry Pi Bookworm?

The bundled RealVNC server does not — Bookworm switched to Wayland and replaced it with wayvnc. Enable VNC in raspi-config (Interface Options → VNC), which turns on wayvnc, then connect with a VNC viewer on port 5900. RealVNC Connect still works as a separate account-based option.

Is SSH or VNC better for a Raspberry Pi?

SSH for anything server-like — it's lighter, scriptable, and the right first tool. VNC (or RDP) when you specifically need the graphical desktop. Many people use SSH daily and only reach for VNC to configure a GUI app.

How do I access my Raspberry Pi over the internet safely?

Never port-forward SSH, VNC, or RDP raw. Use an SSH tunnel for VNC, put the Pi behind a WireGuard VPN, or use Raspberry Pi Connect, which relays access with no port forwarding at all. Always use SSH keys with password login disabled.

What port does Raspberry Pi VNC use?

wayvnc listens on port 5900 by default. Don't expose that port to the internet — reach it through an SSH tunnel (`ssh -L 5900:localhost:5900 …`) or a VPN instead.