Home Assistant remote access, done safely
Updated
You can reach Home Assistant from anywhere with a paid cloud link, a VPN or a tunnel. Here is how each works, what it costs and why simply opening a port on your router is the option to avoid.
As an Amazon Associate we earn from qualifying purchases. Links to Amazon on this page are affiliate links: buying through them costs you nothing extra.
Why remote access needs care
Home Assistant can unlock doors, open garage doors, turn off alarms and show cameras. Anyone who reaches the login page can try passwords against it, and anyone who finds a flaw in an out-of-date version can try to exploit it. Home Assistant’s securing checklist says to use a secure remote access method rather than exposing the system directly to the internet. The FTC gives the same basics for any connected device: unique passwords, regular updates and two-factor authentication.
Also decide whether you need remote access at all. Automations run at home whether you are there or not. If you only want to know when something happens, a push notification may be all you need.
The options compared
| Option | How it works | Cost | Risk and limits |
|---|---|---|---|
| Home Assistant Cloud (Nabu Casa) | Secure link from outside, no router changes; also off-site backup and Alexa or Google Home links | $6.50 a month or $65 a year; 31-day trial | Subscription; Home Assistant calls it the easiest and safest option for most people |
| VPN into your home network | You connect a VPN first, then open Home Assistant as if at home; the documentation names Tailscale and ZeroTier One as examples | Some services have free tiers; check each provider’s current terms | The VPN must be on before the app connects, or sensors from the phone will not update |
| Router with a built-in VPN server | Same idea, run by your router | Router cost, often $80–$250 | Setup is harder; your router must support it |
| Port forwarding | Forward a router port to Home Assistant’s port (8123 by default), often with a dynamic DNS name | Free to low cost for a dynamic DNS name | The documentation warns that “just putting a port up is not secure”; CG-NAT can block it; avoid unless you know what you are doing |
| Reverse proxy | A web server in front of Home Assistant that handles encryption | Free | Home Assistant must be set to trust the proxy; another thing to keep patched |
Option 1: The paid cloud link
The cloud link is the least work. It opens a secure connection from your Home Assistant to the service, so you do not touch your router. It also stores one off-site backup of up to 5 GB, and links your system to Alexa and Google Home. The service is planned to be renamed Home Assistant Link on December 2, 2026. Because the subscription funds the project, it also supports Home Assistant itself. Check current prices on the provider’s page before subscribing.
Option 2: A VPN
With a VPN, your phone joins your home network over an encrypted connection, so nothing about Home Assistant is visible to the public internet. The trade-off is convenience: the VPN has to be connected before the Home Assistant app can reach your system, and the documentation notes that without it, mobile app sensors will not update. Many routers can also run a VPN server; this keeps the setup in one place, but follow the router maker’s steps and keep its firmware current. See how to put smart devices on a separate network if you want to keep devices away from your phones and computers.
Option 3: Port forwarding, and why to avoid it
Port forwarding sends traffic from the internet straight to your Home Assistant. The documentation lists the practical problems: dynamic IP addresses change, so you need a dynamic DNS service; carrier-grade NAT (CG-NAT) at some providers blocks inbound connections entirely; and the system is exposed to automated attacks. If you decide to do it anyway, follow the securing checklist first, use HTTPS, enable two-factor sign-in and plan to update every month. Putting Home Assistant behind a reverse proxy adds encryption but not safety on its own.
Lock down the login: two-factor authentication
Home Assistant supports time-based one-time passwords. Once enabled, it asks for the latest six-digit code from your phone’s authenticator app at every sign-in.
- Install an authenticator app on your phone.
- Open your profile in Home Assistant, go to the Security page and, under multi-factor authentication, choose Enable.
- Scan the QR code, then enter the six-digit code to confirm.
- Save the backup information the app gives you, so losing your phone does not lock you out.
The codes depend on time, so if sign-ins fail, check that the Home Assistant clock is correct.
Checklist before you go remote
- Strong, unique password for every account, plus two-factor sign-in.
- Latest monthly release installed; the securing checklist asks you to keep up with every monthly release.
- A recent backup stored away from the Home Assistant computer. Backups are encrypted, so also keep the emergency kit; see our Home Assistant overview for the backup steps.
- Your
secretsfile backed up. Storing passwords there does not encrypt them. - No guest or unused accounts left active.
- A UPS on the router and server, if you rely on remote access while away.
If the goal is to avoid the cloud entirely, read Smart home without internet for what still works offline.
Shop by need
Prefers a VPN run by the router
What to look for: router with a built-in VPN server, regular firmware updates, support for a modern VPN protocol
Typical price: $80–$250
See options on AmazonNeeds backups stored away from the server
What to look for: external SSD or network storage, 500 GB or more, USB 3 for fast copies
Typical price: $40–$120
See options on AmazonRelies on remote access while traveling
What to look for: UPS with enough runtime for the router and the Home Assistant computer, USB management port
Typical price: $40–$150
See options on AmazonFrequently asked questions
Is it safe to open a port for Home Assistant?
It is the riskiest option. Home Assistant’s documentation warns that simply putting a port up is not secure. Use the paid cloud link or a VPN instead, or follow the securing checklist if you must expose it.
Do I need Home Assistant Cloud for remote access?
No. A VPN gives you remote access without a subscription. The cloud service is the easiest route and is listed at $6.50 a month or $65 a year, with a 31-day trial.
Why does the Home Assistant app not update sensors when I am away?
With a VPN setup, the VPN must be connected before the app can reach Home Assistant. Without it, mobile app sensors will not update, according to the documentation.
What is CG-NAT and why does it block remote access?
Some internet providers share one public address between many customers. You then cannot receive inbound connections, so port forwarding fails. A VPN service or the cloud link still works.