When ESPHome merged its vnc component on 22 October, the first version had two clear gaps: it was view-only, and it could only connect to VNC servers with no password. Both are now closed in the development branch. Petar Petrov's pull request adding input actions and touchscreen forwarding was merged on 26 October 2026 (23:48 Polish time), and his password authentication pull request followed on 28 October at 05:14. Neither pull request names a release, but the earlier VNC work is expected in ESPHome 2026.11.
Taps and drags reach the remote screen
The new optional touchscreen_id option links the VNC client to a touchscreen already defined in the configuration. Touches are sent to the VNC server as left-button clicks and drags. An 8-pixel slop keeps a short tap from turning into a text selection in the browser.
For two seconds after any input, the client draws every change as soon as it arrives instead of waiting for the picture to settle. Normally the component waits for the screen to stop changing, which saves e-paper refreshes; after a tap, quick feedback matters more. OHF Daily described the result on 27 October as touchscreens that "control a remote browser dashboard".
Three automation actions arrive with it. vnc.send_pointer moves the pointer and can press buttons, including the scroll wheel. vnc.send_key sends named keys such as Return or Page_Down, which ESPHome resolves to X11 keysyms at build time, so the device carries no lookup table. vnc.type_text types text and handles UTF-8. A physical button wired to a GPIO can therefore scroll the dashboard or switch tabs.
Passwords, carefully
The second pull request adds a password option. VNC authentication uses DES, so the author wrote a small encrypt-only DES implementation of about 1.2 KB of flash, compiled only when a password is set. The key is prepared at build time and stored in flash.
The retry logic is cautious on purpose. TightVNC locks out every user after five failed logins, so after a wrong password the client stops and sets an error status instead of hammering the server. If the server drops the connection without answering, the client waits 60 seconds, tries once more and then stops as well. New vnc.connect and vnc.disconnect actions let an automation reconnect after the password is fixed, or close the session before deep sleep.
What still applies
A password protects the server from casual access, but it does not encrypt the picture or the input. The original documentation warns that VNC traffic is unencrypted and belongs on a trusted network, and that advice now covers the keystrokes too. The password documentation has been merged; the documentation for input actions was still an open pull request on 28 October.