How PhonePad works

Short version: your phone sends 40 bytes of controller state to your PC up to 250 times a second, and the PC hands it to Windows as a real Xbox pad.

The path

Touch  ->  TouchRouter  ->  ControllerState  ->  UDP (40 bytes)
                                                      |
                                                   Wi-Fi
                                                      v
                              pp-core  ->  verify  ->  ViGEmBus  ->  XInput

UDP, not TCP, and deliberately. A controller wants the latest input, not every input. TCP would retransmit a stale packet and stall everything behind it; PhonePad sends on change plus an unconditional repeat, so a lost packet is corrected a few milliseconds later by the next one. About 10 KB/s at full rate.

Pairing and security

Pairing is an X25519 exchange authenticated by the six-digit code shown on the PC. The long-term token it produces is never transmitted. Every packet after that carries a truncated HMAC-SHA256 tag and passes through a 64-slot replay window, so nothing else on your network can inject controller input, and a captured burst cannot be replayed.

Nothing leaves your network. No account, no server, no telemetry. The full threat model — including what it does not defend against — is in SECURITY.md.

Failsafes

If packets stop arriving, every control snaps back to neutral after 120 ms, and the session is dropped after 2 seconds. Killing the app mid-button-press released it in 131 ms on real hardware. A held trigger cannot outlive its connection.

Tuning the sticks

Per stick, in the layout editor:

Setting	What it does
Deadzone	Movement ignored as digitiser noise. Small by design — a touchscreen has no slop to hide.
Anti-deadzone	Cancels the deadzone the game applies. Raise it if a game feels numb near centre; lower it if it feels twitchy.
Saturation	How far out full deflection is reached. Below 1.0 means full lock without your thumb having to land exactly on the ring.
Response curve	Above 1.0 gives finer control near centre at the cost of coarser control far out. Racing wants more; aiming wants less.
Sensitivity	A straight multiplier on the output.
Floating	The stick centres wherever your thumb lands rather than at the drawn circle. On by default, and the reason the response is repeatable between grabs.
Drift	Past the ring, the origin follows your thumb, so easing off full lock registers immediately.

Layouts

A layout stores a separate arrangement for landscape and portrait and switches when you rotate. Positions are fractions of the screen and sizes are fractions of its shorter edge, which is what makes one layout correct on more than one phone.

Layouts can be exported and shared. The format is specified in LAYOUT_FORMAT.md, and the rule it is built around is that a layout is data, never code — importing one changes how your controller looks and responds, and can do nothing else.

The numbers

Every figure quoted on this site is measured, and the method is written down beside it in benchmarks.md, including what has not been measured. The architecture decisions, and why ViGEmBus was chosen over the alternatives, are in the ADR.