# Devices

> Put a phone or laptop behind your account's encrypted DNS with a resolve-only credential, an identity of its own, and a readable lookup history.

*Source: https://www.whisper.security/docs/network/devices*

---
A device does not need an agent, a tunnel or software from Whisper to sit behind your
resolver. It needs one resolve-only credential, which answers its name lookups under your
account's policy and can do nothing else to the account.

```bash
whisper device add --label "work-laptop"
```

That one call mints the credential and prints everything the machine needs: the encrypted
DNS URL, a one-tap profile link for Apple platforms, the Private DNS host for Android, and
the device's own routable address. The token is shown once.

The steps differ between platforms, so they have a page of their own:
[Set Up a Device](/docs/network/devices/setup) covers Apple, Android, Windows and Linux,
along with the lookup history page and how to take a device back off.

Two things are worth knowing before you start. The credential is resolve-only by
construction, so it can never register, read or change anything on your account, which is
what makes it safe to install on a family member's phone. And the device still gets a
routable identity with a reverse record and a registry entry, so it is checkable by anyone
in the same way an agent is; that identity is described in
[Device Identities](/docs/identity/devices).

Policy is set for the account, not per device, so what a device may resolve is whatever
[Resolver Policy](/docs/network/resolver/policy) says.