The reMarkable 2 has no multi-user support. One device, one set of notebooks, one cloud account. Share it with a partner or a child and you share everything.
This adds switchable user profiles — separate notebooks, separate PIN, separate cloud account on a single tablet. One profile can keep reMarkable cloud sync while another stays local-only. Switching takes about three seconds.
No Toltec, no launcher, no custom firmware. A small POSIX-shell switch engine installed over SSH, which means nothing to re-flash and nothing to maintain against an alternative package ecosystem.
This is convenience and basic privacy, not security. Anyone with USB or SSH access can read every profile — as on any rooted reMarkable. Don't rely on it to protect data.
A profile is two directories — xochitl/ (documents) and config/ (settings, PIN, cloud
token). A single active symlink pivots which the tablet uses. Switching = stop xochitl →
repoint active → start xochitl (~3-5s). After a switch, xochitl's own lock screen uses
that profile's native PIN, so per-profile locking is automatic.
Selecting a profile depends on your OS version:
- Handoff switching (shipped, works on all current OS). Trigger a switch when you hand
the tablet over — a phone shortcut or an SSH one-liner (
rm-switch). Each person then unlocks with their own native PIN. This is what runs on reMarkable OS newer than ~3.3. - Auto-by-PIN pad (OS ≤ 3.3 only). A custom boot PIN pad that maps the entered PIN to a
profile automatically. It draws through
rm2fb, whose support tops out at OS 3.3.2.1666, so it does not work on newer builds (see Status). Code lives inpad/.
Deployed in the handoff model on a reMarkable 2 running OS 3.27.3.0 (2026-07-20). Two profiles, switched by an iPhone shortcut / SSH.
The auto-by-PIN pad is blocked on OS > 3.3: rm2fb patches xochitl at per-version
memory offsets and has no entries beyond 3.3.2.1666, and the rM2's packed framebuffer can't
be driven directly without it. The pad remains in-repo for OS ≤ 3.3 and as a future path if
framebuffer access is solved for newer builds.
See docs/INSTALL.md. In short, from a Mac with the tablet on SSH:
ssh root@10.11.99.1 'mkdir -p /home/root/profiles /home/root/remarkable-profiles'
scp bin/rm-profile root@10.11.99.1:/home/root/profiles/rm-profile # deploy engine
scp -r bin scripts root@10.11.99.1:/home/root/remarkable-profiles/ # + migrate script
ssh root@10.11.99.1 'chmod +x /home/root/profiles/rm-profile'
ssh root@10.11.99.1 'sh /home/root/remarkable-profiles/scripts/rm-profile-migrate --dry-run user1 user2'
ssh root@10.11.99.1 'sh /home/root/remarkable-profiles/scripts/rm-profile-migrate user1 user2'
The migrate script moves your current data into the first profile and creates a
local-only second profile with cloud tokens and passcode stripped. User 1 keeps the
cloud-synced library and User 2 gets an empty local one. Profile names default to user1
and user2 if you leave them off. If you pick your own, use lowercase letters, digits,
_ and -.
Back up first (the script also backs up; copy it off-device).
scripts/rm-switch user2 # switch, over USB (default host)
RM_HOST=192.168.1.50 scripts/rm-switch user1 # over wifi
Or an iOS Shortcut running /home/root/profiles/rm-profile switch <name> over SSH — see
docs/INSTALL.md.
Switching over wifi needs SSH over wifi turned on first. Newer reMarkable OS only
listens for SSH on USB, so docs/INSTALL.md covers enabling it in every profile. It also
covers bin/rm-ssh-forced, a forced command that limits the wifi-exposed key to
rm-profile switch <name>. It accepts any existing profile with a safe name, so there is
no list of names to edit.
Installs made with older default profile names keep working. Updating the scripts leaves
your profiles under their current names. Renaming them to user1 and user2 is optional. docs/INSTALL.md has the
commands under Existing installs.
bin/rm-profile switch engine (list/status/switch/create/set-pin)
bin/rm-ssh-forced forced command that limits a wifi SSH key to switching
scripts/rm-profile-migrate engine-only install (shipped model)
scripts/rm-switch Mac/phone-side switch trigger
scripts/rm-profile-setup full install incl. PIN pad (OS <= 3.3)
scripts/reapply.sh post-OTA reapply (pad model)
pad/ Rust PIN pad — core logic (host-tested) + ARMv7 binary
systemd/ boot gate unit (pad model)
tests/ bats suite
docs/INSTALL.md on-device runbook
cd pad && cargo test -p rmprofile-core # core logic (12 tests)
bats tests/ # engine, forced command, hash (28 tests)
shellcheck -s sh bin/* scripts/* # lint
reMarkable 2 only. Not reMarkable 1, not the Paper Pro family.
Tested on reMarkable OS 3.27.3.0. The switch engine touches only xochitl/ and
config/ plus a symlink, so it should survive OS updates — but an update can reset
SSH access, and you will need to re-run the install if the rootfs is replaced.
Can two people share one reMarkable? Not natively. That is what this fixes.
Does each profile get its own cloud account? Yes — each profile carries its own
config/, which holds the cloud token. One can sync, another can stay offline.
Does it survive an OS update? The profile data does. The install may need re-running if the update replaces the rootfs or resets SSH.
Is my data protected from the other user? No. See the warning at the top — anyone with USB or SSH access reads everything. This separates workspaces, it does not secure them.
Does this void the warranty or brick anything? It needs SSH access, which reMarkable provides officially. It writes no firmware and patches no binaries in the shipped model.
MIT — see LICENSE.