From https://www.cl.cam.ac.uk/research/dtg/attarchive/vnc/sshvnc.html
Now, the VNC protocol normally uses port 59xx, where xx is the display number of the server. So a VNC server on a Windows machine, which normally uses display number 0, will listen on port 5900. Most Unix VNC servers will probably use display numbers 1,2, etc and so will be listening on ports 5901, 5902 and so forth. If you forward these ports to a remote machine, you can make the remote VNC server appear to be a server running on your local machine.
So, imagine you had a VNC server running as display :1 on machine snoopy, and you wanted a secure connection to it from your local machine. You could start the ssh session using:
ssh -L 5902:localhost:5901 snoopy
and any references to display :2 on your local machine would actually connect to display :1 on snoopy.
Note that the above SSH command-line is deliberately meant to accept incoming connections only from the local machine. This means that to use the SSH connection that we have just set up, we must connect to it from the same machine, using the special name 'localhost', rather than using the machine's own unique name.
So instead of running a vncviewer:
vncviewer snoopy:1
you could run:
vncviewer localhost:2
and you get the same effect, but with a secure connection.
Its probably a good idea to still use a VNC password unless you are sure no unauthorised people can access the target machine from within its local network.