Your first connection, with a key, in five minutes

Add a host, generate a key that never leaves the phone's hardware, and stop typing passwords.

5 min read

Step by step

Add the host
On the home screen, tap Add host. Fill in the Connection block: a display name for you, the address that is actually dialled, the username, and the port if it is not 22.
Where: Add hostConnection
Generate a key on the phone
Open the key list and tap Generate key. Name it after the machine it is for. The key is created in your phone's secure hardware and never leaves it, so nobody can copy it, not even the app.
Where: SettingsHostsAll hostsKeysGenerate key
3
Put the public key on the server
Copy the public key from the key's actions and append it, as one line, to the authorized_keys file of the user you log in as.
```
$ echo 'ecdsa-sha2-nistp256 AAAA… phone' >> ~/.ssh/authorized_keys
```
Choose the key for the host
Back in the host editor, set Authentication to that key and save. Leave the password empty if you would rather be asked each time.
Where: HostAuthentication
Connect and read the host key
Tap the host. The first connection shows the server's fingerprint and asks whether to trust it. Compare it with the one on the server if you can — this is the one real security decision in the whole flow.

Turn on Biometric lock under Settings › Security and every use of a key asks for a fingerprint or your face, with a five-minute grace window.
Already have an ~/.ssh/config? Settings › Backup & import › Import from another app reads HostName, Port, User and ProxyJump from it.
Server behind a bastion? Add the bastion as a host first, then pick it as a jump: up to three hops.
If a host key ever changes, the connection stops and stays stopped. That is on purpose: forget the old key from that host's sheet only once you know why it changed.