Docs that don't lie.

Install on macOS · Windows · Linux

Sixty-second installer. Auto-imports ~/.ssh/config on first run.

Sign in or stay local

Local-only mode keeps every byte on your device. Team mode unlocks sync + RBAC.

Your first SSH session

Find a host in ⌘K, hit ↵. We handle bastions, agent forwarding, and key picking.

Import from .ssh/config or Termius

Bring your host blocks, identities and ProxyJump chains in one click.

Grouping hosts

Group by environment (prod / staging / dev) or by project. Drag-drop or rule-based.

Bastion / jump-host chaining

Zero-config support for ProxyJump. Chain up to 4 hops. Per-hop identity allowed.

Port forwards · tunnels

Local · remote · dynamic. Pin to a connection so they reattach on reconnect.

SFTP browser

Drag-drop transfers with checksum verification. Resume on disconnect.

Local vault · OS keychain

macOS Keychain · Windows Credential Manager · libsecret on Linux. Touch ID-aware.

Generating new keys

Ed25519 by default. RSA-4096 supported. Per-host key suggestions.

Rotating keys

Pull-down list of every host using a key — rotate in one click.

Team vault (Pro)

Envelope-encrypted blobs in the cloud. Decryption keys never leave devices.

Quick snippets via ⌘K

Type-ahead palette for your favorite commands and runbooks.

Variables · ${cwd} ${host.tag}

Template snippets with host metadata. Resolved at run-time.

Shared team snippets

Promote a personal snippet to team scope. RBAC-controlled.

Run on selection

Highlight a host group, run the snippet on all of them at once.

Run on every host in a group

Up to 1,000 hosts in parallel. Live aggregated output with per-host filters.

Cancel + retry per host

Yellow-flag any host, retry just those, ignore the rest.

Pre-flight dry-run

Render the resolved command per host before you hit ↵.

Patterns + tags

Broadcast by tag or glob. e.g. `*.prod` or `tag:edge`.

Every connection, logged

Timestamp · user · host · key fingerprint · session length.

Command-level capture

Pro+. Opt-in. Encrypted at rest. Configurable redaction.

Export to SIEM

CSV · JSON · Splunk HEC · Datadog. Daily rollups by user/group.

Tamper-evident hash chain

Every entry hashes the previous — log tampering is detectable.

SAML 2.0 setup

Generic SP. Tested with Okta, Azure AD, Google, JumpCloud, OneLogin.

OIDC setup

Works with any compliant IdP. Auto-provision on first sign-in.

SCIM 2.0 provisioning

Automate de-provisioning. Map IdP groups to host groups.

Per-host RBAC

Grant read · execute · admin per group or per host. Auditable.

Single-binary install

Drop the binary on a box, point at Postgres. 5-minute install.

Helm chart

Production-ready chart. Targets K8s 1.27+ on EKS · GKE · AKS.

Backup + restore

Postgres dump + S3-compatible blob store. Restore in 60 seconds.

Air-gapped deployments

No phone-home. Update via signed image bundle.

Public REST API

OpenAPI 3.1 spec. Bearer-token auth. Rate-limited per workspace.

CLI (sshc)

Headless mode for CI. Same auth as desktop. Pipes into shell scripts.

Webhooks

Connect · disconnect · broadcast · audit-event. HMAC-signed.

Personal access tokens

Scoped tokens (read · run · admin). Auto-expire policies.