Frequently asked questions

The questions that come up most, answered without marketing language.

Is there an iPhone or iPad version?

No. SSH Manager Pro is an Android app and there is no iOS version, nor one planned. It requires Android 8.0 or later on a 64-bit device. Much of what makes it work is Android-specific - keys generated inside the Android Keystore, and an embedded Tailscale node that runs as a separate process, which iOS does not permit. There is no desktop or web version either.

Is my private key safe on a phone?

Safer if it is never on the phone at all, which is what the app is built around. You can generate a key inside the phone's security chip so the private half can never be read out - not by this app, not by anything else. You can keep the key on a YubiKey instead. Or for AWS and Google Cloud hosts you can use a key that is minted per session and discarded minutes later. Imported keys are supported too, encrypted with AES-256-GCM using a key held in the Android Keystore and excluded from Android's cloud backups.

What happens if I lose my phone?

A hardware-backed key is gone with the device and cannot be used by whoever finds it, since it was never exportable and the app can be locked with your fingerprint. Remove the corresponding line from authorized_keys on your servers to be certain. If you used a YubiKey, the key is on the token rather than the phone, so nothing is lost. If you used cloud credentials, revoke the IAM user or service token.

Can I use the same SSH key on more than one device?

Not a hardware-backed key - that is the trade for it being non-exportable. A YubiKey works on every phone you tap it against. An imported key can be restored to another device through encrypted cloud backup.

Does it work with Headscale?

Yes. The Tailscale control server URL is configurable, so the embedded node works with Headscale or any compatible coordination server.

Do I need the Tailscale app installed?

No. The app embeds its own Tailscale node. It does not capture your phone's whole network the way a system VPN does, so it will not conflict with a work VPN.

How is this different from other Android SSH clients?

Most ask you to paste a private key and then promise to look after it. This one is designed so you do not have to: keys can be generated inside the secure element, held on a YubiKey, or avoided entirely for AWS, Google Cloud and Cloudflare hosts. It also verifies host key fingerprints and aborts on a change rather than prompting you to accept it.

What does the AI copilot send to a server?

By default, nothing. The offline rule engine runs on the device and transmits no data. If you enable a live model such as Gemini or OpenRouter with your own API key, recent terminal output is sent as context so the model can see what you are looking at - which may include hostnames or file contents. If you work with sensitive output, leave live models off.

What happens if I cancel my subscription?

Nothing is deleted. Your hosts, keys, snippets and settings all remain, and existing jump hosts keep working. Pro features stop: you cannot create new jump hosts, restore from cloud backup, or use live AI models or the Google Cloud and Cloudflare connection modes.

Does the app need root?

No. It uses standard Android APIs throughout - the Keystore for encryption, NFC reader mode for security keys, and ordinary networking.

Which Android versions are supported?

Android 8.0 (API 26) and later. Hardware-backed keys work on all of them, though StrongBox - a separate security chip rather than the processor's trusted environment - requires Android 9 and a device that includes one. The app reports which protection your device actually provided rather than assuming.

Can I connect to a server with no public IP address?

Yes, three ways. Google Cloud IAP reaches Compute Engine instances that have no external address. Cloudflare Access reaches hosts published through a tunnel with no open port. Tailscale reaches anything on your tailnet, including machines behind NAT or a home router.

Is there a free version?

Yes, and the security features are in it: the terminal, encrypted vault, hardware-backed keys, security keys, Tailscale, AWS Instance Connect, all 72 snippets and the offline AI copilot. Pro adds jump hosts, encrypted cloud backup, live AI models, and the Google Cloud and Cloudflare modes.

What happens if a server's fingerprint changes?

The connection is aborted with a warning. It is not a prompt you can accept, because a prompt during a man-in-the-middle attack is a prompt people click through. If the change is legitimate - a rebuilt server, say - remove the stored fingerprint in the app and reconnect to pin the new one.

Can I export my session history?

Yes. Any single session or your whole history can be exported to a file in Downloads. This is free. There is also a configurable line limit, where 0 means no limit.

Something else?

Email sshmanagerpro@gmail.com. See also the security model and the setup guides.