Frequently asked questions

The questions that come up most, answered without marketing language.

Is there an iPhone or iPad version?

An iOS version is currently in active development. Today, SSH Manager Pro is released in all 178 countries on Google Play for Android (Android 8.0 or later on 64-bit phones, foldables, and tablets). The iOS release will bring the same security-first SSH experience to iPhone and iPad.

Is my private key safe on a phone?

Safer if it is never on the phone at all, which is what the app is built around. You can generate a key inside the phone's security chip so the private half can never be read out - not by this app, not by anything else. You can keep the key on a YubiKey instead. Or for AWS and Google Cloud hosts you can use a key that is minted per session and discarded minutes later. Imported keys are supported too, encrypted with AES-256-GCM using a key held in the Android Keystore and excluded from Android's cloud backups.

What happens if I lose my phone?

A hardware-backed key is gone with the device and cannot be used by whoever finds it, since it was never exportable and the app can be locked with your fingerprint. Remove the corresponding line from authorized_keys on your servers to be certain. If you used a YubiKey, the key is on the token rather than the phone, so nothing is lost. If you used cloud credentials, revoke the IAM user or service token.

Can I use the same SSH key on more than one device?

Not a hardware-backed key - that is the trade for it being non-exportable. A YubiKey works on every phone you tap it against. An imported key can be restored to another device through encrypted cloud backup.

Does it work with Headscale?

Yes. The Tailscale control server URL is configurable, so the embedded node works with Headscale or any compatible coordination server.

Do I need the Tailscale app installed?

No. The app embeds its own Tailscale node. It does not capture your phone's whole network the way a system VPN does, so it will not conflict with a work VPN.

Tailscale says the device is "not owned by user …" and I can't connect. What do I do?

That message appears when the browser is signed in to Tailscale as a different account from the one that owns this phone's node. It usually follows picking the wrong account on Tailscale's page the first time; the browser then remembers it, so every retry shows the same message.

Open Settings → Tailscale in the app, tap Stop, then Start Node. Tailscale asks you to choose an account again: pick the one that owns the device (the one you first signed the app in with), then connect to the host again. If it still fails, Sign Out of Tailscale on the same screen and sign in once more.

How is this different from other Android SSH clients?

Most ask you to paste a private key and then promise to look after it. This one is designed so you do not have to: keys can be generated inside the secure element, held on a YubiKey, or avoided entirely for AWS, Google Cloud and Cloudflare hosts. It also verifies host key fingerprints and aborts on a change rather than prompting you to accept it.

What does the AI copilot send to a server?

By default, nothing. The offline rule engine runs on the device and transmits no data. If you enable a live model - Gemini (through your Google sign-in or your own key), OpenRouter or a server you host - your prompt and recent terminal output (up to the last 1,000 characters) are sent as context so the model can see what you are looking at, together with the session's host alias, username and hostname - which may include file contents. If you work with sensitive output, leave live models off.

What happens if I cancel my subscription?

Nothing is deleted. Your hosts, keys, snippets and settings all remain, and any AWS, Google Cloud or Cloudflare profile you already set up keeps working - a paywall that breaks existing configuration isn't the model. Pro features stop: you cannot restore from cloud backup, use live AI models, start a new session recording, or add a new AWS, Google Cloud or Cloudflare profile. Recordings you already made stay yours to share or delete.

Does the app need root?

No. It uses standard Android APIs throughout - the Keystore for encryption, NFC reader mode for security keys, and ordinary networking.

Which Android versions are supported?

Android 8.0 (API 26) and later. Hardware-backed keys work on all of them, though StrongBox - a separate security chip rather than the processor's trusted environment - requires Android 9 and a device that includes one. The app reports which protection your device actually provided rather than assuming.

Can I connect to a server with no public IP address?

Yes, four ways. Google Cloud IAP reaches Compute Engine instances that have no external address. AWS Session Manager reaches EC2 instances through AWS's own channel, with no inbound rule at all. Cloudflare Access reaches hosts published through a tunnel with no open port. Tailscale reaches anything on your tailnet, including machines behind NAT or a home router.

Do you support Azure?

Not with a zero-secret connect mode, and that's a Microsoft limitation, not a decision we made. AWS EC2 Instance Connect and Google Cloud IAP both have documented public APIs this app calls directly. Azure's equivalents - Microsoft Entra ID's ephemeral SSH certificates and Azure Bastion - don't: both are built into the Azure CLI itself, with no public API for a third-party app to call instead. Building either would mean bundling a full Azure CLI environment on your phone or reverse-engineering an undocumented endpoint, and we don't do the second one. An Azure VM works today over ordinary Direct SSH with a password or key, same as any other server.

Is there a free version?

Yes, and the security features are in it: the terminal, encrypted vault, hardware-backed keys, security keys, Tailscale, jump hosts, all 73 snippets and the offline AI copilot. Pro adds every cloud provider integration - AWS, Google Cloud and Cloudflare - plus encrypted cloud backup, session recording and live AI models.

What happens if a server's fingerprint changes?

The connection is aborted with a warning. It is not a prompt you can accept, because a prompt during a man-in-the-middle attack is a prompt people click through. If the change is legitimate - a rebuilt server, say - remove the stored fingerprint in the app and reconnect to pin the new one.

Can I export my session history?

Yes. Any single session or your whole history can be exported to a file in a location you choose. This is free. There is also a configurable line limit, where 0 means no limit.

Something else?

Email support@sshmanagerpro.app. See also the security model and the setup guides.