Features
Grouped by what they are for: reaching a host, proving who you are, and getting work done once you are in.
Proving who you are
Three ways to authenticate. Security keys and cloud sign-in mean no private key is stored on the phone, and a hardware-backed key can never be read out of it.
- Keys and the encrypted vaultHardware-backed keys, imported keys, and how they are stored.
- YubiKey over NFCSign in by holding a security token against the phone.
- Cloud Browser Sign-inSign in with AWS or Google via browser with OAuth 2.0 PKCE. Zero static secrets.
Reaching a host
A host is often not directly reachable — behind NAT, in a private subnet, or with no public address at all. Each of these solves that a different way.
- TailscaleAn embedded node, no second VPN app.
- AWS EC2Instance Connect or Session Manager, with no stored key.
- Google CloudIdentity-Aware Proxy, no public IP needed.
- Cloudflare AccessNo open SSH port on the host.
Getting work done
- The terminalxterm-256color, vim and htop, multiple sessions, searchable history.
- Command snippets73 built in, plus your own.
- AI copilotWorks offline, flags destructive commands.
- Encrypted backupEnd-to-end, with a passphrase only you hold.
How the connection modes compare
| Mode | Key stored on phone? | Needs an open port? | Tier |
|---|---|---|---|
| Direct | Yes, unless hardware-backed | Yes | Free |
| Tailscale | Yes, unless hardware-backed | No | Free |
| Jump host | Yes, unless hardware-backed | On the bastion only | Free |
| AWS Instance Connect | No | Yes | Pro |
| AWS Session Manager | No | No | Pro |
| Google Cloud IAP | No | No | Pro |
| Cloudflare Access | Yes, unless hardware-backed | No | Pro |
Cloudflare Access is transport only — it decides whether you may reach a host, and the host still asks for its own credential. The AWS and Google Cloud modes replace the credential too, which is why they need nothing stored.