Features
Grouped by what they are for: reaching a host, proving who you are, and getting work done once you are in.
Proving who you are
Four ways to authenticate, three of which mean no private key is stored on the phone.
- Keys and the encrypted vaultHardware-backed keys, imported keys, and how they are stored.
- YubiKey over NFCSign in by holding a security token against the phone.
Reaching a host
A host is often not directly reachable — behind NAT, in a private subnet, or with no public address at all. Each of these solves that a different way.
- TailscaleAn embedded node, no second VPN app.
- AWS EC2Instance Connect, with no stored key.
- Google CloudIdentity-Aware Proxy, no public IP needed.
- Cloudflare AccessNo open SSH port on the host.
Getting work done
- The terminalxterm-256color, multiple sessions, searchable history.
- Command snippets72 built in, plus your own.
- AI copilotWorks offline, flags destructive commands.
- Encrypted backupEnd-to-end, with a passphrase only you hold.
How the connection modes compare
| Mode | Key stored on phone? | Needs an open port? | Tier |
|---|---|---|---|
| Direct | Yes, unless hardware-backed | Yes | Free |
| Tailscale | Yes, unless hardware-backed | No | Free |
| Jump host | Yes, unless hardware-backed | On the bastion only | Pro |
| AWS Instance Connect | No | Yes | Free |
| Google Cloud IAP | No | No | Pro |
| Cloudflare Access | Yes, unless hardware-backed | No | Pro |
Cloudflare Access is transport only — it decides whether you may reach a host, and the host still asks for its own credential. The AWS and Google Cloud modes replace the credential too, which is why they need nothing stored.