# SSH Manager Pro

> A security-first SSH client for Android. An SSH and terminal client for Android built so that credentials stay under the user's control: keys can be generated inside the phone's secure element or held on a YubiKey, and cloud hosts can be reached without storing any key at all.

**Android 8.0 or later. Android only - there is no iOS version.** Free, with an optional Pro subscription. Support: sshmanagerpro@gmail.com

## Overview

- [Home](https://sshmanagerpro.app/): Android SSH client where keys never leave your control: generate them inside the phone's secure element, keep them on a YubiKey, or connect with no key at all.

## Docs

- [Documentation](https://sshmanagerpro.app/docs/): Setup guides for SSH Manager Pro: getting started, AWS IAM, Google Cloud IAP, Cloudflare Access and YubiKey PIV configuration.
- [AWS setup](https://sshmanagerpro.app/docs/aws-setup/): Create a least-privilege IAM user for EC2 Instance Connect, with the exact policy JSON. Three actions, none of which can change or read an instance.
- [Cloudflare setup](https://sshmanagerpro.app/docs/cloudflare-setup/): Publish an SSH host as a Cloudflare Access application, create a service token, and attach a policy so the app can reach it with no open port.
- [Getting started](https://sshmanagerpro.app/docs/getting-started/): Install SSH Manager Pro, add your first host, and connect — including generating a key that cannot be copied off the phone.
- [Google Cloud setup](https://sshmanagerpro.app/docs/google-cloud-setup/): Create a service account with the two roles Identity-Aware Proxy needs, open the firewall to Google's proxy range, and enable OS Login on the instance.
- [YubiKey setup](https://sshmanagerpro.app/docs/yubikey-setup/): Generate a P-256 key in PIV slot 9A with ykman, add the token to the app over NFC, and put its public key on your server.

## FAQ

- [FAQ](https://sshmanagerpro.app/faq/): Common questions about SSH Manager Pro: is there an iPhone version, key safety, losing your phone, Headscale, and what the AI copilot sends.

## Features

- [Features](https://sshmanagerpro.app/features/): Everything the app does: hardware-backed keys, YubiKey over NFC, Tailscale, AWS, Google Cloud, Cloudflare Access, snippets and an offline AI copilot.
- [AI copilot](https://sshmanagerpro.app/features/ai-copilot/): Describe what you want and get the command. Works fully offline with an on-device rule engine, no account and no API key, and flags destructive commands.
- [AWS EC2 without SSH keys](https://sshmanagerpro.app/features/aws/): Connect to EC2 with Instance Connect. A fresh key is minted per session and discarded by AWS after a minute, so nothing is stored on the phone.
- [End-to-end encrypted backup](https://sshmanagerpro.app/features/backup/): Back up hosts, keys and settings encrypted on the phone with a passphrase only you know. The server stores a blob it cannot read.
- [Cloudflare Access](https://sshmanagerpro.app/features/cloudflare/): Reach hosts published behind a Cloudflare Access application, with no SSH port open to the internet, authenticated with a service token.
- [Google Cloud IAP](https://sshmanagerpro.app/features/google-cloud/): Reach Compute Engine VMs that have no public IP address, through Google's Identity-Aware Proxy, with a one-time SSH key published via OS Login.
- [Command snippets](https://sshmanagerpro.app/features/snippets/): 72 built-in diagnostic commands grouped by Disk, Processes, Network, Containers and Performance, plus your own, with the ones you use rising to the top.
- [SSH keys and the encrypted vault](https://sshmanagerpro.app/features/ssh-keys/): Generate an SSH key inside the Android Keystore so the private half can never be read out, or import an existing key into a Keystore-encrypted vault.
- [Tailscale, built in](https://sshmanagerpro.app/features/tailscale/): An embedded Tailscale node reaches machines behind NAT or a home router without installing a second VPN app, and works with Headscale too.
- [The terminal](https://sshmanagerpro.app/features/terminal/): A real xterm-256color terminal for Android: selectable output, multiple concurrent sessions, searchable history, and scrollback that survives a reconnect.
- [YubiKey over NFC](https://sshmanagerpro.app/features/yubikey/): Sign in to SSH by holding a YubiKey against your Android phone. The private key stays on the token, so the same key works from any phone you tap it against.

## Pricing

- [Pricing](https://sshmanagerpro.app/pricing/): The terminal, encrypted vault, hardware-backed keys, Tailscale, snippets and AWS Instance Connect are free. Pro adds jump hosts, backup and live AI.

## Security

- [Security model](https://sshmanagerpro.app/security/): How credentials are stored, how host keys are verified, what leaves the device and what does not — including the limits of each protection.

## Legal

- [Privacy](https://sshmanagerpro.app/privacy.html)
- [Terms](https://sshmanagerpro.app/terms.html)
- [Licences](https://sshmanagerpro.app/licenses.html)