Security model
What protects what, and where each protection stops. Stated plainly, because a security claim you cannot check is marketing.
Credentials at rest
Passwords, key passphrases, imported private keys and cloud credentials are encrypted with AES-256-GCM using a key held in the Android Keystore, with a random IV per value. The Keystore key does not leave the device. Nothing sensitive is written to disk in plaintext, and the app is excluded from Android's cloud backups.
A failed decrypt is an error rather than a fallback. Returning the ciphertext and using it as a password — which some implementations do — turns a recoverable problem into an authentication failure that gives no hint where to look.
Credentials that are never stored
The strongest position is not holding a secret at all:
- Hardware-backed keys — created inside the secure element, non-exportable.
- Security keys — the private half stays on the token.
- Cloud Browser Sign-in — authenticate via browser with AWS (OAuth 2.0 PKCE + DPoP) or Google Cloud SDK without keeping long-lived static secrets.
- AWS Instance Connect and Google Cloud IAP — an ephemeral key per session, discarded after minutes.
Host key verification
The app pins a server's public key fingerprint on first connection and verifies it every time after. If a fingerprint changes, the connection is aborted with a warning rather than prompting you to accept it — a prompt during a man-in-the-middle attack is a prompt you will click through.
Trust on first use has a known limit: the first connection is unverified. If you are connecting over a network you do not trust, compare the fingerprint the app shows against one you obtained another way.
Transport
Modern key exchange with strict KEX support, guarding against the Terrapin prefix-truncation attack. Legacy ciphers are not offered.
App lock
Optional biometric or PIN lock, re-applied whenever you leave the app. The lock is drawn over the running app rather than replacing it, so unlocking returns you to exactly the screen and half-typed text you left.
This protects against someone picking up an unlocked phone. It is not a defence against a compromised device: a rooted phone running hostile software can observe the app regardless.
What leaves the device
| Data | Goes where | When |
|---|---|---|
| Hosts, keys, snippets | Your cloud backup, encrypted with your passphrase | Only if you enable backup |
| Terminal output | Your chosen AI provider | Only with a live model enabled (Gemini through Google's Firebase when you are signed in with Google, OpenRouter, or a server you host) |
| Feedback you write | The developer's feedback service | Only when you press Send in Settings > About (optional reply email) |
| Subscription state | Google Play and Google sign-in | When you sign in or buy Pro |
| Tips card | Google Play (update and review prompts) | Rarely on the Hosts list; can be turned off in Settings > About |
| Cloud API calls | AWS, Google, Cloudflare | When using those connection modes |
| Session traffic | The host you connected to | Always — it is an SSH client |
There is no analytics and no usage tracking. Crash reporting is off by default; if you switch it on, crash reports carry the stack trace and your app and device version, never your credentials or terminal output — though a server name can appear in an error message. See the privacy policy.
Reporting a problem
Security reports are welcome at security@sshmanagerpro.app. Please describe what you found and how to reproduce it; you will get a reply.