Security model
What protects what, and where each protection stops. Stated plainly, because a security claim you cannot check is marketing.
Credentials at rest
Passwords, key passphrases, imported private keys and cloud credentials are encrypted with AES-256-GCM using a key held in the Android Keystore, with a random IV per value. The Keystore key does not leave the device. Nothing sensitive is written to disk in plaintext, and the app is excluded from Android's cloud backups.
A failed decrypt is an error rather than a fallback. Returning the ciphertext and using it as a password — which some implementations do — turns a recoverable problem into an authentication failure that gives no hint where to look.
Credentials that are never stored
The strongest position is not holding a secret at all:
- Hardware-backed keys — created inside the secure element, non-exportable.
- Security keys — the private half stays on the token.
- AWS Instance Connect and Google Cloud IAP — a key per session, discarded after minutes.
Host key verification
The app pins a server's public key fingerprint on first connection and verifies it every time after. If a fingerprint changes, the connection is aborted with a warning rather than prompting you to accept it — a prompt during a man-in-the-middle attack is a prompt you will click through.
Trust on first use has a known limit: the first connection is unverified. If you are connecting over a network you do not trust, compare the fingerprint the app shows against one you obtained another way.
Transport
Modern key exchange with strict KEX support, guarding against the Terrapin prefix-truncation attack. Legacy ciphers are not offered.
App lock
Optional biometric or PIN lock, re-applied whenever you leave the app. The lock is drawn over the running app rather than replacing it, so unlocking returns you to exactly the screen and half-typed text you left.
This protects against someone picking up an unlocked phone. It is not a defence against a compromised device: a rooted phone running hostile software can observe the app regardless.
What leaves the device
| Data | Goes where | When |
|---|---|---|
| Hosts, keys, settings | Your cloud backup, encrypted with your passphrase | Only if you enable backup |
| Terminal output | Your chosen AI provider | Only with a live model enabled |
| Cloud API calls | AWS, Google, Cloudflare | When using those connection modes |
| Session traffic | The host you connected to | Always — it is an SSH client |
There is no analytics or telemetry. See the privacy policy.
Reporting a problem
Security reports are welcome at sshmanagerpro@gmail.com. Please describe what you found and how to reproduce it; you will get a reply.