Guides · September 2026
SSH from an iPhone
A real terminal on the phone in your pocket — the client to pick, the key ceremony, the reachability question, and the honest answer to what a phone can’t do.
What an iOS SSH client actually is.
An SSH client on an iPhone is a complete client: it holds your keys, negotiates the connection, and draws a terminal on a screen that was never meant for one. The good ones — Termius, Blink Shell, Prompt 3, Secure ShellFish — are mature, and the differences between them are mostly about money, keys, and how they cope with the two things iOS does to every app: suspend it when you switch away, and give it a keyboard with no Esc, Ctrl, or Tab.
So the route has five parts, and none is optional. Pick a client. Get a key onto the phone and its public half onto the host. Make the host reachable from a cellular network. Make the session survive the phone. Then live with the keyboard. What follows is that route, honestly, before the question of whether the phone needs an SSH client at all.
The iOS clients, side by side.
Prices are from each vendor’s own page as of September 2026; check them, because the subscriptions move.
| Client | Price | Keys | Mosh | Best for |
|---|---|---|---|---|
| Termius | Starter is free; Pro is $10/month billed annually, for sync | Generates Ed25519, ECDSA, RSA; Face ID keys in the Secure Enclave on Pro | Yes | One client on phone, desktop, and Android, hosts synced |
| Blink Shell | Two weeks free, then $19.99/year; GPL-3.0 source | Ed25519, ECDSA, RSA, or Secure Enclave keys that never leave the chip | Yes | Keyboard-first power use; mosh that survives sleep |
| Prompt 3 | $9.99/year or $49 once; 7-day trial; Mac, iPad, iPhone, Vision Pro | Synced by Panic Sync; favorites locked with Face ID and the Secure Enclave | Yes, plus Eternal Terminal | One licence across every Apple screen |
| Secure ShellFish | Free to try; $2.99/month, $14.99/year, or $29.99 for life | Secure Enclave keys, hardware security keys, SSH certificates | Not advertised | Your server’s files in the Files app and in Shortcuts |
| a-Shell | Free; BSD-3 source | ssh-keygen on the phone, as on a Mac | No | A local Unix shell that also has ssh and scp |
The route, step by step.
01Pick the client and install it
If you want one app everywhere and don’t mind a subscription for sync, Termius. If you live in the terminal and own a Bluetooth keyboard, Blink. If you already use a Mac and an iPad and want one licence, Prompt 3. If what you actually want is the server’s files in the Files app, ShellFish. Every one of them is free to try, so try two.
02Make a key on the phone; only the public half leaves it
Don’t AirDrop your laptop’s private key. Generate a new one in the app — Blink under
config→ Keys → Generate New, Termius under Keychain → New key — and prefer Ed25519. Blink and Termius can also make the key inside the Secure Enclave, which means it cannot be exported or synced, and that is the point: a stolen phone yields nothing to copy. Then append the public key to~/.ssh/authorized_keyson the host; Blink ships ssh-copy-id for exactly this.ssh-copy-id -i phone-key user@hostFrom Blink, naming the key you generated 03Make the host reachable from a cellular network
On the same Wi‑Fi,
ssh user@192.168.1.20just works. Anywhere else, something has to carry the connection. The clean answer is a tailnet: install Tailscale on the phone and on the host, and the host gets a stable name that resolves from any network; the personal plan is free. Tailscale SSH can even replace the key ceremony, though its server side runs only on Linux and, through the open-source tailscaled, macOS. The old answer is a port forward on the router to port 22 — it works, and it puts sshd on the public internet, so if you take it, key-only authentication is not optional.04Keep the session alive with tmux, and the channel alive with mosh
Two different problems. tmux keeps the shell running on the host when the connection dies: start work inside
tmux new -s workand reattach withtmux attach -t workfrom any device. mosh keeps the connection itself alive as the phone hops from Wi‑Fi to cellular to sleep — it rides UDP ports 60000–61000 after an SSH handshake, so those must be open wherever port 22 is, and it syncs only the visible screen, which is why mosh.org itself tells you to run tmux underneath. Blink, Termius, and Prompt 3 all speak it.sudo apt-get install mosh tmux mosh user@host tmux attach -t work || tmux new -s workOn the host once, then from the phone 05Tame the phone
The keyboard has no Esc, Ctrl, Tab, or arrows, so every client adds a row above it — Termius calls it the keyboard add-on and lets you reorder its groups; Blink’s gestures and remaps live under customize. Pinch to change the font size. Turn auto-lock up while you work, because iOS suspends a backgrounded app and a plain SSH connection rarely survives the lock screen; mosh does, which is most of why the paid clients bother with it. And accept the geometry: a phone-width terminal is for checking on work, not for the work.
Where the route wears thin.
None of this is a defect in the apps. It is the shape of SSH, worn on a phone.
A key per device
Every phone, tablet, and laptop gets its own key, its public half copied to every host, and its removal — when the phone is lost — means editing authorized_keys on each of them, from something that still has access.
A host that must be reachable
sshd has to be on the LAN, on a tailnet, or on the public internet. The tailnet is the good answer, and it is one more agent on every machine and one more app on the phone.
Persistence as a discipline
The session survives only what you started inside tmux. Forget once and a two-hour job dies with the lock screen.
The screen you arrive at
You land on a prompt, not on the work. Finding the session, the pane, and the question an agent asked an hour ago is scrolling with a thumb.
Or skip SSH entirely.
For servers you don’t control, the SSH app is the right tool and the route above is how to use it. For machines that are yours — the workstation, the Mac mini, the build box — there is a shape with no client at all. spawnd installs one daemon on each host you own; the daemon dials out, so nothing on the host listens, no port is forwarded, no VPN is needed. The phone opens a browser, installs the console to the home screen as a web app, and is approved once against a short code. There is no key on the phone to generate, copy, or revoke; revoking the device is one click that every host honors.
The sessions are different too. Each one is owned by a worker process on the host, so it survives the closed tab, the dropped connection, the laptop lid, and a daemon restart, scrollback intact — there is no tmux to remember. And what the phone opens onto is the standing work: one workspace per project, a grid of sessions across hosts, an attention cue when an agent is waiting on a yes, and a notification on the phone so you don’t have to keep checking. Your browser talks to each daemon peer-to-peer, end-to-end encrypted; the server that introduces them never sees session content. It is open source, MIT/Apache-2.0. Termius alternatives ranks the clients beside the route that needs none, and Claude Code, remote covers the agent side: the official ways to reach a running Claude Code, and the machines they leave out.
Start
One line on the host, nothing on the phone.
curl -fsSL https://spawnd.dev/install.sh | shQuestions
- What is the best free SSH client for iPhone?
- Termius’ Starter plan is free and includes SSH, SFTP, and port forwarding; a-Shell is free and open source with ssh and scp built in. Blink and Prompt 3 are paid after a trial, and both earn it if you use the phone terminal daily.
- Why does my SSH session drop when I lock my iPhone?
- iOS suspends apps in the background, and a plain SSH connection doesn’t survive that. Use mosh, which reconnects transparently, and run tmux on the host so the shell itself is never lost.
- Do I have to open a port on my router to SSH from my phone?
- No. A tailnet such as Tailscale reaches the host from any network without a forwarded port. spawnd takes the other route: the host dials out and nothing on it listens, so there is no port to open and no VPN to run.