SSH client for Android

Termexa connects an Android phone, tablet or foldable to the servers you already use, over SSH. This page walks through adding a host and signing in, then covers what the terminal does once you are connected.

Why SSH on a phone is usually painful

• The phone keyboard has no Esc, Tab, Ctrl or arrow keys, which shells and editors depend on.
• Connections drop when the phone moves from Wi-Fi to mobile data or the screen turns off.
• Private keys and passwords need somewhere safe to live on a device you carry everywhere.

Connect to a server in four steps

1. Add a host. On the Terminals screen, tap ☰ to open Connections, then tap Remote terminal · Add new SSH host and enter an alias, the address (domain or IP), the port and the username. You can also set a Command to run after login, such as tmux new -A -s main.
2. Choose how to sign in. Generate a new Ed25519 key on the phone and copy its public key to the server, import an existing private key (Ed25519, RSA or ECDSA, with its passphrase if it has one), or use a password. When a server asks extra questions, such as a one-time code (keyboard-interactive), Termexa shows the server's prompt and sends your answer.
3. Check the server key. On the first connection Termexa shows the server's key fingerprint. Compare it with the server before tapping Trust. From then on the key is checked every time, and if it changes Termexa stops instead of connecting.
4. Type with the toolbar. The two-row toolbar under the terminal has Esc, Tab, Ctrl, Alt, Shift, Page Up/Down and arrows. Tap Ctrl, then a key, for a combination such as Ctrl+C. To keep Ctrl on for several keys, add the Ctrl Lock key in Settings → Shortcut panel.

Example: add the generated key to the server

After Generate new key, tap Copy public key and run this on the server as the same user:

mkdir -p ~/.ssh && chmod 700 ~/.ssh
echo 'PASTE-THE-PUBLIC-KEY-HERE' >> ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys

To compare the fingerprint Termexa shows on first connect, print the server's own:

ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub

What else the SSH client does

• Keychain. Passwords, keys and passphrases are encrypted with an Android Keystore key, excluded from automatic backup, and can be shared by several hosts. Saving a key passphrase is optional and protected by the device lock or biometrics.
• Jump hosts. Reach a server through another saved host (like ProxyJump). Both servers' keys are checked.
• Local port forwarding. Forward 127.0.0.1:local-port on the phone to an address and port reachable from a saved host, for example a web dashboard on the server. Running forwards can be stopped from the notification.
• Reconnects. Keepalives detect a dead connection, and Termexa reconnects automatically after a network change, then runs the host's saved command again.
• In the background. By default connections stay open when you leave the app. You can choose to close them after 1, 5, 30 or 60 minutes instead.
• Several terminals at once. Open more than one terminal per host; running terminals are grouped by host with a live preview. Add a host or a saved command to the home screen as a shortcut.
• Diagnose. When a connection fails, Diagnose checks the address, the port, the server key and sign-in one at a time and tells you which step failed.
• Lock and privacy. Optional fingerprint or face app lock, screenshots blocked by default, password-protected backups, and no account, ads or analytics.
• Local shell. Local terminal opens a shell on the phone itself, no server needed.

Frequently asked questions

Related guides