Bastillion sits between your users and the systems they need to reach, acting as a trusted third party rather than a simple password vault.
Web-based SSH terminal - once a host is registered, authorized users can open one or more live terminal sessions to it directly from the browser, with commands optionally broadcast across every open session at once.
SSH key management - Bastillion holds its own SSH keypair and pushes/rotates public keys across the hosts you register, so individual users never need to hold or manage long-lived keys to those systems themselves.
Key features: 2-factor authentication (Authy or Google Authenticator), centralized SSH key distribution and rotation, Profiles to control exactly who can reach what, Composite Scripts to run saved scripts across a whole fleet at once, and TLS/SSL over SSH.
Free at up to 5 registered systems; paid annual license tiers (Starter, Team, Business) raise the cap. Licensed under the Prosperity Public License.
A startup from Garfield Heights, the United States that is founded by Sean Kavanagh.
Web-Based SSH Terminal
Open one or more live terminal sessions to a registered host from the browser, with commands optionally broadcast across every open session at once.
SSH Key Management
Bastillion holds its own SSH keypair and pushes/rotates public keys across registered hosts, so individual users never hold long-lived credentials.
Two-Factor Authentication
Log in with an optional OTP access code via Authy or Google Authenticator for a second factor on every account.
Profiles & Access Control
Group systems into named Profiles and link users to them to control exactly who can reach what; revoking a profile assignment cuts access immediately.
Composite Scripts
Save a script once and execute it across every selected terminal in a fleet at once.
Bastillion acts as a bastion host rather than a simple password vault - it holds its own SSH keypair and pushes/rotates that key across every registered host, so end users never hold long-lived credentials to production systems. On top of that it gives you a full web-based terminal (with commands broadcast across multiple sessions at once), 2FA login, and Profile-based access control, all self-hosted as a single Java jar.
Most alternatives are either a heavyweight zero-trust platform (Teleport) aimed at large security teams, or a generic remote-desktop gateway (Guacamole, MobaXterm). Bastillion is a single self-hosted jar you can be running in minutes, purpose-built for the SSH key lifecycle: it generates, distributes, and rotates its own key across your fleet so nobody has to hand out or track individual credentials, and it's free for up to 5 systems before you need a license.
IT, DevOps, and security teams at any organization that runs its own servers - from solo developers managing a handful of hosts up to platform teams standardizing SSH access across a large fleet.
Bastillion started as an open-source SSH console for centrally managing server access. It's now maintained by Loophole, LLC, and has grown into a full v5 release on Java 21/Jakarta EE 11, with Ed25519/Ed448 key support, a v4-to-v5 migration tool, and a hardened CSRF/security-headers layer, while staying free to self-host at small scale.
Java 21 with Jakarta EE 11, packaged as a self-contained jar with an embedded Jetty server. It uses an embedded H2 database, xterm.js for the browser terminal, and Apache MINA SSHD for the SSH protocol layer, with Ed25519/Ed448 keys generated and managed via Bouncy Castle.
We have collected here some useful links to help you find out if Bastillion is good.
Check the traffic stats of Bastillion on SimilarWeb. The key metrics to look for are: monthly visits, average visit duration, pages per visit, and traffic by country. Moreoever, check the traffic sources. For example "Direct" traffic is a good sign.
Check the "Domain Rating" of Bastillion on Ahrefs. The domain rating is a measure of the strength of a website's backlink profile on a scale from 0 to 100. It shows the strength of Bastillion's backlink profile compared to the other websites. In most cases a domain rating of 60+ is considered good and 70+ is considered very good.
Check the "Domain Authority" of Bastillion on MOZ. A website's domain authority (DA) is a search engine ranking score that predicts how well a website will rank on search engine result pages (SERPs). It is based on a 100-point logarithmic scale, with higher scores corresponding to a greater likelihood of ranking. This is another useful metric to check if a website is good.
The latest comments about Bastillion on Reddit. This can help you find out how popualr the product is and what people think about it.
Do you know an article comparing Bastillion to other products?
Suggest a link to a post with product alternatives.
Is Bastillion good? This is an informative page that will help you find out. Moreover, you can review and discuss Bastillion here. The primary details have been verified within the last quarter. So they could be considered up to date. If you think we are missing something, please use the means on this page to comment or suggest changes. All reviews and comments are highly encouranged and appreciated as they help everyone in the community to make an informed choice. Please always be kind and objective when evaluating a product and sharing your opinion.