-
Encryption
AES-256-GCM authenticated encryption (NIST-approved, prevents tampering), PBKDF2 100k iterations key derivation, Ed25519 public keys, ECDH key exchange, zero-telemetry, transparent/auditable architecture
-
Platforms
macOS, Windows, Linux, CLI (Command-line), Web interface available
-
Authentication
Password-based, SSH key-based (Ed25519, RSA), TOTP 2-factor auth, Biometric (Touch ID, Face ID, Windows Hello), LDAP/SAML (Enterprise)
-
Team Permissions
Admin, Member, Viewer — RBAC per vault
-
File Transfer
SFTP dual-pane (40% faster than Termius), drag-and-drop file editing, batch upload/download, sync folders, chmod visual editor, resumable transfers on disconnect
-
Session Sharing
Real-time session sharing with granular RBAC (read-only, write, admin), link-based access, automatic access revocation when user leaves team, session recording & replay available (Premium)
-
Audit Trail
Forensic-grade audit logs: 24+ months retention (configurable), immutable/tamper-proof (can't be deleted), tracks: who connected when, what commands executed, file transfers, access changes. Exportable in multiple formats (JSON, CSV). GDPR/SOC2/HIPAA compliant.
-
Snippets
Personal and team snippet libraries, role-based access control (who can edit/view), syntax highlighting (Bash, Python, Go, Rust, etc.), keyboard shortcut access (⌘+P), search and tagging, version history
-
Languages
10 languages: English, Français, Deutsch, Čeština, Polski, 日本語, Português (BR), Kurdish. RTL support coming. Full documentation in all languages.
-
Free Plan
Free forever (no expiration): 1 SSH connection, community support, full feature access (SFTP, audit logs, encryption, 2FA), no credit card required, limited to 1 concurrent session. Upgrade anytime. 30-day money-back on paid plans.
-
Vaults
Encrypted vaults: Personal vault (local sync via end-to-end encryption), Team vault (shared credentials with RBAC), Vault hierarchy (nested vaults), Zero-knowledge architecture (SecurSSH can't access vault contents), Biometric unlock (Touch ID, Face ID, Windows Hello)
-
Agent Forwarding
SSH agent forwarding (per-host configuration), port forwarding (local, remote, SOCKS), jump hosts (multi-hop SSH), identity file selection per connection, automatic key loading from vault
-
Baseline security / Session management
Session timeout (configurable inactivity), automatic lock on inactivity, encrypted session state (AES-256-GCM), session recovery on app restart, multi-device sync (same vault across devices)
-
Admin capabilities / Team management
Admin dashboard: User management (add/remove/suspend), Permission control (RBAC management), Audit log review (search by user/time/action), Vault management (create team vaults), Billing & license management (Enterprise)
-
Env Variables
Per-host environment variables (key-value pairs), inherit from parent (vault level), override per-connection, support for bash expansion syntax, useful for proxies, credentials, deployment variables
-
Offline
100% local-first architecture: Works completely offline (no internet required), saved connections available offline, vault accessible offline (end-to-end encrypted), sync when internet returns (automatic). Zero cloud dependency option.
-
Import/Export
Import: OpenSSH config format, Termius JSON, PuTTY private keys. Export: Encrypted JSON (AES-256-GCM), standard SSH format, backup format (encrypted, full vault). Zero data loss migration from other tools.
-
GDPR compliant, EU-hosted
✅ GDPR Compliant: EU-hosted (Frankfurt, Germany), data residency guaranteed, right to access/delete/export honored, zero telemetry (no analytics), no third-party data sharing. Data Processing Agreement available. SOC 2 Type II audit in progress (Q4 2026).
