Why I built my own SSH client for Android

I run a small home server and often need to check on it from my phone. I tried a lot of SSH apps for Android. Most of them wanted an account, synced my keys to a cloud, or showed ads. I wanted my server keys to stay on my own phone and nowhere else, so I built the app I wanted. It's called Pocket SSH Terminal.

This is a short post about the design choices and what I learned. I'm also curious what you'd want from an SSH client on a phone.

Keys never leave the phone

The app creates an Ed25519 key on the device. The private key is encrypted with AES 256 GCM under a key in the Android Keystore. That Keystore key requires biometrics or the screen lock for every single use, with no time window after unlocking. If the phone has a StrongBox chip, it is used. The encrypted file is kept out of backups, and the key id is bound to the file as authenticated data, so files can't be swapped between keys.

One honest consequence: because the key never leaves the phone, a new phone means a new key. I added a short guide for that, because users got stuck on it.

Host keys are never trusted silently

An unknown or changed host key blocks the connection. The app shows the fingerprint, asks you to confirm, and pins it.

Pasted text is checked

Text copied from a website or chat can hide control characters, escape sequences that break out of bracketed paste, or invisible and direction changing Unicode characters. The app analyses pasted text before it reaches the terminal and warns you.

History that is never saved

Each command and its output becomes a block you can copy or run again. The history exists only in memory and is never written to the phone.

[BILLEDET KOMMER HER]

What testers taught me

I spent most of my time on testing, security and listening to testers. They asked for server groups and a guided first start, so those are in now. Mosh is the most requested thing that is still missing. Today the session can drop if Android freezes the app in the background, so I use tmux, and the app can open or resume a tmux session. That only solves half of it, and I know it.

The honest part

The app is not open source. After a free week it costs a one time price (5.99 USD, and Google Play shows a lower local price in some countries, around 170 rupees in India) or a small subscription. It's a side project, and this is how I can keep working on it. There is no account, no ads and no tracking, and the privacy policy says exactly what leaves the phone.

Google Play: https://play.google.com/store/apps/details?id=dk.pocketssh&referrer=utm_source%3Ddevto

What would you need from an SSH client on your phone, and what does the one you use today get wrong?