Security

Encryption & keys

Every connection uses standard SSH protocol encryption, straight to your server. Your terminal sessions, credentials and files go directly between your phone and your own computers. Private keys can be locked behind Face ID, prompting each time one is used to connect.

Host verification

Host keys are verified on first connect and checked again on every connection after that, so a changed or spoofed key is never silently accepted. Known Hosts in Vaults shows exactly what was trusted and when.

Private key handling

When adding an Identity, a dedicated key generated on the phone is safer than reusing a key you already use elsewhere — if it's ever lost, only the hosts you added it to are affected. ed25519 is a reasonable default unless a host specifically requires ecdsa or rsa.

There is no cross-device sync — a Host/Identity/Snippet export is a plain portable file you move yourself. Treat that file like a password while it exists: delete it once it's imported on the other device.

Practical safety checklist

• ›Use a dedicated SSH key for CyberTerm rather than reusing your personal laptop key.
• ›Turn on Face ID key lock for any Identity used against a sensitive host.
• ›Verify a new host's key fingerprint out of band the first time you connect.
• ›Review Known Hosts periodically and remove entries for hosts you no longer use.
• ›Delete Host/Identity export files once they’ve been imported on the other device.
• ›Remove a saved Identity if you ever revoke or rotate that key on the server.