How MySSH protects your data

The big picture

MySSH keeps your hosts, passwords and keys in a vault on your computer. If you sign in, an encrypted copy travels through our cloud so your other devices can have it. Connections to your servers never go through us.

No account? Then nothing leaves your computer at all. The app works in full without one.

Your master password

When you create an account you choose a master password. Everything else rests on it, and it never leaves your device. Two keys are derived from it right there:

The sign-in key cannot decrypt anything, and knowing it does not help to find the encryption key. The cloud copy is exactly as strong as your master password, so make it long and use it nowhere else.

A forgotten master password cannot be recovered. Nobody, the owner of the server included, can then read the cloud copy. What is on your device stays.

What goes to the cloud

• Nothing until you sign in.
• After that: hosts with their saved passwords, groups, identities, snippets, settings and the keys of your saved hosts' servers.
• SSH keys only if you say so. Sync is turned on for each key separately, and it is off by default.
• Every record is encrypted on your device with XChaCha20-Poly1305 before it is sent.

What our server sees

A sync server has to know a few things to do its job. Here is the whole list.

One record, seen from both sides

Here is a host as it exists on your computer, and the very same host as it lies on our server.

The id is a random number that says nothing about the record. Everything that means something is in the blob, and the blob opens only with a key that never left your devices.

What stays on your device

Hosts, saved passwords, SSH keys, identities and snippets live in one file, vault.bin, encrypted with XChaCha20-Poly1305 under a random 256-bit key.

On the device it is protected by your user account and by disk encryption: FileVault on a Mac, BitLocker on Windows. On a Mac, MySSH checks whether FileVault is on and tells you in its settings if it is not.

Some things never leave the device, account or not:

• Command history, encrypted with the vault's key
• SSH keys you have not turned sync on for
• The keys of servers you connected to without saving them as hosts. The list of known hosts holds only public keys and is not encrypted on the device

Network and updates

SSH and SFTP go straight from your computer to your server; nothing passes through the cloud. Apart from your own servers the app talks only to the MySSH cloud (myssh.app), over HTTPS.

Its own updates come from there too. Each one is signed, and the app installs it only if the signature matches the key built into the copy you already have and names the very version on offer. The app never restarts by itself, and you choose when to update: now or at the next launch. An update put off twice, or waiting for three days, is installed quietly and takes over at the next launch, so that nobody stays long on an old version.

If a release turns out to be a bad one, we can withdraw it, and the app will then offer the way back to the one before. That too is a release we signed, and it too waits for your say.

If you ask for an AI suggestion, the line goes over HTTPS to the MySSH cloud, with the server's system and shell, the folder and a few last lines of the screen; passwords, tokens and keys are taken out on your device first. The cloud passes it to Google Gemini and keeps none of the text, only how many suggestions each account asked for. Nothing is sent until you choose the AI's row, and a line typed with a leading space is never sent.

In advanced mode the app also connects to your servers by itself, about once a minute, to read their load. It signs in only with what each host has saved and asks nobody anything: a server whose key is not trusted yet, or that wants a password that is not saved, is left alone. It reads the load and changes nothing.

There is no analytics, telemetry or advertising.

Server identity

On first contact the app shows the server's key fingerprint and waits for your decision. If the key later changes, the connection stops: it may be another machine posing as your server. You can look through the keys you trust, and forget any of them, in the Known hosts section.

With an account, the keys of your saved hosts follow you to your other devices, encrypted like every other record. A server you checked once is checked on a new computer too, so a fake one cannot slip in at the first connection there. A key you accept after a server is reinstalled, or one you forget, changes on every device.

Shared sessions

Inviting someone into a terminal is off until you turn it on in settings, and nothing is shown to anyone until you send a link.

• The content is encrypted with a key that exists only in the link. Our server cannot read it.
• Where possible, participants connect to each other directly and then see each other's IP addresses. To find those addresses the app asks a Cloudflare STUN server, which learns the IPs and nothing of the content. Otherwise the session goes through our server, still encrypted.
• Only one person types at a time: you, until you let a guest. You can take the keyboard back at any moment.
• Sharing ends when you stop it, close the tab, or the session ends.

Worth remembering: everyone with the link sees everything that terminal shows, passwords typed in the open included. A guest you give the keyboard to can run any command on the server as you.

You stay in control

• Nothing runs without you. Sync and automatic reconnection never run commands on your servers. A startup snippet runs only when you open the tab yourself.
• Your devices are in plain view. You see every device signed in to your account and can revoke its cloud access.
• History with manners. A command typed with a leading space is not remembered, and input the server does not echo, such as passwords, never is. You can clear the history at any time.
• Your account is yours to delete. In the app's settings, with your master password: everything our server keeps for it is erased for good. What is on your devices stays.