Frequently asked questions

An SSH app for iPhone and iPad. It connects to your Macs, Linux servers, VPSs and Raspberry Pis, runs commands, and gives you a full terminal. Its standout feature is signing in with Face ID instead of passwords.

An iPhone or iPad with iOS or iPadOS 17 or later, and a computer you can sign in to over SSH. For Face ID sign-in you need a device with Face ID or Touch ID (DuoShell can also fall back to your passcode).

DuoShell is in beta on Apple's TestFlight. Email us to join, and you'll get an invite to install it through the TestFlight app.

No. You can add a server with its password and switch to Face ID from the phone. The Mac companion is a shortcut for setting up many servers at once, including ones that don't allow passwords.

It's free during the beta. We'll announce pricing, if any, before it reaches the App Store.

Your device makes its own SSH key inside the Secure Enclave, Apple's security chip. The private half never leaves the chip: not to us, not to iCloud, not even to DuoShell itself. Each connection asks the chip to sign in, and the chip only does that after Face ID, Touch ID or your passcode. The server holds only the public half, which is safe to share.

Yes, in several ways. There's nothing to type, phish or reuse, the key can't be copied off the device, and you can remove one device's access without changing anything else. Once your servers use keys, you can turn password sign-in off on them entirely.

The key is useless without your face or passcode. To be sure, remove that phone's key: click Remove from servers next to it in DuoShell Pair, or delete the line ending in its duoshell-… name from each server's ~/.ssh/authorized_keys.

No. There's no account, no analytics and no tracking. DuoShell connects only to the servers you add and, while pairing, to your own Mac. See the privacy policy.

Only if you choose to save one, it goes in this device's Keychain, protected by Face ID or your passcode, and never syncs. Once a server uses Face ID sign-in, DuoShell offers to forget its password.

Every server has an identity (its host key). DuoShell shows you the fingerprint the first time and refuses to connect if it ever changes. Servers set up with Pair with Mac come with their identity already recorded by your Mac, so there's nothing to check by hand.

Yes. The QR code carries a one-time secret, and every message in both directions is signed with it, so another device on the network can't add its own key or send your phone fake servers. The code works once and expires in 10 minutes.

They go only to the server you run them on. Command history is stored on this device only (the last 30 runs per server), excluded from cloud backup, and you can clear it any time.

Anything that runs an SSH server: macOS (Remote Login), Linux (Ubuntu, Debian, Fedora…), Raspberry Pi OS, BSD, most NAS boxes and VPSs from any hosting company.

System Settings → General → Sharing → turn on Remote Login. Connect to the Mac's name ending in .local or its IP address, using your Mac account's short name.

Use Tailscale on the machine and your phone, then add the machine's Tailscale address (starting with 100.) under Edit Server → Advanced → More addresses. DuoShell tries the local address first and the Tailscale address next, automatically. See the guide.

You can import an unencrypted OpenSSH Ed25519 or ECDSA P-256 key in Settings. RSA keys and keys protected by a passphrase aren't supported yet. For most people the device's own Face ID key is the better choice anyway.

That server only allows keys (common and good practice). Pair with your Mac if the Mac can already sign in to it, or copy this device's public key from Settings and add it to ~/.ssh/authorized_keys on the server some other way, for example through your host's web console.

Not yet. Servers that require those prompts can still be used with a key.

The connection ended before the server reported back. The command may still have finished on the server. Reconnect and check. For long-running work, use the Terminal with tmux turned on.

tmux keeps a terminal session running on the server even if your phone disconnects. With Keep my terminal session alive on, DuoShell rejoins that session after a reconnect, so long jobs and open editors survive a dropped signal.

Yes, set any port in Edit Server.

It's a small menu-bar app. It shows a QR code, and when your phone scans it, it adds your phone's key to the servers you've checked, using the access your Mac already has. It also records each server's identity and addresses for the phone.

It's signed with our Apple Developer ID and checked by Apple (notarized), so macOS opens it normally. It's distributed from this site rather than the Mac App Store because the App Store's sandbox doesn't allow apps to run SSH. Download and details.

You asked the phone to sign in as a different account (for example root) than the one your Mac uses, so adding the key needs admin rights, and the app can't ask for an admin password. Add the key line it shows to that account by hand, or have the phone sign in as the same account your Mac uses.

Connect to that server once from Terminal on the Mac (ssh you@server) and accept its fingerprint, then pair again.

Yes. If your Mac signs in to a server through 1Password, approve the 1Password prompt on the Mac while pairing.

Yes, with the same features. The screenshots in the guides show both.

Your server list and snippets sync through your iCloud account. Keys and saved passwords never sync; each device uses its own key. On a new device, a synced server asks for its password once, then you can turn on Face ID for that device too.

No. Deletions sync too, and a server you delete stays deleted on all your devices.

DuoShell is built with the latest iOS tools, so it fills iPhone Duo's large inner display, and it works great on every other iPhone too.

Not yet; they're on the roadmap. For now, tmux covers most of what people use Mosh for.

Email [email protected], or use Send Beta Feedback in the TestFlight app (take a screenshot inside DuoShell to attach it automatically).