DEV Community: chen zong

Fixing SSH "Too many authentication failures" (and why it happens)

chen zong — Wed, 19 Aug 2026 15:06:41 +0000

Originally published on termai.sh.

What the error actually means

The server cut you off because your client made too many auth attempts in one connection — by default OpenSSH allows 6 (MaxAuthTries). The counterintuitive part: you usually see this without doing anything wrong. The cause is almost always a client with many keys loaded: it offers key 1, key 2, key 3… each rejection counts as a failure, and you're disconnected before the right key ever gets a turn.

Why your client offers every key it has

SSH agents accumulate keys: everything in ~/.ssh, everything added to ssh-agent, keys from other servers. By default the client tries them all, in order. Five wrong keys = five failures = one attempt left. People with 6+ keys get rejected by every new server, which looks baffling until you know the mechanism.

Fix 1 — Offer only the right key (desktop)

# one-off: force a single key, ignore the agent's pile
ssh -o IdentitiesOnly=yes -i ~/.ssh/the_right_key user@host

Make it permanent per-host in ~/.ssh/config:

Host myserver
    HostName 203.0.113.7
    User deploy
    IdentityFile ~/.ssh/the_right_key
    IdentitiesOnly yes

IdentitiesOnly yes is the key directive: it stops the client from parading every agent key past the server.

Fix 2 — On mobile, pin the key to the connection

Mobile clients are naturally less prone to this — but only if the connection is configured with one specific key. Attach the key that belongs to this server to the connection, and the client offers exactly that one, so the failure counter never piles up.

Fix 3 — Server-side (use sparingly)

MaxAuthTries 10
# then: sudo systemctl restart ssh

Treat this as a workaround, not the fix — a higher limit also gives brute-forcers more swings per connection (fail2ban mitigates that). The real fix is clients offering the right key first. With password auth, repeatedly mistyping also trips the limit — that one is just retyping carefully or switching to keys.

TL;DR

Meaning: too many auth attempts in one connection (default cap 6, MaxAuthTries)
Real cause: the client/agent offering its whole key pile, wrong ones first
Fix: IdentitiesOnly yes + the one right IdentityFile; on mobile, pin the key per connection
Avoid: raising MaxAuthTries as a workaround — it widens the brute-force window

Full version with the FAQ: SSH "Too many authentication failures".

Termius alternatives in 2026 (and the Termius vs Terminus mix-up)

chen zong — Wed, 19 Aug 2026 08:45:31 +0000

Originally published on termai.sh. Prices checked August 2026 — treat each vendor's own page as authoritative. Disclosure: TermAI is our app.

Why people look for a Termius alternative

Termius is a solid, mature SSH client, and most people searching for an alternative aren't unhappy with its quality. They're reacting to one of four things:

Price. Termius Pro is $10 per user per month billed annually (~$120/year); month-to-month costs more.
Sync is the paywall. The free Starter plan is generous — unlimited hosts, SFTP, port forwarding, AI autocomplete, commercial use allowed — but sync doesn't work on it. Your hosts and keys live on one device.
Desktop-first feel on a phone. Termius is one product stretched across five platforms; some people want something designed for a 6-inch screen.
Missing pieces. No built-in Tailscale, and the conversational AI Agent is still behind a beta.

First, a disambiguation: Terminus or Termius?

These get searched interchangeably and are not the same product:

Termius — the commercial cross-platform SSH client (formerly Server Auditor). This is what most people mean.
Terminus — the old name of Tabby, the open-source terminal by Eugeny. It renamed itself precisely because "Terminus" was too close to "Termius."
Terminus is also an unrelated B2B marketing platform and a Drupal/Pantheon CLI tool — if you see five-figure monthly pricing, that's the marketing company, not a terminal.

The 2026 comparison at a glance

Client	iOS	Android	Desktop	AI	Tailscale	Price (Aug 2026)
TermAI	Yes	Yes	No	Yes, native	Yes, built-in	Free tier; $2.99/mo
Termius	Yes	Yes	Yes	Yes, autocomplete (free)	No	Free tier; $10/mo annual
Blink Shell	Yes	No	No	No	No	$19.99/yr
Prompt 3	Yes	No	Yes (macOS)	No	No	$19.99/yr or $99 once
Termux	No	Yes	No	No	via package	Free, open source
ConnectBot	No	Yes	No	No	No	Free, open source
Tabby (ex-Terminus)	No	No	Yes	No	No	Free, open source

Short version: for the closest like-for-like at a lower price with AI and Tailscale built in on both iPhone and Android, TermAI is the most direct swap. Live entirely on one platform? A native-only app like Blink (iOS) may suit you better. Want desktop and open source? Tabby.

The full breakdown — Termius pricing math, the free-vs-paid tiers, and each alternative in detail — is in the complete guide: Termius alternatives in 2026.

What is an "AI terminal", really? The 4 steps every one shares

chen zong — Wed, 19 Aug 2026 01:41:59 +0000

What is an AI terminal?

An AI terminal is a command line with a language model built in: you describe what you want in plain English and it writes the command, explains the error you just hit, or suggests the next step — instead of you remembering exact flag syntax. Some go further and run the steps for you.

The short version for 2026: on a desktop, Warp is the leading AI terminal (free tier, paid plans from $20/mo). For AI that actually does the work in a repo, use an agentic CLI — Claude Code, OpenAI Codex CLI, aider, OpenCode or Goose — inside whatever terminal you already like. For private/offline use, run a local model with Ollama. And on a phone, where none of the above ship an app, TermAI puts an AI assistant in a mobile SSH terminal on iOS and Android.

The rest of this page is the map: what each kind is, what it costs today, what changed in 2026, and how to choose. Prices and limits below were checked in August 2026 — this category moves fast, so confirm on the vendor's own pricing page before you commit.

How an AI terminal actually works

Whatever the branding, nearly all of them are the same four steps:

You describe the goal in plain language — "find what's eating the disk", "why did nginx fail to reload".
The tool gathers context. This is the part that separates good from useless: the OS and shell, your recent commands and their output, sometimes the repo's file tree. A tool with no context guesses; a tool with context answers about your machine.
A model returns a command (or a patch, or a plan), usually with a one-line explanation of what it does.
You run it — by pressing enter, tapping Run, or approving an agent's proposed step. Whether that approval is required is the single biggest design difference between tools.

Two consequences worth knowing before you install anything. First, your terminal content becomes model input: whatever is on screen when you ask — hostnames, paths, sometimes secrets in a config you just cat'd — is what gets sent, unless you run the model locally. Second, a confident wrong command looks exactly like a right one. We wrote up how to tell them apart in can you trust AI shell suggestions?

The five kinds of AI terminal

Kind	Examples	Runs on	Best for
Desktop AI terminal	Warp, Wave Terminal, iTerm2 + AI plugin	Mac/Linux/Win	A modern daily-driver terminal with AI built in
Agentic CLI	Claude Code, Codex CLI, aider, OpenCode, Goose, Antigravity CLI	Mac/Linux/Win	Letting AI run multi-step tasks and edit code in a repo
Editor terminal + AI	Cursor, VS Code + Copilot	Desktop	AI beside your code, in the same window
Local-AI shell	Ollama + a shell helper	Mac/Linux/Win	Offline or privacy-sensitive work; nothing leaves the box
Mobile AI SSH client	TermAI	iOS / Android	AI in the terminal on a phone, over SSH

Most "best AI terminal" lists collapse the first two into one row, which is why their advice reads oddly — a terminal emulator with AI and an autonomous coding agent are not competitors. They stack: many people run Claude Code inside Warp. And none of the first four exist on a phone at all.

AI terminal comparison (August 2026)

Tool	Type	Platforms	Open source	Cost	Bring your own key
Warp	Desktop terminal + agents	macOS, Linux, Windows	❌	Free tier; Build $20/mo, Max $200/mo, Business $50/user/mo	✅ (all plans, incl. Free)
Wave Terminal	Desktop terminal + AI	macOS, Linux	✅ Apache-2.0	Free	✅
iTerm2 + AI plugin	Desktop terminal + AI	macOS	✅ terminal	Free (you pay the model)	✅ required
Claude Code	Agentic CLI	macOS, Linux, Windows	❌	Claude Pro $20/mo, Max $100/$200/mo, or API usage	✅ API billing
Codex CLI	Agentic CLI	macOS, Linux, Windows	✅	Included with ChatGPT plans, or API usage	✅
aider	Agentic CLI (git-native)	macOS, Linux, Windows	✅	Free tool; you pay model usage	✅ required
OpenCode / Goose	Agentic CLI	macOS, Linux, Windows	✅	Free tool; you pay model usage	✅ required
Antigravity CLI (`agy`)	Agentic CLI	macOS, Linux, Windows	❌ (was open source as Gemini CLI)	Small free allowance; Google AI Pro/Ultra for real use	✅
Ollama + shell helper	Local-AI shell	macOS, Linux, Windows	✅	Free (your hardware)	n/a — model is local
TermAI	Mobile AI SSH client	iOS, Android	❌	Free tier includes AI (5 AI calls/day)	—

Desktop AI terminals (Warp, Wave, iTerm2)

Warp is the best-known AI terminal: a fast, modern terminal with block-based output, command suggestions, error explanations, and agent management in tabs. In 2026 it has grown into an agent platform — it can drive other CLI agents (Claude Code, Codex, and others) with vertical tabs, notifications and native code review. Pricing as of August 2026: a Free tier (core terminal features stay free on all three desktop platforms; AI is metered in credits — 150/mo for a new account's first two months, then 75/mo), Build at $20/mo, Max at $200/mo, Business at $50/user/mo, and Enterprise. Since May 2026 you can bring your own API key on every plan including Free, which effectively removes the credit ceiling if you already pay a model provider.

Two things people ask about Warp that lists usually skip. It requires an account to sign in. And it has no iOS or Android app — the closest thing is Warp's Remote Control, which publishes a running agent session to a link you can open in a phone browser to watch it and approve steps. That's monitoring a desktop session remotely, not a terminal on your phone: you can't open a fresh SSH connection to an arbitrary server from it. See Warp alternatives and Termius vs Warp.

Wave Terminal is the closest open-source answer to Warp: Apache-2.0 licensed, modern UI, inline rendering, persistent sessions, AI built in with your own key and no forced sign-in. iTerm2 takes the opposite approach on macOS — AI ships as a separate optional plugin, precisely so a stock install can't send terminal contents over the network. It's provider-agnostic (OpenAI, Anthropic, Gemini, DeepSeek) and can point at a self-hosted model with no API key at all; the features are a command generator and "Codecierge" step-by-step guidance.

Agentic CLIs (Claude Code, Codex, aider, OpenCode, Goose)

These don't replace your terminal — they run inside it. You give a goal, and the tool runs a sequence of commands and edits to accomplish it, checking in as it goes.

Claude Code — the deepest at multi-file work and long plans in a repo. It's not sold standalone: it draws on your Claude plan (Pro $20/mo, Max $100/mo or $200/mo) or on API pay-as-you-go. Best when you want one strong model doing sustained work.
OpenAI Codex CLI — open source, with the strongest sandboxing story of the group and the easiest CI/CD integration. Included with ChatGPT plans or billed via API. Pick it if "what exactly is this thing allowed to touch" is your first question.
aider — open source, git-native: every edit becomes a commit, and it builds a repo map for context. The oldest and most predictable of the bunch; you bring your own API key and can point it at almost any model.
OpenCode and Goose — open source, model-agnostic agents. Goose (from Block) runs on-machine and leans on extensions/MCP for tools. Both are good fits if you want no vendor lock-in on the model.
Antigravity CLI (agy) — Google retired Gemini CLI on June 18, 2026 and replaced it with Antigravity CLI, a closed-source Go binary with async multi-agent workflows. If you're following a tutorial that promises Gemini CLI's old 1,000-requests-a-day free tier, that's gone; the current free allowance is a small shared pool and serious use expects a Google AI Pro/Ultra subscription. Check Google's live quota page before planning around it.

The trade-off with all of them is autonomy: handing a loop of shell commands to a model is exactly as powerful and as risky as it sounds. Use sandboxes or approval modes, and prefer a repo under version control. More on this in AI agents in the terminal.

Local-AI shells (Ollama, private and offline)

If the content of your terminal can't leave the machine — regulated environments, client servers, air-gapped boxes, or just personal preference — run the model locally. Ollama pulls an open-weights model and serves it on localhost; a small shell helper turns "what's using port 8080" into a command against it. Nothing is sent anywhere.

Honest costs: local models are meaningfully weaker than hosted frontier models at shell reasoning, a useful model wants real RAM/VRAM, and you own the setup. But for sensitive work the trade is often worth it, and iTerm2's plugin plus several agentic CLIs will happily point at a local endpoint. Walkthrough: running an AI shell with Ollama.

Free and open-source AI terminals

"Free" splits into three different things, and it's worth knowing which one you're getting:

Free tool, you pay the model — aider, OpenCode, Goose, iTerm2's plugin. No subscription, but you need an API key and the meter runs per token. This is the cheapest option for light use and the most expensive for heavy use.
Free tier of a paid product — Warp's Free plan (metered AI credits, or unlimited-ish with your own key), TermAI's free tier (5 AI calls a day on iOS and Android). Fine for occasional use; the ceiling is the point.
Free and local — Ollama plus a shell helper. No account, no key, no meter, no network. You pay in setup time and model quality.

Fully open-source stack, if that's the requirement: Wave Terminal (terminal) + aider or OpenCode (agent) + Ollama (model). Nothing proprietary anywhere in the chain.

The mobile gap: an AI terminal on a phone

Every option above assumes a desktop. Warp, Wave, iTerm2, Claude Code, Codex CLI, aider — none of them ship a phone app. Yet a phone is arguably where an AI terminal helps most: you're away from your desk, typing is painful, a flag you use twice a year is impossible to recall, and something is down now.

That's the gap TermAI fills: an SSH client for iOS and Android with an AI assistant built into the terminal. Describe the task and it suggests the command, grounded in the live server — it reads the OS, current disk/memory/CPU, and recent output — then you tap Run, with a confirmation before anything destructive executes. AI is included on the free tier (5 calls a day). See AI SSH clients explained.

The practical pattern is not "replace my desktop terminal" — it's reach the desktop from the phone. SSH from TermAI into the same Mac or Linux box where you'd normally open Warp, and let the AI help you there. TermAI has Tailscale built in, so the target machine doesn't need to be exposed to the public internet.

Safety: what to check before you let one run commands

Does it require approval? Assistant-style tools (Warp's suggestions, TermAI, iTerm2's generator) propose and wait. Agentic tools run loops — check the default approval mode before pointing one at a production box.
What gets sent? Terminal scrollback often contains hostnames, IPs, tokens from a config you displayed. If that's unacceptable, that's the argument for a local model.
Destructive-command guardrails. rm -rf, dd, mkfs, chmod -R, force-pushes and DROP TABLE deserve an explicit confirm step. Tools differ a lot here.
Sandbox and blast radius. Codex CLI's sandboxing, containers, or simply a repo under git are what make a bad step recoverable.
Read before you run. A model that doesn't know your fstab will still write a confident mount command. Details in can you trust AI shell suggestions?

How to pick

Desktop daily driver with AI built in → Warp (Wave Terminal if you need open source and no account)
AI that runs multi-step coding tasks → Claude Code for depth, Codex CLI for sandboxing, aider for git discipline
No vendor lock-in on the model → aider, OpenCode or Goose with your own key
Private, offline, or regulated → Ollama + a shell helper (or iTerm2 pointed at a local model)
macOS, and you don't want AI in the binary by default → iTerm2, plugin installed only if you want it
Server admin work, not coding → an assistant that explains and confirms beats an agent that acts — see AI for sysadmins
AI in the terminal on a phone, over SSH → TermAI (nothing else on this list has a mobile app)

FAQ

What is the best AI terminal in 2026?

On a desktop, Warp is the leading AI terminal. For autonomous coding work, an agentic CLI — Claude Code for depth, Codex CLI for sandboxing, aider for git-native edits. For private/offline use, Ollama with a shell helper. On a phone over SSH, TermAI. They serve different places you work, and many people use two of them together.

Is there an AI terminal for mobile?

Yes — TermAI is a mobile SSH client with an AI assistant built into the terminal, on iOS and Android, with AI included on the free tier. Warp, Wave, iTerm2, Claude Code and Codex CLI are all desktop-only.

Does Warp have a phone app?

No. Warp runs on macOS, Linux and Windows. Its Remote Control feature publishes a running agent session to a link you can open in a mobile browser to watch and approve steps, but that monitors a desktop session — it isn't a terminal you can SSH from.

Is there a free AI terminal?

Several. Warp has a free tier with metered AI credits (150/mo for the first two months of a new account, then 75/mo) and supports your own API key on the free plan. Wave Terminal, aider, OpenCode, Goose and Codex CLI are free/open-source tools where you pay only for model usage. Ollama is free and local. TermAI's free tier includes 5 AI calls a day on mobile.

What is the best open-source AI terminal?

Wave Terminal (Apache-2.0) is the closest open-source equivalent to Warp. For agents, aider, OpenCode and Goose are open source, and Codex CLI is too. A fully open stack: Wave + aider + Ollama.

Can an AI terminal run commands by itself?

Agentic tools can, by design — that's the product. Assistant-style terminals like TermAI suggest a command and require you to tap Run, with an extra confirmation before destructive ones. Check the default approval mode of any agent before running it on a machine that matters.

What happened to Gemini CLI?

Google retired it on June 18, 2026 and replaced it with Antigravity CLI (the agy binary), a closed-source Go rewrite. The generous old free tier of 1,000 requests a day is gone; real use now expects a Google AI Pro/Ultra subscription, so verify current quotas before building anything around it.

Is an AI terminal the same as an AI SSH client?

No. An AI terminal is a local shell with a model attached. An AI SSH client manages saved hosts and keys, connects to remote servers, and puts the AI in that session — so its answers are grounded in the remote machine's state, not your laptop's. Warp is the former; TermAI is the latter.

Does an AI terminal work offline?

Only the local-model kind. Ollama-based setups (and iTerm2 or aider pointed at a local endpoint) work with no network. Everything hosted — Warp's AI, Claude Code, Codex CLI, Antigravity — needs a connection.

Is it safe to use an AI terminal on a production server?

With care. Prefer a tool that requires approval per command over one that runs autonomously, keep destructive-command confirmations on, assume whatever is on screen is sent to the model unless it's running locally, and read the command before you approve it.

Which AI terminal is best for sysadmins rather than developers?

Sysadmin work is usually one careful command at a time on a remote box, not a repo refactor — so an assistant that explains and confirms fits better than an autonomous agent. Warp on the desktop, TermAI on a phone, or a local Ollama helper where the output can't leave the machine.

Quick Facts

AI terminal = a command line with an LLM that turns plain language into commands
Desktop: Warp (free tier; Build $20/mo, Max $200/mo) · open-source: Wave Terminal
Agentic coding: Claude Code (via Claude Pro $20 / Max $100–$200) · Codex CLI · aider · OpenCode · Goose
Gemini CLI was retired June 18, 2026 → Antigravity CLI (agy), closed source, much smaller free tier
Local/private: Ollama + a shell helper — offline, nothing sent anywhere
Mobile (over SSH): TermAI on iOS + Android — AI on the free tier, grounded in the live server, confirm before destructive
Pick by where you work: desktop, editor, remote server, or phone. Prices checked August 2026.

Warp terminal alternatives in 2026 (and 2 outdated reasons to switch)

chen zong — Wed, 19 Aug 2026 01:37:20 +0000

The short answer

Warp is an excellent AI terminal — and in 2026 it's a different product than most "Warp alternative" articles describe. Two of the old complaints are gone: Warp no longer forces you to log in (that changed in November 2024) and the terminal client is now open source (AGPL-3.0, since April 2026). So pick your alternative for a reason that's still true today:

You want an AI terminal on your phone → TermAI. This is the one gap Warp still doesn't fill — there is no Warp app for iOS or Android.
You want a free, open-source terminal with AI and your own API key → Wave Terminal (Apache-2.0, no credits, bring your own model).
You just want a fast, lean terminal on a Mac → Ghostty (MIT, native, no telemetry) or iTerm2.
You want AI that does the work, not just suggests it → an agentic CLI like Claude Code or aider.
You want SSH with saved hosts and keys → a real SSH client, not a terminal emulator. Warp isn't one.

The rest of this page covers each of those in detail, including what's free, what's open source, what runs on a Mac, and what's genuinely "Warp-like."

What changed in 2026 (most articles get this wrong)

If you're reading a Warp comparison written before mid-2026, two of its main arguments are out of date. Worth knowing before you switch off Warp for a reason that no longer applies:

Warp is open source now. On April 28, 2026, Warp open-sourced its terminal client under AGPL-3.0 (its UI framework is MIT), and rebranded itself an "agentic development environment." OpenAI signed on as a founding sponsor. So "Warp is closed source" is no longer a reason to leave.
Warp doesn't require an account. Warp lifted the login requirement on November 22, 2024. You can download it and use the core terminal without signing up — though some cloud and AI features are still gated behind an account.
What's still proprietary: the client is open, but Warp's cloud side — Oz, its agent-orchestration platform — remains closed. If your objection is "my sessions and prompts shouldn't touch a vendor's cloud," that objection survives; open-sourcing the client didn't change it.
What still doesn't exist: a Warp mobile app. See the mobile section — this remains the single largest hole in Warp's coverage.

Note also that AGPL-3.0 is strong copyleft. For most individuals that's irrelevant, but if you plan to fork and redistribute Warp — or offer it over a network — you inherit obligations that MIT-licensed options like Ghostty or Apache-2.0 options like Wave Terminal don't impose.

Warp alternatives at a glance

Tool	Platform	AI	License	Price
TermAI	iOS + Android	✅ in terminal	Proprietary	Free tier; Pro $2.99/mo
Wave Terminal	Mac/Linux/Win	✅ bring your own key	Apache-2.0	Free
Ghostty	Mac/Linux	❌	MIT	Free
Kitty	Mac/Linux/BSD	❌	GPLv3	Free
WezTerm	Mac/Linux/Win	❌	MIT	Free
Alacritty	Mac/Linux/Win	❌	Apache-2.0	Free
Tabby	Mac/Linux/Win	❌	MIT	Free
iTerm2	macOS only	❌ (plugin)	GPLv2	Free
Warp	Mac/Linux/Win	✅ built-in	AGPL-3.0 (client)	Free tier; paid plans

The thing people most often want that Warp still doesn't offer is a mobile version — none exists. TermAI covers that. For everything else, the open-source desktop field is unusually strong in 2026.

Why people look for a Warp alternative

Filtering out the reasons that are no longer true, here's what actually drives the search in 2026:

No mobile app. Warp runs on macOS, Linux, and Windows — there's nothing for iOS or Android. This is the most common reason, and the one with no workaround inside Warp itself.
AI usage is metered. Warp's AI runs on a credit system, and the free allowance is modest. If you use AI heavily, you either pay or you pick a tool where you bring your own API key and pay the model provider directly.
The cloud side is still closed. Open-sourcing the client didn't open Oz. Privacy-sensitive users who don't want prompts or session data leaving the machine still want a local-AI or no-AI option.
You want SSH, not a terminal emulator. Warp has no saved-host list and no key manager. See below.
You just want a fast terminal. Sometimes you don't need AI at all — you want a lean, instant-start terminal. Ghostty and Alacritty start faster and use less memory than a feature-heavy AI terminal.
Copyleft. AGPL-3.0 is fine to use, but it's a constraint if you intend to fork and ship.

What makes a terminal "Warp-like"?

People searching for a "terminal like Warp" usually aren't asking for a terminal emulator in general — they want a specific set of modern features that Warp popularized. Those are:

Blocks. Each command and its output grouped into a discrete, selectable, shareable unit instead of one endless scrollback.
A real text editor at the prompt. Cursor movement, selection, and multi-line editing that behave like a normal input box rather than readline.
AI in the terminal. Describe what you want, get a command back — without alt-tabbing to a browser.
A command palette and modern UI. Searchable actions, themes, and a GUI that doesn't feel like 1995.

Which alternatives are genuinely Warp-like by that definition:

Wave Terminal — the closest match on the desktop. Command blocks, built-in AI, modern UI, open source. If "terminal like Warp" is your search, start here.
TermAI — the closest match on a phone: AI in the terminal with tap-to-run commands, which no desktop terminal gives you on mobile.
Ghostty / Kitty / WezTerm — modern and fast, but deliberately not Warp-like: no blocks, no AI, no GUI chrome. Great terminals, different philosophy.
Tabby — modern GUI and very customizable, but no blocks and no built-in AI.

If blocks specifically are what you're after and you don't want to leave your current terminal, note that they're a UI feature, not a shell feature — no plugin retrofits them onto Alacritty or Ghostty.

Free Warp alternatives

Warp itself has a free tier, but the AI on it is credit-limited. If "free" is the priority, these cost nothing at all and don't meter your usage:

Wave Terminal — completely free and open source. AI included, but you supply an API key (OpenAI, Claude, or Gemini) or point it at a local model via Ollama or LM Studio. That means no credit limits: you pay the model provider directly, or nothing at all if you run local.
Ghostty, Kitty, WezTerm, Alacritty, Tabby — all free, all open source, no accounts, no metering. No built-in AI.
iTerm2 — free on macOS, and the long-standing default for Mac users who want more than Terminal.app.
TermAI — has a free tier on mobile; Pro is $2.99/mo.

The catch to watch for: "free terminal with AI" almost always means one of two things — free client with metered AI credits (Warp), or free client where you bring and pay for your own model (Wave, and most agentic CLIs). Genuinely free AI usually means running a local model, which is private and unmetered but noticeably weaker than a frontier model.

Open-source Warp alternatives

This is the section that changed most in 2026. Warp's terminal client is itself open source now (AGPL-3.0, April 2026), so if open source was your only objection, you may not need an alternative at all. If you still want one — because you want a permissive license, or because you don't want the proprietary cloud side — these are fully open:

Wave Terminal (Apache-2.0) — the closest open-source equivalent to what Warp does: modern terminal, command blocks, built-in AI with your own key, and no proprietary cloud in the middle. Version 0.14 added durable SSH sessions that survive network drops and reconnect automatically, plus a graphical editor for remote files. Actively developed.
Ghostty (MIT) — GPU-accelerated, written in Zig, no VC money, no ads, no telemetry. Since December 2025 it's under Hack Club's 501(c)(3) as fiscal sponsor, which is a real signal about its long-term independence.
WezTerm (MIT) — configured in Lua, with built-in multiplexing (panes, tabs, remote domains). The most capable option if you want one tool that does everything, everywhere.
Alacritty (Apache-2.0) — the minimalist. No tabs, no splits, no multiplexing by design; pair it with tmux.
Kitty (GPLv3) — GPU-accelerated and feature-rich, with its own graphics and kitten plugin protocols.
Tabby (MIT) — the most customizable GUI terminal, with a plugin ecosystem. It's Electron-based, so it uses more memory and has more input latency than the native options above.

License note if it matters to you: Warp's client is AGPL-3.0 (strong copyleft — network use triggers source obligations), Kitty is GPLv3, iTerm2 is GPLv2, while Ghostty, WezTerm, and Tabby are MIT and Wave and Alacritty are Apache-2.0. For personal use any of these is fine; the distinction only bites if you fork and redistribute.

Warp alternatives for Mac

Warp started as a Mac-first app, so most people searching for a Mac alternative want the same polish without the AI metering or the cloud. On macOS specifically:

Ghostty — the strongest default for most Mac users in 2026. Native macOS UI, GPU-accelerated, near-instant startup, sensible defaults so it works well before you configure anything. MIT-licensed and telemetry-free.
iTerm2 — the veteran. Split panes, search, triggers, profiles, and a decade of accumulated features. Heavier than Ghostty and the UI shows its age, but nothing beats it on sheer feature depth.
Kitty — if you want GPU speed plus scriptability and don't mind configuring a text file.
WezTerm — best pick if you also use Linux or Windows and want one identical config across all three.
Alacritty — if you already live in tmux and want the fastest, most boring possible window around it.
Wave Terminal — if you want to keep an AI assistant in the terminal on your Mac without the credit system.
Terminal.app — worth remembering that macOS ships a perfectly usable terminal. If Warp felt like too much, the built-in one may be enough.

Note that Apple Silicon builds are standard across all of these now — none of them require Rosetta.

Is Warp an SSH client?

Not really — and this trips up a lot of "warp ssh client" searches. Warp is a terminal emulator: you can type ssh user@host inside it just like any terminal, but it has no saved-host list, no key manager, and no tap-to-connect. It's built for working on your local machine, not for managing a set of remote servers. If SSH is the main thing you want — especially from a phone — you want a purpose-built SSH client. On mobile that's TermAI (saved hosts, on-device keys, built-in Tailscale, plus the same in-terminal AI); on the desktop, pair a terminal like Ghostty or Tabby with OpenSSH and an ~/.ssh/config, or use a dedicated SSH client.

One genuinely useful middle ground: Wave Terminal's durable SSH sessions reconnect automatically after a network drop, which is the closest a desktop terminal gets to SSH-client behavior without being one.

If you want AI in a terminal on your phone → TermAI

This is the gap Warp doesn't fill at all. TermAI is a mobile SSH client with an AI assistant built into the terminal: describe a task and it suggests the command, grounded in the live server (it reads the OS, the current disk/memory/CPU, and recent output), with a confirmation before anything destructive runs. It also has built-in Tailscale, and it's on both iOS and Android. If "Warp alternative" really means "I want the Warp experience on my phone," this is it.

The workflow that replaces desktop Warp on the go: SSH from TermAI into the same Mac or Linux box where you'd normally open Warp, and let the AI help you there — from your phone, over the network. With built-in Tailscale you can reach that machine even when it's not on the public internet. New to it? The visual getting-started guide walks through the first connection.

What about Warp on the web?

To be fair to Warp, there is a partial mobile story, and it's worth understanding before you decide. Warp's /remote control feature publishes a running agent session to Warp's cloud, and Warp on the web renders in mobile browsers (iOS Safari 15+, Android Chrome 58+, Samsung Internet 7.2+) with touch gestures for scrolling, selection, and context menus. So you can monitor and steer an agent from your phone.

What that is not: a mobile terminal. It requires a desktop Warp session already running somewhere, it routes through Warp's proprietary cloud, and it gives you no saved hosts, no on-device SSH keys, and no way to open a fresh connection to an arbitrary server from your phone. If you want to start a session from the phone — to a VPS, a home server, a Raspberry Pi — you need an actual mobile SSH client.

If you want a free/open-source desktop terminal

Wave Terminal — the closest open-source Warp equivalent: a modern terminal with built-in AI, free, Apache-2.0, no metering (you bring your own API key, or run Ollama/LM Studio locally). If you like Warp's idea but not the credits, start here.
Ghostty — fast, native, MIT-licensed, works well out of the box. The best "just give me a great terminal" pick in 2026. See Termius vs Ghostty for how a terminal emulator compares to an SSH client.
WezTerm — cross-platform, Lua-configured, with built-in multiplexing so you may not need tmux.
Alacritty — fast and minimal by design: no tabs, no splits, pair with tmux.
Kitty — GPU-accelerated with a rich feature set and its own plugin ("kitten") system.
Tabby — free, open-source, highly customizable, cross-platform. No built-in AI, and being Electron-based it's heavier than the native options. See Termius vs Tabby.
iTerm2 (macOS) — the long-standing free Mac terminal: split panes, search, triggers, and profiles, rock-solid and no AI.

Warp alternatives with AI

If the AI is the specific thing you want to keep, there are three different shapes it comes in — and picking the right shape matters more than picking the right brand:

AI inside the terminal UI (Warp, Wave Terminal, TermAI) — you describe a task, it suggests a command, you review and run. Best when you want to stay in control and learn the commands. Wave is the desktop open-source version of this; TermAI is the mobile version.
Agentic CLI (Claude Code, aider) — instead of suggesting commands, these run multi-step tasks in your project: reading files, editing code, running tests, iterating. Better when you want the AI to do the work rather than advise. They're just programs, so they run inside any terminal — Ghostty, Alacritty, iTerm2, whatever you like. This is the combination a lot of people land on: a fast, boring terminal plus a strong agent in it.
Local AI (Ollama or LM Studio, plus a shell helper or Wave's local-model support) — everything stays on your machine, offline and private, with no credits and no account. The trade-off is a weaker model than a frontier one.

A useful thing to realize: because agentic CLIs are ordinary command-line programs, "an AI terminal" and "a terminal plus AI" are nearly interchangeable on the desktop. The place that isn't true is mobile, where you can't just install a CLI — which is why an app with AI built in matters more there. For the full landscape, see the best AI terminal tools in 2026.

How to pick

AI terminal on a phone → TermAI (Warp has no mobile app)
Open-source terminal with AI, no metering → Wave Terminal
Best all-round Mac terminal → Ghostty (or iTerm2 for maximum features)
One config across Mac, Linux, and Windows → WezTerm
Fast & minimal, you already use tmux → Alacritty
Maximum customization / plugins → Tabby or Kitty
AI that runs tasks → Claude Code / aider, inside any terminal you like
Private / offline AI → Ollama or LM Studio, with Wave or a shell helper
Saved hosts and SSH keys → a real SSH client, not a terminal emulator

FAQ

What is the best Warp terminal alternative?

It depends on what you're replacing. For the same modern-terminal-with-AI experience, free and open source, it's Wave Terminal. For a fast, lean Mac terminal, it's Ghostty. For an AI terminal on a phone — the one thing Warp doesn't do at all — it's TermAI. For AI that does the work rather than suggesting it, an agentic CLI like Claude Code inside any terminal.

Is there an open-source Warp alternative?

Yes, several — though note that Warp itself became open source in April 2026, with its terminal client under AGPL-3.0 and its UI framework under MIT. If you still want an alternative, Wave Terminal (Apache-2.0) is the closest in features, and Ghostty (MIT), WezTerm (MIT), Alacritty (Apache-2.0), Kitty (GPLv3), and Tabby (MIT) are fully open terminals without built-in AI. The one part of Warp that remains proprietary is Oz, its cloud agent-orchestration platform.

Is Warp terminal open source?

The client is, as of April 28, 2026, under AGPL-3.0 (with the UI framework under MIT). The cloud side — Oz — is not. So "Warp is open source" is true of the app on your machine and not true of the service behind it.

What's a free alternative to Warp?

Wave Terminal is free and open source with AI included (you supply an API key, or run a local model via Ollama). Ghostty, Kitty, WezTerm, Alacritty, and Tabby are free with no AI. iTerm2 is free on macOS. TermAI has a free tier on mobile. Warp also has its own free tier, but its AI is limited by a monthly credit allowance.

Is there a terminal like Warp?

Wave Terminal is the closest on the desktop: it has command blocks, a modern UI, and built-in AI, and it's open source. On a phone, TermAI is the closest equivalent. Ghostty, Kitty, and WezTerm are excellent modern terminals but deliberately skip blocks and AI, so they feel quite different from Warp.

Is there a Warp alternative with AI?

Yes. Wave Terminal has AI built in and works with OpenAI, Claude, Gemini, or local models through Ollama and LM Studio. TermAI has AI built into a mobile terminal. And any agentic CLI — Claude Code, aider — brings AI into whatever terminal you already use, which is how many people get AI without switching terminals at all.

What's the best Warp alternative for Mac?

Ghostty for most people: native macOS feel, GPU-accelerated, fast startup, good defaults, MIT-licensed and telemetry-free. iTerm2 if you want maximum features and don't mind a heavier, older-looking app. Wave Terminal if you want to keep AI in the terminal. And macOS's built-in Terminal.app is genuinely fine if Warp felt like overkill.

Does Warp have a mobile app?

No. Warp is desktop-only (macOS, Linux, Windows) — there is no iOS or Android app. You can view and steer a running desktop agent session from a mobile browser via Warp's remote-control feature and Warp on the web, but you can't start a terminal session from your phone that way. For that, use a mobile SSH client such as TermAI.

Can I get Warp on my phone?

Not as an app. The closest is mirroring a desktop session into a mobile browser, which requires a desktop Warp already running and routes through Warp's cloud. To actually open a shell from your phone to a server, use TermAI and SSH into the machine where you'd otherwise run Warp.

Does Warp require an account?

Not anymore. Warp removed the login requirement on November 22, 2024 — you can install it and use the core terminal without signing up, choosing "Skip for now" at the prompt. Some AI and cloud features still require an account. If you want a terminal with no account prompt at all, Ghostty, Alacritty, WezTerm, Kitty, and Tabby never ask.

Is Warp free?

There's a free tier that includes the terminal plus a limited monthly allowance of AI credits, with paid plans above it for heavier AI use. Pricing and credit allowances have been revised more than once — check warp.dev/pricing for current numbers before deciding. If you want to avoid metering entirely, use a tool where you bring your own API key, such as Wave Terminal.

Is Warp an SSH client?

No. Warp is a terminal emulator — you can run the ssh command inside it, but it has no saved-host list or key manager. For a real SSH client, use a dedicated app: TermAI on mobile, or a desktop client paired with OpenSSH.

What's the difference between Warp and a normal terminal?

Warp adds blocks (each command and its output as a discrete unit), a modern text-editor-style input, a command palette, and built-in AI. A classic terminal emulator like Alacritty or Ghostty gives you one continuous scrollback and a readline prompt, and leaves everything else to your shell and tmux. Neither is better in the abstract — Warp trades speed and simplicity for features.

Why is Warp slow / heavy compared to other terminals?

Warp does much more per frame than a minimal terminal: block tracking, a rich input editor, and AI integration all cost memory and startup time. Native GPU terminals like Ghostty, Kitty, and Alacritty do far less by design, which is exactly why they start instantly. If raw responsiveness is what you're after, that's the trade you're making.

Quick Facts

Warp in 2026: client open source (AGPL-3.0, April 2026), no login required (since Nov 2024), cloud/Oz still proprietary
Warp's remaining gap: no iOS or Android app — mobile browser mirroring only
On a phone: TermAI (AI terminal over SSH, saved hosts, on-device keys)
Closest open-source equal: Wave Terminal (Apache-2.0, bring your own AI key)
Best on a Mac: Ghostty (MIT) · Most features: iTerm2 · Minimal: Alacritty
AI that acts: Claude Code / aider, in any terminal · Local/private: Ollama, LM Studio

The best Android SSH client in 2026, honestly compared

chen zong — Wed, 19 Aug 2026 01:19:37 +0000

The short answer

The best SSH client for Android in 2026 is TermAI for most people — it's phone-first, has an AI assistant that suggests commands you confirm before running, and includes Tailscale so you can reach servers behind a home router without a second VPN app. Termius is the pick if you need the same host list on a desktop. ConnectBot is the pick if you want free, open source, and no account. Termux isn't an SSH client at all — it's a Linux environment on the phone. And JuiceSSH, the app that used to win this list, is no longer an option: it was unpublished from Google Play in December 2025 and can't be installed by new users.

Pick in one line:

Best Android SSH client overall — TermAI (free tier; AI + built-in Tailscale)
Best free SSH app for Android — ConnectBot (open source, no account) or TermAI's free tier if you want SFTP and AI
Best for desktop + phone sync — Termius (sync is the paid feature)
Best Android terminal (not an SSH client) — Termux, from F-Droid or GitHub
Came from Windows looking for PuTTY — there is no Android PuTTY; use TermAI or ConnectBot

"Android SSH client", "SSH client for Android", "Android SSH app", and "Android SSH terminal" are the same search with different wording — this page covers them all. Disclosure: TermAI is our own app; prices and status for every app below were re-checked against store listings and release history for 2026.

Android SSH apps at a glance (2026)

App	Price (2026)	Type	Status	Stands out for
TermAI	Free tier; Pro $2.99/mo; Team $7.99/seat/mo	SSH + SFTP client	Active	AI assistant, built-in Tailscale, same app on iOS
Termius	Free Starter; Pro $10/user/mo billed annually	SSH + SFTP client	Active	Cross-platform sync with desktop
ConnectBot	Free, open source	SSH client	Active (1.10.x shipped in 2026)	No account, no cloud, minimal surface
Termux	Free, open source	Local Linux environment	Active (F-Droid/GitHub; Play build deprecated)	Running Linux tools on the phone itself
JuiceSSH	n/a — delisted	SSH client	Removed from Google Play, Dec 2025	Nothing anymore — don't start here

Termius Pro's $10/user/month is the annual-billing rate (~$120/year); month-to-month is meaningfully more. See Termius free vs paid for the full tier breakdown.

"Android SSH" means three different things — pick the right one

Most of the confusion in this category comes from three unrelated tools sharing one search term. Before comparing apps, work out which one you actually want:

An SSH client — connects out from your phone to a remote server (a VPS, a Raspberry Pi, a NAS). This is what 90% of people mean, and it's what TermAI, Termius, ConnectBot, and JuiceSSH were.
A terminal emulator / local shell — gives you a Linux shell running on the phone, with no server involved. That's Termux. You can type ssh inside it, but you get no host list, no key manager, no tap-to-connect.
An SSH server — lets another machine connect into your Android device. That's a separate setup, covered further down.

If you want to restart a service on a server from your phone, you want an SSH client. Everything in the next five sections is judged on that job.

TermAI — best overall in 2026

TermAI is an AI-native SSH client: describe what you want in plain English and it writes the command onto your input line, explains errors, and stays grounded in your session — you read and confirm before anything runs, and destructive commands take an extra confirmation. It also has built-in Tailscale (reach private servers with no separate VPN app and no port forwarding) and the same app on iOS, which matters if you carry both.

The free tier is unlimited SSH and SFTP plus 5 AI requests a day; Pro is $2.99/month and Team is $7.99/seat/month. The design choice worth knowing about is that the assistant is suggest-and-confirm by default, not an agent that executes on your behalf — on a 6-inch screen against a production box, that's the right default, and we argued it out in letting AI run shell commands on mobile, safely.

Best for: anyone who wants command help, SFTP, and a modern, actively-developed Android app.

Trade-off: mobile-only — there's no desktop client, so if you want one host list shared with a laptop, that's Termius's job.

Termius — best cross-platform sync

Termius is polished and syncs hosts, keys, and snippets across Android, iOS, and desktop. If you bounce between a phone and a laptop, that's the appeal — and it's the one thing no phone-first client can match.

The 2026 pricing picture is better than its reputation suggests: the free Starter plan includes SSH, SFTP, port forwarding, AI autocomplete, and a local vault, and Termius explicitly permits commercial use on it. What Starter withholds is synchronization — on the free plan your hosts and keys live on one device only. Paid tiers are Pro at $10/user/month billed annually (~$120/year), Team at $20, and Business at $30, with monthly billing priced higher. So on Android alone, free Termius is a capable client; you're paying for the laptop half.

Best for: people who want one client and one host list across phone and desktop.

Trade-off: sync requires an account and a subscription; the mobile app carries the weight of a desktop-first product. Weighing it against TermAI specifically? See TermAI vs Termius and Termius free vs paid.

ConnectBot — best free & open source Android SSH client

ConnectBot is the original Android SSH client and still the answer when the requirement is "free, open source, no account, no cloud." It's plain — a dated UI, no SFTP, no sync, no AI — but it's genuinely free with no tiers, it asks nothing of you, and it's still being released: the 1.10.x line shipped through 2026, which is more than most apps in this category can say.

The honest limitation is file transfer. ConnectBot does SSH sessions and tunnels, not SFTP, so "edit a config file from my phone" means nano over the session rather than pulling the file down. If that's a dealbreaker, TermAI's free tier includes SFTP and Termius Starter does too. Deciding between it and Termius? See Termius vs ConnectBot.

Best for: minimalists, privacy-first users, and anyone who wants zero accounts.

Trade-off: no SFTP, no sync, no modern conveniences.

Termux — a Linux terminal, not an SSH client

Termux comes up in every "best SSH app for Android" search, so it's worth being precise: it's a local Linux environment on your phone, not an SSH connection manager. You can pkg install openssh and run ssh user@host inside it, but there's no saved-host list, no key manager, no tap-to-connect, and no touch-friendly key row for the things a phone keyboard lacks. It's a package manager and a shell, and that's genuinely excellent when that's what you want — rsync, tmux, git, Python, all on-device.

Install it from the right place. This trips people up constantly: the official release channels are F-Droid and GitHub, and the Google Play build is deprecated — it exists, but with missing functionality compared to the F-Droid build. Because the two are signed with different keys, you can't update across them; switching means uninstalling Termux and all its plugin apps first. If you installed Termux from Play years ago and it feels broken, that's usually why.

More in Termius vs Termux, ConnectBot vs Termux, and running Linux on Android.

JuiceSSH — removed from the Play Store, don't start here

This is the biggest change to the Android SSH landscape since we first wrote this page, and most comparison articles still haven't caught up. JuiceSSH was unpublished from Google Play in December 2025 (11 December, per AppBrain's tracking — neither Sonelli nor Google issued a statement). It wasn't removed for anything it did; it was removed for what it stopped doing. Its last release was v3.2.2 on 4 February 2021, and Google Play requires apps to keep targeting a recent Android API level to stay listed. Four years of silence made that impossible.

Two consequences matter if you're reading this list to choose an app:

You can't install it. The listing is gone, so it won't appear in Play search. Users who had it before removal may still find it under "My apps," but that isn't something to build on.
The Pro licence check broke. Users have reported since December 2025 that Pro purchases made before that date stopped being recognised, with support unresponsive. The likeliest explanation discussed publicly is infrastructure rot rather than anything deliberate — the effect on you is the same.

Sideloading the APK from a mirror is a bad trade specifically because of what this app is: a 2021 binary with 2021 crypto, from an unverified source, holding the private keys to your servers. If you're still on it, the migration order matters — add your new key to authorized_keys before revoking the old one, or you'll lock yourself out of a box you can only reach from your phone. Full walkthrough in JuiceSSH was removed from the Play Store, with the alternatives compared in Is JuiceSSH dead? and Termius vs JuiceSSH.

Best for: nobody, in 2026.

Trade-off: not installable, not maintained, not patched.

What about PuTTY for Android?

A lot of people arrive from Windows searching for "PuTTY for Android" — but there is no official PuTTY for Android. PuTTY is a Windows desktop program; the third-party "PuTTY" apps in the Play Store are unrelated repackages by other developers, and an SSH client is a bad place to trust an unknown publisher. On Android you want a purpose-built mobile client instead: TermAI, ConnectBot, or Termius all do what you came for, with a proper host list and touch-friendly keys.

The habits transfer more than you'd expect — saved sessions become saved hosts, and your .ppk key can be converted to OpenSSH format before importing. We go deeper in PuTTY for Android & iPhone.

Apps you'll see recommended that aren't Android options

Roundups mix platforms constantly. To save you a Play Store search that goes nowhere:

Blink Shell — iOS and iPadOS only. No Android build. (Blink vs Termius.)
Prompt — iOS and iPadOS only, from Panic.
PuTTY, MobaXterm, Tabby, Warp — desktop programs. None has an Android client.
"Server Auditor" — this is just Termius's old name; you'll still see it in older articles.
"Terminus" — a common misspelling of Termius, and also the former name of the Tabby desktop terminal. Different things.

How to SSH from Android, step by step

Whichever client you pick, the first connection is the same five steps and takes about five minutes. You need three things: the server's address, a username, and either a password or an SSH key.

Install a client and open it. With TermAI you don't need an account to make your first connection.
Add the connection — a label, the host (an IP like 192.0.2.10 or a name like pi.local), the port (22 unless you changed it), and your username (root, ubuntu, pi).
Choose password or key. Password is quickest to test with; a key is the right long-term answer. Generate one in the app and add its public half to the server's ~/.ssh/authorized_keys, or import an existing private key — it stays in the phone's secure keystore.
Connect and trust the host key. The first time, you'll be asked to accept the server's fingerprint. That's normal — it's how SSH pins the server's identity.
Learn the shortcut key row. Esc, Tab, Ctrl, and arrows are what make Ctrl+C, tab-completion, and vim usable on a touchscreen.

The full walkthrough with screenshots — including SSH from Android to a Raspberry Pi, to Windows via OpenSSH Server, and to a Mac — is in how to SSH from Android. If the connection won't go through, connection refused and the troubleshooting guide cover the usual causes.

What makes an Android SSH terminal actually usable

Feature lists don't tell you which app you'll still be using in a month. These are the things that decide it on a phone:

A dedicated key row. Esc, Tab, Ctrl, Alt, and arrows aren't on a stock Android keyboard. Without a persistent row, Ctrl+C and vim are effectively unavailable — this is the single biggest usability gap between clients.
Correct terminal emulation. You want real xterm-256color behaviour so htop, nano, tmux, and colour output render properly rather than smearing escape codes across the screen.
Selection and copy/paste that works with a finger. Long-press to select a block of error output, then copy it — or, in TermAI, hand that exact text to the assistant with Ask AI instead of retyping a stack trace into a search box.
Font size and pinch-to-zoom. 80 columns on a 6-inch screen is a real constraint; being able to zoom out for htop and back in to type matters more than it sounds.
Hardware keyboard support. If you ever pair a Bluetooth keyboard or dock the phone, the client should pass through Ctrl and Alt properly.

Android-specific things that actually matter

The "best" app on Android isn't only about features — it's about the things that break on a phone specifically:

Surviving backgrounding. This is the number-one Android SSH complaint, and it's a platform behaviour, not a bug in your app: Doze and App Standby defer background network activity, and Android 16 added a harsher Restricted bucket for apps you haven't opened in days. A good client keeps the session alive or reconnects cleanly when you switch away and back — TermAI auto-reconnects with retries rather than dropping you at a dead prompt. If sessions still die on your device, set the app's Battery usage → Unrestricted in Android's app settings; aggressive OEM battery managers (Xiaomi, Samsung, Huawei, OnePlus) are usually the real culprit.
Key import, not just key generation. You should be able to import or paste an existing ed25519 or RSA private key, not only create a new one. See Ed25519 vs RSA if you're choosing a key type, and copying a key to a server for the other half.
Where the private key is stored. Prefer a client that keeps keys in the Android keystore behind biometric unlock over one that keeps a plaintext file. Your phone is the device most likely to be lost.
Reaching private servers. Home-lab and work boxes usually aren't on the public internet, and port-forwarding 22 to the world is the wrong fix. TermAI has built-in Tailscale so you reach them directly with no second VPN app running in the background — or see accessing a home server from anywhere.
Agent forwarding & jump hosts. If you hop through a bastion to an internal server, check your pick supports the multi-hop flow (ProxyJump / agent forwarding) you need. If reaching internal boxes is the whole reason for the bastion, a mesh VPN removes the jump host in many setups.
Mobile networks drop. Switching Wi-Fi to LTE kills a plain TCP session. Auto-reconnect covers most of it; if you live on flaky connections, Mosh vs SSH explains the roaming-session alternative, and keeping a process running after disconnect is the fix for long jobs.

Running an SSH server on Android (connecting into your phone)

The reverse direction — SSH from a laptop into the phone — is a different job, and no SSH client does it. The standard route is Termux:

pkg update && pkg install openssh
sshd to start the server. It listens on port 8022, not 22, because Termux runs as a normal unprivileged user and can't claim a low port.
Get your username with whoami, then connect from the other machine with ssh -p 8022 user@phone-ip.
Key auth is the intended path — put your laptop's public key in ~/.ssh/authorized_keys on the phone. (passwd sets a password, but keys are the better answer for a device on a shared network.)
termux-wake-lock keeps it running when the screen sleeps.

This is genuinely useful for pulling files off the phone or scripting against it — and it's a good reminder that "Android SSH" splits into two completely different setups depending on which way the connection goes.

Best mobile SSH client (Android and iPhone)

If you carry both, the shortlist collapses fast, because most of this category is single-platform. TermAI and Termius are the two that ship the same client on Android and iOS — TermAI as a phone-first app with AI and Tailscale on a $2.99/month Pro tier, Termius as the mobile end of a desktop product with sync as the paid feature. Blink Shell and Prompt are iOS-only; ConnectBot and Termux are Android-only. For the iPhone-side view see the best SSH client for iPhone and the iPad roundup; for the cross-platform-including-desktop view, the best SSH client in 2026.

How to pick

Want AI help + SFTP + a modern app → TermAI
Need the same host list on a desktop → Termius
Free, open source, no account → ConnectBot
Free but you also want SFTP → TermAI free tier or Termius Starter
Run Linux on the phone itself → Termux, from F-Droid or GitHub (not an SSH client)
SSH into your phone → Termux's sshd on port 8022
Reaching a home server or a box behind NAT → a client with Tailscale built in
Came looking for PuTTY → there's no Android PuTTY; use TermAI or ConnectBot
Still on JuiceSSH → migrate now, rotating keys as you go

FAQ

What is the best SSH client for Android?

TermAI for most people in 2026 — it's built for the phone, has an AI assistant that suggests commands you confirm before running, includes SFTP on the free tier, and has Tailscale built in for servers behind a router. Choose Termius instead if you need desktop sync, or ConnectBot if you want free and open source with no account.

What's the best free SSH app for Android?

ConnectBot is fully free and open source with no tiers at all. TermAI's free tier adds SFTP and 5 AI requests a day, and Termius's free Starter plan includes SSH, SFTP, and port forwarding — with sync as the paid feature. All three are legitimate free options; the difference is what you get beyond a plain terminal.

Is JuiceSSH still available?

No. JuiceSSH was unpublished from Google Play in December 2025 after its last release in February 2021, and new users can't install it. Pro licence validation has also broken for many existing users. Migrate to TermAI, Termius, or ConnectBot — and rotate your keys while you do.

Is there a PuTTY for Android?

No official one — PuTTY is a Windows program, and the "PuTTY" apps on Play are unrelated third-party repackages. Use a native Android SSH client like TermAI or ConnectBot instead; you can convert a .ppk key to OpenSSH format and import it.

Which Android SSH app has AI?

TermAI is AI-native and includes the assistant on its free tier (5 requests/day). Termius includes AI autocomplete/command generation in its free Starter plan, with a separate conversational agent on a beta track. The design difference matters: TermAI suggests and waits for your confirmation rather than executing on your behalf.

How do I SSH from Android?

Install an SSH client, add a connection with the host, port 22, and your username, pick password or key authentication, then accept the server's host key on first connect. It takes about five minutes — the step-by-step guide has screenshots.

Is Termux an SSH client?

Not really. Termux is a Linux terminal environment on the phone; ssh is one command you can install inside it. There's no saved-host list, key manager, or tap-to-connect. Use Termux when you want Linux tools on-device, and an SSH client when you want to manage remote servers. Install it from F-Droid or GitHub — the Play Store build is deprecated.

Can I SSH into my Android phone?

Yes, but that's the reverse direction and needs a server, not a client. Install OpenSSH in Termux and run sshd; it listens on port 8022 because Termux can't bind a privileged port. Connect with ssh -p 8022 user@phone-ip.

Why does my SSH session disconnect when I switch apps?

Android's Doze and App Standby suspend background network activity, and Android 16 added a stricter Restricted bucket for apps you haven't opened recently; OEM battery managers are often more aggressive still. Set the app's battery usage to Unrestricted, and prefer a client that auto-reconnects. For long-running jobs, run them under tmux or screen so the work survives the disconnect entirely.

Does any Android SSH client support SFTP?

TermAI and Termius both include SFTP file transfer, on their free tiers. ConnectBot does not — it's sessions and tunnels only. If you need to move files rather than just run commands, that's the deciding factor.

Do I need root on my phone to use SSH?

No. Android SSH clients are ordinary apps and don't require root. Even running an SSH server via Termux doesn't need root — that's exactly why it uses port 8022 instead of 22.

What should I look for in an Android SSH client?

Saved hosts with private-key import, keys stored in the Android keystore behind biometric unlock, a special-keys row (Esc/Ctrl/Tab/arrows), sessions that survive backgrounding, SFTP, and — increasingly — an AI assistant and a way to reach machines behind NAT.

Is SSH on Android safe?

Yes, with the usual conditions: install only from official stores (an SSH client is the worst possible app to sideload), use keys rather than passwords, keep the key behind the device's biometric lock, and use a maintained app — an unpatched client is the actual risk, which is the whole lesson of the JuiceSSH story. More in SSH keys vs passwords.

Quick Facts

Topic: best SSH app / SSH client for Android in 2026
Best overall / AI-native: TermAI (free tier with SSH + SFTP and 5 AI requests/day, Pro $2.99/mo, built-in Tailscale, iOS too)
Best desktop sync: Termius (free Starter includes SSH/SFTP; Pro $10/user/mo annual, sync is the paywall)
Free & open source: ConnectBot (no SFTP; 1.10.x releases shipped in 2026)
No longer an option: JuiceSSH — unpublished from Google Play in December 2025, last release February 2021
Not an SSH client: Termux (local Linux environment; install from F-Droid or GitHub, Play build deprecated)
SSH into Android: Termux sshd, port 8022
PuTTY for Android: doesn't exist; use a native SSH client

SSH agent forwarding is a footgun. Use ProxyJump instead.

chen zong — Tue, 18 Aug 2026 14:50:55 +0000

You need to git pull on a server, or hop from a bastion to a box behind it, and your key only lives on your laptop. The advice you'll find is ssh -A — agent forwarding. It works, it feels clever, and it quietly hands every server you land on the ability to use your key as you. There's a better default that costs you nothing: ProxyJump.

Here's why forwarding is riskier than it looks, and the one-line replacement.

What agent forwarding actually does

Your SSH agent holds your private key and answers "sign this" challenges so the key never leaves your machine. Agent forwarding (-A) exposes that agent's socket on the remote server so the server can ask your agent to sign things — e.g. to authenticate you onward to a third box.

The catch: while you're connected, anyone with root on that server can use your agent too. They can't copy your key, but they don't need to — they can ask your agent to sign logins to every machine your key opens, as you, for as long as your session is up. On a shared or less-trusted box, that's your entire key's reach handed to whoever controls it.

# Don't reach for this by reflex:
ssh -A bastion

The better default: ProxyJump

Almost every reason people use -A is really "I need to reach box B through box A." ProxyJump does exactly that — but the connection to B is tunneled through A and authenticated from your laptop, so A never sees or touches your agent.

ssh -J bastion db-internal

Or make it permanent in ~/.ssh/config:

Host db-internal
    HostName 10.0.0.5
    ProxyJump bastion

Now ssh db-internal transparently hops through the bastion. Your key stays on your device, the bastion is just a pipe, and a compromised bastion can't impersonate you onward. Same convenience, none of the exposure.

"But I need git on the server"

The other big use of -A is running git pull (over SSH) on a remote host. Two safer options:

Deploy keys: a per-repo, read-only key that lives on the server. Scoped to one repo, revocable, and it can't be used to log in anywhere else.
Clone over HTTPS with a scoped token instead of SSH.

Both keep your personal key off the server entirely.

When forwarding is defensible

Forwarding isn't evil — it's just over-recommended. It's reasonable when you fully trust and control the intermediate host (your own hardened bastion, no other users) and only for the moment you need it. If you must, scope it hard:

Use ssh-add -c so the agent asks for confirmation on every use — you'll see it if a server tries to sign something behind your back.
Use ssh-add -t 300 to auto-expire keys from the agent.
Never forward to a shared, managed, or third-party server.

But "trusted, controlled, momentary" describes very few of the servers people forward to.

Doing this from a phone

On mobile the stakes are higher, not lower: the key should sit in the device's secure enclave, and you don't want a tapped-out -A reflex exposing it through some box you SSH'd into from a coffee shop. A good mobile client makes the safe path the easy one — saved ProxyJump hops per host, key in the enclave, biometric confirmation on use. That's the model I build into TermAI: the jump is a saved property of the host, so the safe hop is one tap and the footgun is never the default.

TL;DR

ssh -A forwards your agent, and any root on the remote can use your key as you while you're connected. You almost never need it — ssh -J bastion target (ProxyJump) reaches the same box while keeping your key on your laptop. For git on a server, use a scoped deploy key, not your personal key. Only forward to hosts you fully control, and if you do, add ssh-add -c and a timeout. On a phone, keep the key in the secure enclave and let saved jumps do the hopping.

Do you still use -A anywhere — and is the box on the other end really one you'd trust with your whole keyring?

SSH hardening: 3 changes do 90% of the work, the rest is theater

chen zong — Tue, 18 Aug 2026 13:49:23 +0000

Search "SSH hardening" and you get a 20-item checklist: change the port, disable protocol 1, set a login banner, tweak ciphers, install fail2ban, rate-limit, add 2FA, port-knock… Most of it is security theater — it feels productive and moves almost no risk. Three changes do the real work. Here they are, and why the popular ones don't matter.

The 3 that actually move risk

1. Keys only — turn off password auth

This is the whole ballgame. Password auth means your servers are exposed to credential-stuffing and brute force 24/7. Keys make that class of attack impossible.

# /etc/ssh/sshd_config
PasswordAuthentication no
PubkeyAuthentication yes

Add your public key to ~/.ssh/authorized_keys first, test a new session, then reload sshd. Do this one thing and you've closed the door most attacks come through.

2. No direct root login

Even with keys, don't let anyone log in straight as root. Log in as a normal user, sudo when needed — so every privileged action is attributable and a single leaked key isn't instant root.

PermitRootLogin no

3. Limit who can log in

Most boxes have one or two humans who should ever SSH in. Say so explicitly:

AllowUsers alice bob

Now an attacker needs a valid username too, and a forgotten service account can't be used as a door.

That's it. Keys-only + no-root + an allow-list closes the paths real attacks use. Reload and you're done:

sudo systemctl reload sshd

The theater (and why)

Changing the port (22 → 2222). Doesn't stop anyone — a scanner finds the new port in seconds. Its only effect is a quieter auth.log. That's a nice-to-have, not security. If you've done keys-only, the noise was already harmless.
fail2ban / rate-limiting. Great for log noise and password auth. But if you turned passwords off (#1), there's no password to brute-force — you're banning bots from a door that's already sealed. Defense in depth, not a load-bearing wall.
Fancy cipher/MAC tuning. Modern OpenSSH defaults are already strong. Hand-tweaking the cipher list mostly risks locking out a client while adding no real protection.
Login banners, protocol 1 disable. Protocol 1 has been dead for years; banners are legal cover, not defense.

None of these are wrong — they're just not where the risk is. Do them after the three that matter, if you like, not instead of.

Don't undo it all on your phone

The one place hardening quietly leaks: how you connect from mobile. A keys-only server is pointless if the private key is sitting in a synced note or a screenshot. On a phone the key should live in the secure enclave and unlock with biometrics — which is exactly how I built key handling into TermAI — but the rule holds for any client: the hardening on the server is only as good as where the key lives on the device.

TL;DR

Skip the 20-item checklist. Do three things: PasswordAuthentication no, PermitRootLogin no, AllowUsers <you>. That closes the paths attacks actually use. The port change and fail2ban are for a tidy log, not for security — do them last, or not at all. And keep your private key in your phone's secure enclave so none of it is wasted.

What's on your SSH hardening list that you'd defend as more than theater?

SSH keys on your phone: generate, import, and use them without leaking the private key

chen zong — Tue, 18 Aug 2026 08:05:41 +0000

Password SSH from a phone is a bad habit waiting to bite you: it's phishable, brute-forceable, and painful to type on a touch keyboard. Keys fix all three — but "just use keys" glosses over the part that actually trips people up on mobile: where the private key lives, and how it gets onto the phone without ever leaking.

Here's the practical version.

The one rule: the private key never travels as plaintext

A keypair is two halves. The public key is safe to hand out — you copy it to every server. The private key is the secret; if it leaks, anyone can log in as you. The whole game is keeping the private half from ever sitting somewhere insecure — a chat message, an email attachment, a synced Notes app, a screenshot.

That leads to two clean approaches on a phone. Pick one; don't mix.

Approach A — generate the key on the phone (best)

The private key is created on the device and never leaves it.

Generate a new Ed25519 key (ssh-keygen -t ed25519 is the desktop equivalent; a good mobile client does this in-app). Ed25519 over RSA: shorter, faster, modern.
Protect it with a passphrase. On a phone this is the difference between "lost phone = lost servers" and "lost phone = shrug."
Copy the public key to each server's ~/.ssh/authorized_keys (paste it, or use ssh-copy-id from a machine that already has access).
Store the private key in the phone's secure enclave / Keychain, not a plain file. A well-built client keeps it there and gates use behind Face ID / Touch ID.

Now the secret was born on the device, is encrypted at rest, and requires biometrics to use. That's the setup you want.

Approach B — import an existing key (only if you must)

If you already have a key on your laptop and genuinely need the same one on the phone, move it out of band and encrypted, never through a chat app or email:

Prefer an encrypted transfer your client supports (some import via QR from a paired desktop, or over an encrypted local channel).
If you must move a file, make sure it's a passphrase-protected private key, delete the intermediate copy afterward, and rotate it later if you're unsure where it went.
Honestly, generating a new per-device key (Approach A) and adding its public half to your servers is usually less risky than shuttling one private key around.

Two mistakes that quietly undo all of this

A key with no passphrase, synced to the cloud. iCloud/Google backups of an unprotected private key mean your servers are one account compromise away. Passphrase + secure-enclave storage avoids it.
Reusing one key everywhere with no way to revoke. Use a per-device key (laptop, phone, tablet each their own). Then losing one device = remove one public key line from authorized_keys, not re-key everything.

Lock the door behind you

Once keys work, turn passwords off on the server so a stolen/weak password can't bypass all this:

# /etc/ssh/sshd_config
PasswordAuthentication no
PubkeyAuthentication yes

Then sudo systemctl reload sshd. Test a new key-based login in a second session before closing your current one.

The mobile-specific bit

Everything above is standard SSH hygiene — the phone twist is storage and unlock. On a phone your private key should live in the secure enclave and unlock with biometrics, so a shoulder-surfer or a grabbed-and-unlocked phone still can't export it. That's a core thing I build into TermAI (keys in the Keychain, Face ID to use them, generate-on-device by default), but the principle holds for any client you pick: generate on device, passphrase-protect, store in the enclave, one key per device.

Do that and SSH from a phone stops being the scary option and becomes the safe one.

How do you handle keys across devices — one key synced, or a separate key per device with public keys fanned out?

SSH into a home server behind CGNAT — from your phone, no port forwarding

chen zong — Mon, 17 Aug 2026 16:07:02 +0000

If your home server sits behind CGNAT (carrier-grade NAT), the classic "forward port 22 on the router" trick just doesn't work — your ISP shares one public IP across many customers, so there's no port to forward. Add a phone as your only device (on-call, traveling, laptop dead) and reaching that box feels impossible.

It isn't. Here's the approach that actually holds up, and how to do the whole thing from a phone.

Why port forwarding fails on CGNAT

Port forwarding assumes you own the public IP on your router's WAN side. Under CGNAT you don't — the ISP NATs you again upstream. So even a perfect router config forwards a port that the outside internet can never route to. Dynamic DNS doesn't help either; it points at an address that isn't really yours.

The usual workarounds each have a cost:

Rent a VPS + reverse SSH tunnel — works, but you're paying for and hardening another public box, and exposing SSH on it.
Ask the ISP for a static/public IP — sometimes possible, often paid, sometimes flatly refused.
Cloudflare Tunnel / ngrok — great for HTTP, awkward-to-paid for raw SSH.

The approach that scales down to a phone: a mesh VPN

Instead of poking a hole inward, put the server and your phone on the same private overlay network and let them find each other. A WireGuard-based mesh — Tailscale, or the self-hosted Headscale control server — does exactly this:

Install the mesh client on the home server; it dials out to the coordination server, so CGNAT is irrelevant (outbound connections always work).
Install the same mesh on your phone.
Both get stable private IPs (e.g. 100.x.y.z). Now your phone can ssh user@100.x.y.z as if you were on the LAN — encrypted, no ports exposed to the public internet.

No inbound firewall rules. Nothing listening on a public IP. SSH is only reachable to devices you've explicitly added to the tailnet, which is a real security win on its own.

Self-hosted vs hosted control plane

Tailscale (hosted): fastest to set up, generous free tier.
Headscale (self-hosted): you run the coordination server yourself — appealing if you want zero third-party dependency for your homelab. It speaks the same client protocol.

Either way the client side is identical, which matters for the phone step below.

Doing it from the phone

This is where most guides stop, because the phone side is genuinely fiddly: you end up juggling a separate VPN app, a keys app, and an SSH app, tabbing between them every time a connection drops.

A cleaner setup is a mobile SSH client with the mesh built in, so the tunnel comes up with the connection instead of as a separate step. I build one — TermAI — with Tailscale integrated, plus SFTP and an AI helper that suggests commands and waits for you to confirm before anything runs (on a production box, "read before you run" matters). But the pattern is what counts: keep the overlay network and the terminal in one place so a dropped mobile connection re-establishes both.

Checklist for the phone:

Mesh client connected, phone shows a 100.x address
SSH key imported to the phone (not a password) — generate on the phone, copy the public half to the server's authorized_keys
Test ssh user@100.x.y.z on Wi-Fi, then again on cellular to confirm CGNAT is truly bypassed
Optional: tmux on the server so a flaky mobile link doesn't kill a long job

Hardening once it works

Because SSH is now only reachable over the tailnet, you can safely:

Set PasswordAuthentication no and rely on keys.
Restrict sshd to listen on the mesh interface only.
Drop any public port-forward rules you were fighting with.

TL;DR

CGNAT breaks port forwarding because you don't own the public IP. A WireGuard mesh (Tailscale or self-hosted Headscale) sidesteps it entirely with outbound connections, gives your phone a stable private IP to the server, and removes SSH from the public internet in the process. Put the mesh and the terminal in the same mobile app and the whole thing works from a phone without app-juggling.

What's your CGNAT workaround — reverse tunnel, mesh VPN, or did you get a static IP out of your ISP?

SSH into your servers from your phone: keys, Tailscale, and an AI safety net

chen zong — Mon, 17 Aug 2026 01:48:50 +0000

Every on-call engineer has lived this: an alert fires, you're not at your desk, and all you have is your phone. The laptop-and-VPN scramble takes ten minutes you don't have. Here's a setup that lets you actually fix things from a phone — safely.

1. Use a real terminal, not a toy

You want an SSH/SFTP client that behaves like a terminal. On iOS/Android the usual names are Termius, Blink Shell, Termux, and TermAI. Whichever you pick, make sure it supports:

SSH keys, not just passwords
SFTP for pulling and editing configs/logs
A key-agent so you're not retyping a passphrase on every reconnect

2. Keys, stored right

Password auth on an internet-facing box is asking for trouble. Generate an ed25519 key:

ssh-keygen -t ed25519 -C "phone"

Put the public key in the server's ~/.ssh/authorized_keys, import the private key into your mobile client's key store, then turn password auth off in sshd_config:

PasswordAuthentication no

3. Reach private servers without opening ports

Most of your boxes shouldn't expose SSH to the internet at all. Instead of port-forwarding, put them on a mesh VPN like Tailscale — your phone joins the tailnet and you SSH straight to the private IP. Some mobile clients ship Tailscale built in, which saves you juggling two apps and a login.

4. The part that matters at 3 a.m.: don't fat-finger prod

Typing systemctl restart against the wrong host, on a phone keyboard, half-awake, is a real failure mode. This is where an AI assistant earns its keep — but the mode is everything. You want suggest-then-confirm (the tool proposes a command, you read it, then you run it), not an autonomous agent that executes on its own. On a production box, "read before you run" is the whole game.

Wrap-up

Phone-based ops isn't about replacing your laptop. It's about the five minutes that stop a small incident from becoming a big one. Keys + a mesh VPN + a suggest-then-confirm assistant is a setup you can actually trust while you're on call.

Disclosure: I build TermAI, a mobile SSH terminal that bundles SFTP, built-in Tailscale, and a suggest-then-confirm AI assistant — but the setup above works with whatever client you prefer.