security & privacy

Security and privacy

Shell Drop keeps your connection details, passwords, and SSH keys on your device. There is no Shell Drop account, and no Shell Drop server sits in the path between your phone and the machines you connect to.

This page describes how that works, so you can decide whether it fits how you want your credentials handled.

No account, no Shell Drop server

You download the app and connect. There is no sign-up and no Shell Drop-operated cloud holding your hosts, passwords, or keys.

Direct SSH connections

Shell Drop opens an SSH connection straight from your device to your host. Nothing is relayed through a third party in between.

Keys in the Secure Enclave

P-256 keys are generated inside the iPhone's Secure Enclave, where the private key cannot be read by anything, including Shell Drop itself.

No telemetry

The app carries no analytics SDK, no third-party crash reporter, and no event tracking.

Credentials and keys

Passwords stay on the device. They are stored in the iOS Keychain with WhenUnlockedThisDeviceOnly, so they do not sync to iCloud and are removed if the app is deleted.
SSH keys. Generate Ed25519 keys in-app, or P-256 keys backed by the Secure Enclave where the private key never leaves the hardware and signing happens inside the chip. Existing OpenSSH keys (Ed25519, ECDSA P-256/P-384/P-521) can be paste-imported.
Optional Face ID per key. Any SSH key can be set to require Face ID, or your device passcode, each time it signs in to a server. Automatic reconnects within a short window do not re-ask, so a dropped connection retrying does not trigger a string of prompts.
Secrets are never written to the local database. Passwords and keys are held in the Keychain and the Secure Enclave, and are excluded from the app's stored data.
Passwords are zeroed from memory after they are used to authenticate, rather than left sitting in process memory.

Connections

SwiftNIO SSH. Connections run on Apple's Swift SSH implementation. Version 5.1.5 updates it to SwiftNIO SSH 0.15.0, which fixes CVE-2026-43798, a memory-safety issue a malicious or intercepting server could trigger during key exchange, without authenticating first.
Trust on first use. The first time you connect to a host, Shell Drop records its key and warns you if that key changes on a later connection.
Port validation. The destination port is validated before a connection is attempted.
Output sanitization. Terminal output and tmux control sequences are sanitized before they are rendered.
Bracketed paste. Pasted text is bracketed so a remote host treats it as pasted content rather than typed commands.

Sync and your data

Connection details (host, port, labels) sync through your own iCloud using Apple's private CloudKit database. That data lives in your own iCloud account. There is no Shell Drop server holding it.
Passwords and Secure Enclave keys are excluded from sync and stay on the device that created them.
Removing your data. Deleting the app clears the on-device Keychain entries. Connection metadata in iCloud is managed from your own iCloud settings.

What Shell Drop does not collect

Shell Drop has no account or login, no analytics or usage tracking, and no advertising or marketing SDKs. No session data is collected, so there is nothing to sell or share. The full privacy policy has the detail.

Security reviews

The codebase has been through internal security reviews covering host-key handling, password zeroing, port validation, tmux output sanitization, CloudKit validation, keychain migration, and bracketed paste.

The whole app was also run through a Mythos-class multi-agent audit using a Glasswing-style pipeline, adapted from Cloudflare's Project Glasswing: a recon pass, then 8 hunter agents, then 3 verification agents. No critical or externally-reachable issues were found, the core posture held up, and a cluster of medium findings was fixed. There is a write-up on the blog.

To be straight about the scope: these are internal reviews, not a third-party penetration test, and the source is not currently public. If that matters for your use, it is worth knowing up front.

The trade-off

A cloud SSH manager syncs everything across every device and platform and stores it in the vendor's encrypted vault. That is convenient, and it means trusting the vendor's servers and account security. Shell Drop takes the device-first approach: a smaller footprint, your secrets on your own hardware, and less reach across machines. Both are reasonable ways to work. This page is here so you can see which one Shell Drop is.

Shell Drop is on the App Store. Universal iPhone and iPad, iOS 17+, with full iPhone Duo support folded or open.

Download on the App Store