An iPhone can hold SSH keys as safely as a laptop, and in one way more safely: a key made in the Secure Enclave can't be copied off the phone at all. This page covers which key type to use, how to put the public key on a server, and how SSH agent forwarding lets that server use your phone's key for GitHub or another server.
The steps use Shell Drop, a free SSH client for iPhone, iPad and iPhone Duo. The SSH parts apply to any client.
Shell Drop generates two kinds of key in the app:
ssh-keygen -t ed25519 makes on a computer. Short keys, fast signing, accepted by any current OpenSSH server, GitHub, GitLab and Bitbucket.Existing OpenSSH keys can be paste-imported too: Ed25519 and ECDSA P-256, P-384 and P-521.
Any key can be set to need Face ID, or the device passcode, each time it signs in to a server. Automatic reconnects within a short window don't ask again, so a connection that drops and retries doesn't bring up a string of prompts.
The private key stays on the phone. The server only needs the public half, one line that starts ssh-ed25519 or ecdsa-sha2-nistp256.
~/.ssh/authorized_keys for the user you log in as, one key per line.If ~/.ssh is new, OpenSSH expects it to be private to that user:
mkdir -p ~/.ssh && chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keysShell Drop syncs connection details (host, port, labels) through your own iCloud. Private keys and passwords are left out of sync and stay on the device that holds them. Secure Enclave keys can't move at all, by design.
That makes the simplest arrangement one key per device: an iPhone key and an iPad key, each with its own line in authorized_keys. Removing a lost or retired device is then a matter of deleting its line on each server, and the other devices keep working. A comment at the end of each public key line, such as the device name, makes that line easy to find later.
Passwords, for servers that use them, live in the iOS keychain on that device only and are removed if the app is deleted. The security page has the full detail on storage.
Agent forwarding is the equivalent of ssh -A. With it on, the server you're connected to can ask the phone to sign with your keys, so it can reach other servers without a key of its own. That covers:
No keys are left on the server and the private keys never leave the phone. It works with Ed25519 and ECDSA keys, including keys held in the Secure Enclave.
Forwarding is off by default, and set per saved connection and per device. Tap and hold a connection, choose Edit, and switch on Forward SSH keys. The same switch is in Settings > Login and connections > Saved connections.
The server has to allow it too. OpenSSH servers allow agent forwarding unless AllowAgentForwarding no is set in sshd_config, and Shell Drop says so when a server refuses.
The first time a server asks for a signature on a connection, a card on the phone names the server, the key and the login it's for, such as git for GitHub. It has three buttons: Deny, Sign once, and Allow for this connection. Signing needs Face ID or the passcode.
Allow for this connection asks once, then signs without the card until you disconnect or tap Revoke, so an agent running git over and over isn't stopped at every step. A pill under the tabs shows the server, a running count of signatures, and the Revoke button. For a card on every signature, set Ask before signing to Every time in the connection's settings.
Requests are refused after a minute with no answer, and while the phone is locked. Every refusal says why, in a banner when the app is open and a notification when it isn't. Because the key stays on the phone, a job that runs while the phone is locked can't use it. For unattended jobs, a deploy key or token on the server is still the right tool.
A Tmux session started before you connected still points at an old agent socket, so git inside it can't find your keys. This is standard ssh -A behaviour. Adding this to the server's ~/.bashrc or ~/.zshrc makes git inside Tmux follow whichever connection is live:
if [ -S "$SSH_AUTH_SOCK" ] && [ ! -L "$SSH_AUTH_SOCK" ]; then
ln -sf "$SSH_AUTH_SOCK" ~/.ssh/ssh_auth_sock
fi
export SSH_AUTH_SOCK=~/.ssh/ssh_auth_sockThe Tmux cheat sheet covers the rest of Tmux from a phone, and the 5.2.3 release post has screenshots of the approval card and the pill.
The first time Shell Drop connects to a server it records the server's host key. If that key changes on a later connection, the session is blocked and the mismatch is shown, which is how SSH catches a server being impersonated.
Yes. Shell Drop can create a P-256 key inside the iPhone's Secure Enclave, where the private key never leaves the chip and can't be read by any app, Shell Drop included. Ed25519 keys and imported OpenSSH keys are stored in the iOS keychain.
Ed25519 is the standard modern choice and works with every current OpenSSH server and git host. A Secure Enclave key is P-256 because that's the only type the Secure Enclave makes, and its private key can't be copied off the phone. Both are good choices.
Yes, in Shell Drop 5.2.3 and later. Turn on Forward SSH keys for a saved connection, and the server can use the phone's keys to reach GitHub or another server. Each connection is approved on the phone with Face ID or the passcode.
With forwarding on, the server can ask for signatures while you are connected, so turn it on only for servers you trust. In Shell Drop it is off by default, every connection is approved with Face ID, you can revoke it at any time, and requests are refused while the phone is locked.
No. Shell Drop syncs connection details through your own iCloud and leaves private keys and passwords on the device that holds them. One key per device, each added to the server's authorized_keys, is the simplest setup.
Reading on a computer? Scan the code with your iPhone camera.