DuoShellSSH for iPhone and iPad · Beta on TestFlight
Sign In To Every Server With Face ID.
DuoShell gives your iPhone or iPad its own SSH key, made inside the Secure Enclave. One scan with your Mac puts it on your servers. After that, you tap a server, look at your phone, and you're in.
Setup
One Scan On Your Mac. Face ID From Then On.
DuoShell Pair, a small free Mac app, uses the SSH access your Mac already has to add your iPhone's or iPad's key to each server and record each server's identity.
Click Pair iPhone Or iPad On Your Mac
Check the servers you want. Keys in 1Password's SSH agent work too; approve the prompt on the Mac.
Scan The Code In DuoShell
The code works once and expires in 10 minutes. Everything sent is encrypted, and both screens show a matching code to check before anything is set up.
Tap A Server And Look At Your Screen
Face ID (or Touch ID) unlocks the key in the Secure Enclave for that one connection. The private half never leaves the chip.
No Mac? Add a server with its password, connect once, and tap Sign In With Face ID Next Time. How it works
Workspace
Paste A Command. Copy The Result.
Each run comes back as a card with its output, exit status and timing, ready to copy in one tap. When you need a full shell, the Terminal is one tab away.
Snippets
Save any command you've run with Save As Snippet. Pick it from the menu next time, or let DuoShell type it into the Terminal. Snippets sync between your devices.
Laptop Keyboard
Turn the Terminal's bottom half into a full keyboard with Esc, Control, Option, Tab, arrows and F-keys. Tap Control once for the next key, twice to lock it.
Sessions That Survive
Turn on tmux for a server and a dropped connection costs you nothing. One tap on Reconnect and you're back in the same session, editor and all.
History On This Device Only
Each server keeps its last 30 runs, up to 2 MiB of output each, on this device and out of cloud backup. Clear it whenever you like.
Set Up Another Device
Your iPhone sets up your iPad, or the other way round, with no Mac: scan a code, check the matching numbers, approve with Face ID. Each device gets its own key.
Copy And Paste In The Terminal
Touch and hold for Copy, Paste and Select Text, or double-tap a word. Pasting text with a line break asks first, so nothing runs by surprise.
Security
A Key That Can't Leave Your Phone.
There's no password to phish and no key file to lose. Remove one device's access from a server without touching anything else.
- SIGN-IN KEY
- ECDSA P-256, made in the Secure EnclaveIt can't be exported, synced or backed up. Each device has its own.
- UNLOCK
- Face ID, Touch ID or your passcodeAsked once per connection, never stored.
- SERVER IDENTITY
- Recorded at pairing, checked every timeDuoShell refuses to connect if a server's host key changes.
- PAIRING
- Encrypted, with a matching codeFresh keys each time; the code works once and expires in 10 minutes. Both screens show six digits to check.
- PASSWORDS
- Optional, in this device's KeychainNever synced. DuoShell offers to forget one once Face ID works.
- DATA WE COLLECT
- NoneThe app has no account, no analytics and no tracking. Your server list syncs through your own iCloud.
Mac App
DuoShell Pair Lives In Your Menu Bar.
It reads the servers you already reach with ssh, adds your iPhone's or iPad's key to the ones you check, and removes a device from all of them in one click if it's ever lost.
Try It Before You Add A Single Server.
Tap Try The Demo in DuoShell for a pretend server that runs on your phone. Run commands, use the Terminal and set up Face ID sign-in, with nothing to connect.