Secure Shell or Secure Socket Shell (SSH) is an encrypted network protocol that allows you to access other computers over an insecure network (such as the internet).
Although primarily a tool for system administrators, SSH can be useful for private users who want to execute commands and move files on home media or games servers, set up a VPN server on a rented VPS space, or suchlike. It is particularly handy for accessing headless servers that have no screen or keyboard attached for inputting commands.
In this article, we will look at how to use your Android phone or tablet to SSH into a remote server. Luckily, there are several very good SSH client apps for Android, so we also look at some of the best of these. Besides this, we include a quick guide to turning your Android device into an SSH server host.
Traditional SSH clients provide command-line (terminal) access to SSH servers (any computer actively running SSH server software). And this remains by far the most common way to use SSH.
On desktop computers, X11 forwarding allows you to run GUI applications remotely, provided X-forwarding is also configured on the target computer. The only real way to do this in Android is via the XServer XSDL app, which is rather buggy, but which does work.
For this article, we will assume that readers are looking for a more traditional SSH client. If you want full GUI access to a remote computer, then apps such as AnyDesk and TeamViewer are much easier ways to achieve this than configuring XServer XSDL.
If you want to transfer and rename files using a GUI interface, though, SFTP is an improvement over the old and highly insecure FTP file transfer protocol. It basically works like FTP but secures the connection using SSH.
Best SSH apps for Android
Below we have listed the Android apps for SSH.
ConnectBot is a 100% free and open source SSH (and Telnet) client and terminal emulator that can manage multiple simultaneous SSH sessions, create secure tunnels, and copy/paste between other apps in Android.
It is a traditional-style SSH client, which is to say that it provides command-line access to computers running SSH server software. A GUI interface is available for setting up connections, though.
ConnectBot can run pretty much all SSH commands, and fully supports persistent connections, key management, and port forward management. A clever feature is URL scanning, which scans for anything that looks like a URL, which it presents as a list of links.
A customizable strip of special keys, such as CTRL and ESC make the terminal very easy to use without needing an external keyboard (which is also supported). ConnectBot can be downloaded from either the Play Store or via F-Droid.
Termius is an all-singing, all-dancing, SSH client with ECDSA, ed25519, and chacha20-poly1305 encryption support. Some advanced features not found in ConnectBot appear in the core app, which is free, with even more available via in-app purchases, but it must be noted that Termius is a closed source proprietary software.
Termius supports multiple SSH, Telnet, and Mosh connections in tabbed windows, port forwarding, has a built-in RSA/DSA/ECDSA key generator, and a Putty keys importer, and includes a built-in SFTP (FTP over SSH) client for easy GUI management and transfer of files.
Handy premium features include a built-in SFTP (FTP over SSH) client for easy GUI management and transfer of files, and "snippets” - predefined port knocking or shell scripts that you can easily run at any time. Like ConnectBot, Termius features a customizable keyboard strip for easy input when not using an external keyboard.
Termius is available from the Play Store.
Like Termius, JuiceSSH is a very popular and fully-featured proprietary SSH (and Telnet and Mosh) client with in-app purchases for premium features. It supports ECDSA, RSA, and DSA SSH keys and password, SSH key agent forwarding, 2FA via Google Authenticator, and includes an RSA key generator.
One of JuiceSSH’s more interesting features is "Identities,” which allows you to define a set of usernames, passwords, and/or private keys for multiple connections. It supports port forwarding, terminal characters, and, like Terminus, "snippets.” It also features clicking on URLs to open them in your browser.
Premium features include automated AES-256 encrypted backups of all of your connections and settings, a widget, dynamic port forwarding, integration with Amazon AWS/EC2, and more.
JuiceSSH is available from the Play Store.
There are of other "regular” SSH clients out there for Android, but with ConnectBot, Terminus, and JuiceSSH being as good as they are, we really don’t see the point of adding more to this list.
So instead, we are going to suggest Ghost Commander; a free and open source dual-panel file manager for Android, for which an SFTP plugin is available for seamless SSH-encrypted file management and transfer on a remote server.
Ghost Commander also allows you to manage local files (including files on SD card or OTG USB devices), regular FTP, Google Drive, Dropbox, and BOX or any WebDAV enabled cloud storage, and Windows network SMB shares (may require free plugins).
Video and audio content can be streamed from remote locations (including SFTP servers), and Ghost Commander includes a built-in text editor, media previews, zip/unzip functionality, and much more.
Setup using an Android SSH Client App
For this guide we are using the open source ConnectBot app to connect to the headless Raspberry Pi SSH server we used for our PiVPN and Pi-hole projects. Although we are using ConnectBot, setup for all Android SSH client apps is very similar.
(Optional) Import a public SSH key. We secured our Pi server with just a username and password, since we only ever intend to access it over our local network. Servers that are accessible over the internet should be secured with a cryptographic key pair.
If this is the case for the SSH server you wish to connect to, then its administrator will share its public key with you. This can be transferred to your Android device storage via email, USB connection to a PC, USB OTG stick, or suchlike.
To import a public key for an SSH server, on the Hosts screen select the hamburger menu icon -> Manage Pubkeys.
Hit the folder icon, navigate to where the imported [keyname].key file is located on your device, and select it.
Hit the back button to return to the Hosts page.
ConnectBot also allows you to generate key pairs that you can share with the server, but that is beyond the scope of this tutorial.
Connect to an SSH host server. Whether you just imported a public SSH key or don’t need to and have just opened the app, you should now be on the Hosts page.
Click the big + symbol at the bottom right of your screen to set up a new connection.
Ensure Protocol is ssh (it is by default) and under username@hostname:port enter your username followed by the @ symbol and then the SSH host’s IP address or URL.
SSL uses port 22 by default, so you don't actually need to fill this bit in if your server uses port 22. If it uses a different port number, then add :[port number] to the login address.
If using a public key is required, touch "Use pubkey authentication” and select the key you imported in Step 2.
You can change any other settings you wish, or you may be instructed to do so by your SSH server administrator. Touch the + button when you are done.
Back on the Hosts screen, select the newly created SSH host.
The first time (only) you connect, you will see a security warning. Select YES.
Enter your password when prompted, and your command-prompt should turn into that of your SSH host server.
You are now connected!
Pros and Cons of using an SSH client app for Android
- Convenience - you can access your SSH host(s) from anywhere using the device in your pocket. What’s not to like?
- Connecting to an SSH host using an Android app is just as secure as connecting using a more traditional desktop SSH client.
- Most Android SSH client apps are as fully featured as their desktop cousins (such as PuTTy).
- A touch screen is not the ideal way to enter terminal commands. Fortunately, most Android SSH apps support the use of an external keyboard (such as almost any Bluetooth keyboard).
Setting up your Android device as an SSH host
The above tutorial shows you how to connect to a remote host on your Android device via SSH. It is also possible to set up your Android device as an SSH host server.
The method outlined in the tutorial below is something of a "quick and dirty” approach that lacks frills. But it's easy to implement, and it works without requiring root access.
Download, install, and run SSHelper.
Enable file Writing. You will need to do this only once.
As the instructions say, touch OK to visit the SSHelper App Info page -> Permissions -> Storage -> Allow.
Touch the back arrow until you are back on the SSHelper Log screen, which should show that SSH server is already up and running. In the future, simply starting the app will launch the SSH server.
Select the Config tab. To connect to your Android device over SSH, you will need the IP address, Port number, and password of the server. Note that SSHelper accepts any username during login.
By default, the server password is admin. It is a very good idea to change it to something more secure. When you’ve done this, scroll to the bottom of the page and hit "Restart server with new values.”
Your Android device is now an SSH server host that you can connect to in the usual way (for example, in Android using the instruction in the previous section).
We outline how to connect to an SSH server (like the one we have just created) from Windows, macOS, Linux, and iOS, in How to SSH into a Raspberry Pi. Above, we have connected to our Android SSHelper server from Windows using PuTTy.
The only thing to note is that you will be unable to login as root unless the host Android device has been rooted.
Test if SSH is working
When you successfully SSH into another computer, you will see a terminal command prompt that belongs to that computer.
In other words, exactly as it would look if you were physically sat at the host computer using a terminal emulator such as Terminal (Linux and macOS), Command Prompt/Windows PowerShell (Windows), or Terminal Emulator for Android.
We can easily see above that we have connected to our Raspberry Pi. More usefully, you will now be able to execute commands as if you were sat in front of the host computer. If you're not sure where to start, then entering help will almost invariably output a list of valid commands.
If using an SFTP app (such as Ghost Commander or Solid Explorer) then you will be able to see, rename, move and preview (etc.) files on the host computer using a GUI interface if you are successfully connected.