Agent Terminal
Your keys, end to end.
Every connection, command and notification between your mobile device and your desktop is locked to keys that never leave your devices. Check it yourself with standard SSH tools. How the two modes differ.
Two ways to connect. No port forwarding.
On a private network the two apps talk directly and never involve us at all. Away from home a relay introduces them and, wherever the networks allow it, gets out of the way — the session then runs peer to peer. Where they do not, the relay carries it, still encrypted end to end. On the free plan that relay is one of n0’s public relays, run by n0, not by us, with no promise of uptime or speed (what they see); with Pro it is one of Agent Terminal’s dedicated relays.
SSH straight across your private network, to the one key your desktop showed in its QR code. No data leaves the private network.
Both devices discover each other via central relay. The SSH connection runs inside, so the relay carries packets it can neither read nor sign in with.
Devices directly connect via P2P network.
A device is its key.
Every connection, on your Wi-Fi or over a relay, is strictly funneled through, and guarded by, a single SSH gateway in the desktop app. It accepts public keys and nothing else: no password, no token, no account sign-in opens a terminal.
How it holds
- Pairing happens once, in person: your mobile device scans the QR code on the same Wi-Fi and gives your desktop its public key
- Your mobile device checks your desktop's key on every connection, at home and over the relay alike
- Push Notifications are encrypted to a key only your mobile device holds
- Revoking a device on your desktop closes its connections within half a second
Check it yourself
-
ssh-keyscan -t ed25519 -p 47831 <your-pc>shows the same key as your desktop's Connected devices page and your mobile device's Settings -
ssh -v -p 47831 anyone@<your-pc>with a key it has never seen offerspublickeyonly, and ends inPermission denied -
The list of keys your desktop accepts is a plain
authorized_keysfile you can read and edit
Minimal data.
We would rather show you the short list than bury a long one. If you use Agent Terminal on the free plan, without an account, nothing we keep is tied to your identity: only your mobile device’s push address, for notifications.
With an account, we hold
- Your email address, and the provider id behind a Google or GitHub sign-in
- Your plan and its renewal date, as reported by our billing provider
Impossible for us to receive
- Anything you type, or that your programs print
- Your project names, your file listing, or your terminal's contents
- Your name or email address, if you never make an account
More details.
The privacy policy lists every field we keep and why. The terms say what we promise and what we do not.