Is there a web SSH client that does not upload my private key?
SSH from a Chromebook, an iPad, a locked-down work laptop, or any browser, without handing your key to a server.
What you are running into
Most browser SSH tools work by running the SSH client on their server. You upload your private key, or paste your password, and their machine logs into yours on your behalf. Convenient, and it means a company you have never met holds working credentials to your servers.
The alternative has been to carry a laptop with a real terminal, or to type on a phone SSH app with a tiny keyboard and no history.
How SSH Guru handles it
The client runs in your tab
The SSH client is Go compiled to WebAssembly. Key exchange, authentication and encryption happen in your browser. There is no server-side SSH client anywhere in the product.
A vault only you can open
Keys and passwords are encrypted in the browser with Argon2id and AES-256-GCM under your passphrase. What we store cannot be decrypted on our side.
Host keys pinned in the browser
The server's host key is remembered on first use and a change warns you. The check runs inside the WASM client, so the relay cannot tamper with it.
What to do, step by step
- Open sshguru.com in any modern browser
Chrome, Edge, Firefox, Safari. Chromebooks and iPads included. Nothing to install.
- Create an account and a vault passphrase
Choose a passphrase you will not lose: it cannot be reset, because we never have it.
- Add a server
Hostname, port, username, then paste a private key or a password. It is encrypted before it leaves the page.
- Connect
A full terminal with copy, paste, resize and scrollback. Ask the Guru for help beside it, or ignore it.
- Come back from another device
Sign in, unlock the vault with your passphrase, and your servers are there. Session history and transcripts are kept with the account.
Questions
Does it work on an iPad?
Yes, in Safari or Chrome. A hardware keyboard helps for long sessions, as with any terminal.
Does it support jump hosts?
Yes, on Pro. The in-browser client dials the bastion and opens the inner connection through it; the bastion never sees credentials for the target.
What about servers on my home network?
Those need a bridge, a $5 board that dials out from your LAN. See the guide on accessing a home server from outside.