Frequently asked questions

It's free to download, with no ads, no accounts and no subscription. On iPhone, iPad and Android the free version holds up to five hosts. Unlimited Hosts, a one-time in-app purchase, removes that limit. Hosts you already have always keep working, whether or not you buy.

The purchase belongs to your App Store or Google Play account. On another device signed in to the same account, tap Restore Purchases. On Apple devices it can be shared with your family through Family Sharing. A purchase on one store doesn't carry over to the other.

iPhone and iPad (from the App Store), and Android phones and tablets, including foldables (from Google Play). The layout adapts to the screen: a bottom bar on phones, and a navigation rail and sidebar on tablets. A Mac version is coming later.

There is no web version. Browsers can't open the raw network connections SSH needs, so the app has to run on your device.

Any server you can reach over SSH with a password or key. The app runs ordinary commands on the server, so which tools you see depends on the operating system and on what is installed.

• Linux has the most features, especially with systemd. Each release is tested on Debian, Ubuntu, Fedora, AlmaLinux, Rocky Linux, Arch Linux, openSUSE, Alpine, Devuan and Proxmox VE.
• macOS and FreeBSD are supported, with their own service managers (launchd, rc.d), firewalls (pf) and package tools.

Windows servers aren't supported yet.

No agent and no daemon: only an SSH server. Some screens use tools you may already have, such as docker or podman for Containers, kubectl for Kubernetes, virsh for Virtual Machines and iperf3 for the network speed test. When a tool is missing, its screen says so.

Yes. Tap Try a demo host to explore a simulated Debian server built into the app. It works offline, and nothing leaves your device.

One developer: me, Joshua Akers, in Virginia, through my company, SERVER SIDEKICK LLC. I use the app on my own servers every day. Support emails come straight to me.

If I ever stop working on it, the app keeps working. It has no account to expire and no server of mine to depend on, and your hosts, keys and backups stay with you.

Private keys of these types, in the OpenSSH format that ssh-keygen writes today or the older PEM format:

• Ed25519 (recommended)
• ECDSA
• RSA

Passphrase-protected keys work: enter the passphrase in the credential's form. The easiest route is to let the app make the key: in a credential, choose Generate new key, then Deploy to host to add it to the server's authorized_keys.

To make a key on a computer instead:

ssh-keygen -t ed25519 -f ~/.ssh/sidekick

then paste the contents of ~/.ssh/sidekick (the private key, not the .pub file) into the credential.

If a key won't load, rewrite it in a format the app reads. This keeps the same key, so servers that trust it still do:

ssh-keygen -p -f ~/.ssh/id_rsa

A PuTTY .ppk key needs converting first: puttygen key.ppk -O private-openssh -o key.

In the credential, set Privilege escalation to sudo or doas. The app puts that in front of the commands that need root.

The app runs commands without an interactive prompt, so it can't type a sudo password for you. The account needs to be allowed to run sudo without one, for example with a sudoers rule like this (edit with visudo):

alice ALL=(ALL) NOPASSWD: ALL

For doas, use permit nopass alice in doas.conf. If you'd rather not, log in as root, or leave escalation off: most screens still work read-only, and the app tells you when an action needs more rights.

The first time you connect to a server, the app shows its host key fingerprint and asks whether to trust it, just as ssh does on a computer. After that it checks the key on every connection and warns you if it changes, which can mean the server was reinstalled or that something is intercepting the connection. You can review or remove remembered keys in the app.

Yes. Add the bastion as a host, then pick it as the jump host when you add the server behind it. The connection is tunneled through the bastion, like ssh -J.

Yes. If your server asks extra questions at login (keyboard-interactive authentication, such as a one-time code from PAM), the app shows you each prompt to answer.

The scan looks for SSH servers on the local network your device is connected to. A server won't show up if:

• it is on a different network or subnet, or behind a VPN;
• its SSH server listens on a port other than the one scanned, or a firewall blocks it;
• on iPhone and iPad, Local Network access is turned off for Server Sidekick (Settings → Privacy & Security → Local Network).

You can always add a host by typing its address.

• Can you reach the server from the device at all? Try the same network the server is on.
• Is the port right? SSH uses 22 unless you changed it.
• "Permission denied" usually means the username, password or key is wrong, or the server doesn't allow that method (see PasswordAuthentication and PubkeyAuthentication in /etc/ssh/sshd_config).
• Was the key added to ~/.ssh/authorized_keys for that user on the server?

Still stuck? Settings has a diagnostics log of the errors the app has met. You can read it, then email it to support from there.

Shells stay open while you move around the app. If the connection itself drops, which is common on mobile, use tmux or GNU screen: the app can open a terminal straight into a tmux or screen session, and reattach to it later.

Yes, if you turn on server-side alerts for a server. The app installs a small check script on that server, in the account it signs in as, and runs it every 5 minutes unless you choose another interval. When a rule fires or clears, the server itself sends a message to the destination you chose: ntfy, a webhook (such as Discord, Slack or Gotify) or a Healthchecks ping address. The messages never pass through the app or through me. To stop it, choose Remove on the server's Alerts screen; deleting the app doesn't reach your servers.

Rules the app checks itself raise a notification only while that host's Metrics or Services screen is open. There is no Server Sidekick server watching your hosts.

• Keep devices the same: turn on sync in Settings → Sync on each device, with a WebDAV server you choose, such as your own Nextcloud. Your hosts, groups, snippets and more stay the same everywhere, end-to-end encrypted with a passphrase only you know. Passwords and keys sync too on devices where you turn on "Sync passwords and keys".
• Everything, including passwords and keys: make a backup in Settings. It is a file encrypted with a passphrase you choose. Move the file to the new device and restore it there.
• Just the host list: share hosts by QR code or file, and scan or open it on the other device. Shared host lists never contain credentials.

No. The passphrase never leaves your device and I never see your backups, so nobody can decrypt a backup without it. Make a new backup with a passphrase you'll remember, or keep it in a password manager.

Yes. Turn on app lock in Settings to require Face ID, Touch ID, your fingerprint or your device passcode to open the app. Your device does the check; the app only learns whether it passed.

Server Sidekick is built with Flutter and uses dartssh2, an SSH implementation written in Dart, on every platform. The licenses of all the open-source components are in the app under Settings → About → View licenses.

On your device. Passwords and SSH keys are encrypted, with the encryption key held in your device's secure storage (the Keychain on Apple devices, the Keystore on Android). If you turn on sync, an encrypted copy also goes to the WebDAV server you chose, which can't read it. I don't run a server that the app talks to, so I never have a copy.

No. There are no accounts, ads, analytics or crash reporting. The app connects only to the servers and services you set up, and to the App Store or Google Play for the one purchase. The privacy policy has the details.

• Camera: only to scan a QR code of hosts shared from another device, when you tap Scan.
• Local Network (iPhone and iPad): to scan your network for SSH servers and to connect to servers on it.
• Notifications: for the alert rules you set up.
• Face ID or fingerprint: only for app lock.

Delete the app. Everything it stored is on your device, so it goes with the app. Backups you exported are files you control; delete them wherever you saved them.