Key Management

PocketCmd keeps SSH private keys in a key library on the device. Open it from Settings › Connection › SSH Keys, or from a server’s settings when you pick a key for it. A key in the library can be assigned to any number of servers.

Supported keys

Algorithm	Generate on device	Import
Ed25519	Yes (recommended)	Yes
ECDSA	P-256, P-384, P-521	Yes
RSA	2048, 3072 or 4096 bits	Yes
DSA	No	No

PocketCmd reads OpenSSH (BEGIN OPENSSH PRIVATE KEY), PKCS#1 RSA PEM, EC PEM and PKCS#8 keys, encrypted or not. The format is detected from the key text, so you never have to specify it. DSA keys are recognized but cannot be used to sign in. See Supported Key Formats for the full matrix.

Add a key

Tap the + button in the key library (Add Your First Key when the library is empty). The chooser offers two options.

Generate new key

Generate new key creates a key pair on the device.

1. Enter a Key Name and, optionally, a description.
2. Choose the key type: Ed25519, ECDSA P-256, ECDSA P-384, ECDSA P-521 or RSA. For RSA, pick 2048, 3072 (the default), or 4096 bits.
3. Optionally add a comment and a passphrase under Comment & protection. A passphrase encrypts the private key in OpenSSH format (aes256-ctr with bcrypt), the same way ssh-keygen does.
4. Tap Generate.

The result screen shows the public key and its SHA-256 fingerprint. Tap Copy public key and add the line to ~/.ssh/authorized_keys on each server that should accept the key.

Import existing key

Import existing key takes a private key you already have.

1. Tap Paste to insert the key from the clipboard, or File to pick a key file. A picked file must contain a PEM or OpenSSH private key and be smaller than 64 KB; its name becomes the key name.
2. As soon as key text is present, PocketCmd shows its format, algorithm, fingerprint and whether it is encrypted.
3. If the key is encrypted, enter its passphrase so PocketCmd can store it with the key.
4. Tap Add Key.

To create a key on a computer and import it afterwards:

ssh-keygen -t ed25519 -C "[email protected]"

Caution

Move private keys only over channels you trust, such as AirDrop or an end-to-end encrypted messenger. Do not send them by unencrypted email or post them in chat channels.

Keys that come with imported servers

Two import paths bring keys along with the servers that use them:

• From a PocketCmd Server host. Run pcmd sync on the machine and scan the one-time QR code it prints. PocketCmd imports the hosts in that machine’s ~/.ssh/config together with the key files their IdentityFile lines point to. This works on Free; servers past the Free limit are imported locked.
• From a server you are connected to. Importing a server’s ~/.ssh/config over SSH reads the referenced key files from that server and asks for the passphrase of each encrypted key.

See SSH Config Import for both flows.

Passphrases

PocketCmd does not ask for a key passphrase when it connects. If a key is encrypted, its passphrase has to be stored with it. Until it is, the key library and the key’s detail screen warn that connections using the key will fail.

To change or remove a stored passphrase, open the key and edit the Passphrase field. Leaving the field empty removes the stored passphrase.

Key details

Tap a key in the library to open its detail screen. It shows:

• the key’s name and notes, both editable
• the fingerprint (SHA-256), with a copy button
• Protection: whether the key is encrypted
• the comment stored in the key, when the format carries one
• when the key was added and last used
• the public key, with a Copy button
• the private key, hidden until you tap Reveal key

Replace from clipboard swaps in new key material while keeping the key’s name and server assignments. Deleting a key lists the servers that use it; those servers fail to connect until you assign another key.

How keys are stored

Private keys and passphrases are encrypted with AES-256-GCM under your vault key before they are written to the operating system’s secure storage (for example the Keychain on Apple platforms and Keystore-backed storage on Android). The vault key depends on your app password, so the stored copies cannot be read while the app is locked. See App Password & Vault Security.

Keys shared through a team vault appear on the vault pages. Import such a key into your personal vault to use it in the key library and for your own servers. See Secrets Vault.

To move keys to another device, include them in an encrypted export or use sync.