How to Connect with an SSH Private Key on iPhone (and Where Your Credentials Live)

The problem

Password logins on a server are a weakness, but moving to keys on a phone raises questions. Where does the private key live? Can anyone who borrows the phone open it? Does the app quietly upload it to its own cloud? Most people never get an answer and either use passwords or avoid the phone altogether.

How ServerPanel handles keys

• Formats: OpenSSH-format Ed25519, ECDSA and RSA. Ed25519 and RSA can be passphrase-protected. Encrypted ECDSA keys aren’t supported yet.
• Where they’re kept: the iOS Keychain, set to “after first unlock, this device only”. Keys aren’t uploaded, aren’t included in iCloud Keychain, and aren’t synced between your devices.
• Reuse: the SSH Keys library (Settings → SSH Keys) stores a key once so several servers can use it. A server can instead hold its own pasted key.

Steps

1. Get your private key onto the phone securely (for example from a password manager, rather than by email).
2. In Settings → SSH Keys, add the key, and its passphrase if it has one.
3. Add or edit a server, choose Private Key, and pick the key from the library (or paste it).
4. Connect. The app reuses the stored key next time.

Lock the app

Under Settings → Security & Privacy, turn on app lock. ServerPanel then asks for Face ID, Touch ID or your device passcode whenever it opens or returns from the background. It uses the system prompt and doesn’t store a PIN of its own. If the phone has no passcode at all, there is nothing to check against and the app opens.

Know the limit: host keys

ServerPanel does not yet remember or verify a server’s host key (trust-on-first-use). That means it can’t warn you if something between you and the server impersonates it. On a trusted network or VPN this is a small risk, but on public Wi-Fi it’s worth connecting through a VPN first.

Housekeeping

• Use a separate key for the phone so you can revoke it without touching your laptop key.
• Give it a passphrase if you can.
• If the phone is lost, remove its public key from the servers’ authorized_keys.

FAQ

Which key formats are supported? OpenSSH-format Ed25519, ECDSA and RSA keys. Encrypted ECDSA keys are not supported yet.

Are my keys uploaded or synced? No. They are stored in the iOS Keychain on this device and are never sent anywhere but to the server during login. They do not sync, even with iCloud sync on.

Does ServerPanel check the server’s host key? Not yet. It currently accepts the server’s host key without pinning it, so avoid connecting over untrusted networks without a VPN.

Can I lock the app? Yes. In Settings, turn on app lock to require Face ID, Touch ID or your device passcode when opening the app or returning to it.