SSH keys on iPhone and iPad are generated on the device itself and kept in the system's secure storage. Only the public key goes to the server, where it is added to ~/.ssh/authorized_keys with ssh-copy-id or by hand. The private key should never leave the phone, and the server expects permissions of 700 on ~/.ssh and 600 on authorized_keys.
How to generate an Ed25519 SSH key on iPhone or iPad
OpenSSH has supported Ed25519 keys since version 6.5, released in January 2014, so any reasonably current server accepts them. Ed25519 is the type to pick for a new key. It also avoids relying on the ssh-rsa SHA-1 signature, which has been disabled by default since OpenSSH 8.8 (September 2021).
On a desktop, you create the key pair with ssh-keygen. The options are listed in the official ssh-keygen manual page:
ssh-keygen -t ed25519 -C "iphone-work"
# Creates ~/.ssh/id_ed25519 (private) and ~/.ssh/id_ed25519.pub (public)An iPhone or iPad has no local ssh-keygen, so the SSH client generates the key. In termi1 the key is created on the phone and stays in the system's secure storage. You end up with the usual pair:
- a private key that never leaves the device;
- a public key, which is a single line of text (for example
ssh-ed25519 AAAA… comment) and the only part you copy to the server.
If you use a FIDO2 security key, OpenSSH has accepted ed25519-sk keys since version 8.2 (February 2020). The server must run that version or newer.
Where the SSH key is stored on iPhone versus desktop
On a computer running OpenSSH, the private key is a file in ~/.ssh/ with permissions of 600. It is protected only by those permissions and by a passphrase, if you set one. On iOS the key sits in the system's secure storage, and the app uses it to authenticate without leaving it around as a loose file.
| What is compared | iPhone / iPad (termi1) | Desktop (OpenSSH) |
|---|---|---|
| Where the private key lives | System secure storage | File in ~/.ssh with permissions 600 |
| How it is generated | From the app, on the device itself | ssh-keygen -t ed25519 |
| How the public key reaches the server | Pasted into authorized_keys or paired via termi1 Companion on a Mac | ssh-copy-id or pasted into authorized_keys |
| Whether the private key leaves the machine | No; it never goes to termi1 servers either | Only if you copy it yourself |
| What syncs across devices | Connections and shortcuts with an optional account; never the private key | Nothing; you copy the config by hand |
In practice, every device gets its own key. Give each one a comment that identifies it (iphone-work, ipad-home). If you lose the phone, you can then revoke just that line.
Copying the public SSH key to the server with ssh-copy-id
ssh-copy-id appends a public key to ~/.ssh/authorized_keys on the server and creates the directory if it is missing. It runs on a machine that has OpenSSH. Use it when the iPhone's public key is already on your laptop (via AirDrop, email or clipboard) and the laptop can log in to the server.
# Save the iPhone's public key line as iphone-work.pub and upload it
ssh-copy-id -f -i iphone-work.pub user@server
# If sshd is not listening on port 22
ssh-copy-id -f -i iphone-work.pub -p 2222 user@serverYou need -f because the private key is not on the laptop. Without it, ssh-copy-id uses the matching private key to check whether the key is already installed. OpenSSH listens on TCP port 22 by default, so -p is only needed if you changed it.
Adding the SSH key to authorized_keys from the iPhone itself
sshd expects permissions of 700 on ~/.ssh and 600 on authorized_keys, so set them while you add the key by hand. With no computer in between, log in once with a password from the iPhone and run:
mkdir -p ~/.ssh && chmod 700 ~/.ssh
echo 'ssh-ed25519 AAAA...your-key... iphone-work' >> ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keysUse >>, not >. A single angle bracket overwrites the file and locks out every other key.
termi1's keyboard has Ctrl, Tab and arrow keys for fixing the line. The built-in SFTP lets you view or download authorized_keys to confirm the line is complete. If you ask the AI for the command, it is typed at the prompt without pressing Enter, and the AI never receives keys or passwords.
With a Mac, the process is shorter. termi1 Companion (macOS 14 or later, free, in the menu bar) checks Remote Login, mosh-server and tmux. It then pairs the iPhone with a six-digit code that installs the public key.
Once key login works, set PasswordAuthentication no in /etc/ssh/sshd_config. Keep your current session open until you have confirmed key access from a second one.
4 mistakes when using SSH keys from iPhone or iPad
These four problems make sshd fall back to asking for a password or stop the session from opening at all:
- Permissions too open. With
StrictModes yes, the default, sshd ignores authorized_keys if other users can write to it. Reset to 700 and 600. - Broken line when pasting. A public key is a single line, and a line break in the middle invalidates it.
- Assuming Mosh skips the key. Mosh starts mosh-server over an initial SSH connection, then needs UDP 60000-61000. It does no port forwarding or X11.
- Exposing port 22 just for your phone. For machines without a public IP, a mesh network without open ports such as Prialo, or Tailscale, is cleaner.
With the key in place, termi1 keeps the session alive with Mosh when you switch from Wi-Fi to mobile data. It uses tmux so whatever you left running is still there when you come back. The full terminal works without an account; get the termi1 terminal on the App Store.
Frequently asked questions
Can you run ssh-copy-id from an iPhone?
ssh-copy-id does not run on an iPhone, because iOS ships no local shell with the OpenSSH tools. From the phone, log in with a password and append the public key to ~/.ssh/authorized_keys using echo and >>. Alternatively, run ssh-copy-id -f -i from a computer that already reaches the server.
Which SSH key type should you generate on an iPhone?
The best SSH key type to generate on an iPhone is Ed25519, supported by OpenSSH since version 6.5 in January 2014. Avoid relying on the ssh-rsa SHA-1 signature, which has been disabled by default since OpenSSH 8.8. With a FIDO2 security key, the ed25519-sk type requires OpenSSH 8.2 or later.
Does the private SSH key leave the iPhone when using termi1?
A private SSH key generated in termi1 never leaves the iPhone: it stays in the system's secure storage and is never sent to termi1 servers. The optional account syncs connections and shortcuts, not private keys. The AI does not open the session and never receives keys or passwords.
What permissions does authorized_keys need for the key to work?
The authorized_keys file needs permissions of 600, and the ~/.ssh directory needs 700, both owned by the user. With StrictModes enabled, which is the sshd default, looser permissions make the server ignore the key and fall back to asking for a password.