Biometric Keys (SEP, Keystore)

Termius for iOS, macOS and Android allows you to generate an SSH key inside an isolated hardware subsystem and use it for SSH connections. The key is generated inside Secure Enclave (SEP) on iOS and macOS and Keystore on Android. The private part of such a key cannot be accessed by Termius or the OS.

Before generating a key in Secure Enclave / Keystore, you'll need to protect your device with Touch ID / fingerprint, Face ID / face recognition, or passcode, if you're using iOS or macOS. You'll be asked to authenticate using one of these methods during a connection.

As of now, it is possible to generate only 256-bit ECDSA keys.

Note: Generating a biometric key requires Android 9 or a newer version.

Important: Resetting the protection of your device will make all previously generated keys unusable.

Generate a biometric key

Important: Since the private part of a biometric key cannot be accessed by Termius, it will not be synchronized to your other devices with Termius.

Export a biometric key

As with other kinds of keys, you can use Termius to add a key's public part to an authorized_keys file stored on a host. On iOS, the key will be automatically attached to that host's entry.