Biometric Keys (Secure Enclave)

Termius for iOS and macOS allows you to generate a key inside Secure Enclave (SEP), an isolated hardware subsystem that comes with most Apple devices, and use it for SSH connections. The private part of such a key cannot be accessed by Termius or the operating system.

Before generating a key in Secure Enclave, you'll need to protect your device with a passcode, Touch ID, or Face ID. You will be asked to authenticate with one of these methods during connection.

As of now, it is possible to generate only 256-bit ECDSA keys.

Important: Resetting the passcode, Touch ID or Face ID will make all previously generated keys unusable.

Generate a biometric key

Important: Since the private part of a biometric key cannot be accessed by Termius, it will not be synchronized with your Termius account.

Export a biometric key

As with other kinds of keys, you can use Termius to add a key's public part to the authorized_keys file stored on a host. On iOS, the key will be automatically attached to that host's entry.