Security and privacy

ShellDrop keeps your connection details, passwords, and SSH keys on your device. There is no ShellDrop account, and no ShellDrop server sits in the path between your phone and the machines you connect to.

This page describes how that works, so you can decide whether it fits how you want your credentials handled.

Credentials and keys

• Passwords stay on the device. They are stored in the iOS Keychain with WhenUnlockedThisDeviceOnly, so they do not sync to iCloud and are removed if the app is deleted.
• SSH keys. Generate Ed25519 keys in-app, or P-256 keys backed by the Secure Enclave where the private key never leaves the hardware and signing happens inside the chip. Existing OpenSSH keys (Ed25519, ECDSA P-256/P-384/P-521) can be paste-imported.
• Optional Face ID per key. Any SSH key can be set to require Face ID, or your device passcode, each time it signs in to a server. Automatic reconnects within a short window do not re-ask, so a dropped connection retrying does not trigger a string of prompts.
• Secrets are never written to the local database. Passwords and keys are held in the Keychain and the Secure Enclave, and are excluded from the app's stored data.
• Passwords are zeroed from memory after they are used to authenticate, rather than left sitting in process memory.

Connections

• SwiftNIO SSH. Connections run on Apple's Swift SSH implementation.
• Trust on first use. The first time you connect to a host, ShellDrop records its key and warns you if that key changes on a later connection.
• Port validation. The destination port is validated before a connection is attempted.
• Output sanitization. Terminal output and tmux control sequences are sanitized before they are rendered.
• Bracketed paste. Pasted text is bracketed so a remote host treats it as pasted content rather than typed commands.

Sync and your data

• Connection details (host, port, labels) sync through your own iCloud using Apple's private CloudKit database. That data lives in your own iCloud account. There is no ShellDrop server holding it.
• Passwords and Secure Enclave keys are excluded from sync and stay on the device that created them.
• Removing your data. Deleting the app clears the on-device Keychain entries. Connection metadata in iCloud is managed from your own iCloud settings.

What ShellDrop does not collect

ShellDrop has no account or login, no analytics or usage tracking, and no advertising or marketing SDKs. No session data is collected, so there is nothing to sell or share. The full privacy policy has the detail.

Security reviews

The codebase has been through internal security reviews covering host-key handling, password zeroing, port validation, tmux output sanitization, CloudKit validation, keychain migration, and bracketed paste.

The whole app was also run through a Mythos-class multi-agent audit using a Glasswing-style pipeline, adapted from Cloudflare's Project Glasswing: a recon pass, then 8 hunter agents, then 3 verification agents. No critical or externally-reachable issues were found, the core posture held up, and a cluster of medium findings was fixed. There is a write-up on the blog.

To be straight about the scope: these are internal reviews, not a third-party penetration test, and the source is not currently public. If that matters for your use, it is worth knowing up front.

The trade-off

A cloud SSH manager syncs everything across every device and platform and stores it in the vendor's encrypted vault. That is convenient, and it means trusting the vendor's servers and account security. ShellDrop takes the device-first approach: a smaller footprint, your secrets on your own hardware, and less reach across machines. Both are reasonable ways to work. This page is here so you can see which one ShellDrop is.

---

ShellDrop is on the App Store. Universal iPhone and iPad, iOS 17+, and Apple Vision Pro on visionOS 2+.

Download on the App Store