SSH · SFTP · FTP — iOS and Android
Shellter is an SSH, SFTP and FTP client with no account, no sync and no telemetry. Your servers, keys and passwords stay on the phone you typed them into.
~/what-is-stored
This is the complete list. There is no fourth column for “shared with partners”, because there are no partners.
| Data | Where it lives | Leaves the device |
|---|---|---|
| Passwords, private keys, key passphrases | Platform keychain / keystore, hardware-backed where available | Never |
| Connection details | Local database in the app’s private container | Never |
| Pinned host-key fingerprints | The same local database | Never |
| Theme and terminal font size | A file in the app’s private container | Never |
| Files you download | A Downloads folder you can open in Files | Never |
~/security
Most apps market every protocol as “secure”. These are not equally secure, so here is what each one actually gives you.
The host key is pinned the first time you connect and compared on every reconnect. A mismatch stops the connection before authentication, so a password is never sent to a server that failed the check. Continuing takes an explicit decision.
Traffic is encrypted, but the underlying FTP library accepts any TLS certificate it is offered. That defeats passive eavesdropping. It does not stop an attacker who can intercept the connection. Prefer SFTP.
Your username, password and every file travel in the clear. It is here because real servers still require it, and it is labelled everywhere it appears in the app, including on the connection screen.
~/screens
~/features
Interactive shell rendered with xterm. It follows the keyboard, resizes the remote PTY when you rotate the phone, and keeps 10,000 lines of scrollback.
Open the file browser from inside a live session and it reuses that SSH connection rather than opening another one. Transfers report real progress.
Private keys and passwords go to the iOS Keychain and Android EncryptedSharedPreferences, hardware-backed where the device supports it. The app never writes a secret to its own database.
The fingerprint is pinned on first connect and checked every time after. You can review every pinned key, and forget one to re-pin it.
There is nothing to sign up for. The app makes no network request except to the servers you type in yourself. No analytics, no crash reporting, no ads.
Light and dark themes, full support for the system text size, and layouts that reflow rather than clip — down to a 4-inch phone in landscape.
~/questions
Into the platform’s own secret store: the Keychain on iOS, EncryptedSharedPreferences on Android, hardware-backed on devices that provide it. They are read only to open a connection, and they are never written to the app’s database, never logged, and never included in an error message.
Deleting a connection removes its stored secrets at the same time.
No, and that is enforced rather than assumed. On Android the app opts out of Google cloud backup and device-to-device transfer. On iOS credentials are stored “this device only”, so they are not carried into an encrypted backup or restored onto another phone. Moving to a new device means entering your connections again — deliberately.
The connection stops before authentication and you get a blocking dialog showing both fingerprints — the one pinned on your device and the one the server just offered. Nothing is sent until you choose. A key legitimately changes when a server is rebuilt, so the dialog lets you re-pin, but it makes you say so.
Plain FTP is not: credentials and file contents travel in cleartext. FTPS encrypts them, but the FTP library the app uses accepts any TLS certificate, so it does not protect against an active attacker. Both are supported because real servers still require them, and both are labelled as such in the app rather than quietly presented as secure. Use SFTP over an SSH host where you can.
The source is on GitHub, so the claims on this page can be checked against the code rather than taken on trust.
Shellter