The best SSH client for a Mac: what you notice after a week
Every list of the best Mac SSH client contains the same names, and most of them are comparing different categories of thing without saying so. One entry is a terminal emulator. The next is a connection manager with an account and a subscription. The one after that is a mobile app. They all connect to a server, so they end up in the same list, and the list cannot tell you which one fits because the question depends on what the week looks like rather than on the feature count.
The useful frame is narrower. macOS already includes the client. What the paid and third-party options sell is everything around it: a host list, key handling, sessions that survive a closed lid, and the same setup on a phone. This looks at each of those, with what they cost today.
Three different things go by the same name
The ssh command on a Mac is OpenSSH, maintained by Apple and installed with the system. It does the connecting, the key exchange, the port forwarding and the file transfers. Nothing in the list below replaces it, and most of the entries call it.
A terminal emulator is the window that command runs in. Apple Terminal, iTerm2 and Ghostty are in this category. They decide tabs, splits, fonts, colours, scrollback and keyboard handling. Swapping one for another changes none of the SSH behaviour: the same ~/.ssh/config, the same keys, the same known hosts.
A connection manager stores the list of servers and their credentials, and usually syncs that list between devices. Termius and Prompt are in this category. They add a graphical host list, a vault for keys and passwords, snippets, and in some cases session logs. This is the category where subscriptions appear, because syncing between devices means running a service.
Mixing those three together is what makes the lists confusing. A recommendation to use iTerm2 and a recommendation to use Termius are not alternatives to each other. Many people run both.
The options side by side
| Option | Category | Price checked today | Platforms | Where it is strongest |
|---|---|---|---|---|
| Apple Terminal with OpenSSH | Terminal emulator | Included with macOS | Mac | Already installed, reads ~/.ssh/config, New Remote Connection for saved hosts |
| iTerm2 | Terminal emulator | Free, GPL v2, macOS 10.14 or newer | Mac | Split panes, hotkey window, triggers, tmux integration |
| Termius | Connection manager | Starter free; Pro $10 per month paid annually; Team $20 per seat; Enterprise $30 per seat | Mac, Windows, Linux, iOS, Android | Host list with tags, vault, snippets, sync across desktop and mobile |
| Prompt 3 | Connection manager | One purchase covering four platforms; Panic Sync included at no charge | Mac, iPhone, iPad, visionOS | Mosh and Eternal Terminal, jump hosts, Touch ID and Face ID on favourites |
| Secure ShellFish | Connection manager | Free to try, then a lifetime unlock or a monthly option | iOS, iPadOS, Mac | Servers appear in the Files app and Finder, widgets, security keys and SSH certificates |
| Blink Shell | Mobile terminal | Two weeks free, then $19.99 per year | iOS, iPadOS | Mosh for roaming between networks, local UNIX tools |
Prices and platform lists were read today on each vendor's own site. They change, so check before buying, particularly the seat prices, which are quoted per user and per month.
The built-in client, and what it actually lacks
A surprising number of setups never need more than what ships with the Mac. ~/.ssh/config is a host list: a name, a hostname, a user, a port, a key file, and the connection becomes one short word. The agent plus the Keychain remove the passphrase prompt. ProxyJump handles a bastion host in one hop. Apple Terminal even has a New Remote Connection panel for saved hosts, which few people ever open.
What it lacks is not features but surface. The host list is a text file, so it does not sort, search, tag or show which machines are reachable. Nothing syncs to a phone. Credentials that are not keys, such as a password for a device that only accepts passwords, have nowhere to live except a separate password manager. And the list is yours to maintain: an entry for a server that no longer exists sits there until somebody deletes it.
For one person with ten servers and keys everywhere, that is a fair trade and costs nothing. The trade turns at roughly the point where the servers outnumber what you can remember, or where somebody else needs the same list.
What a connection manager is actually selling
Two things, mostly: a searchable inventory, and the same inventory somewhere else.
Termius publishes a free tier that includes a local vault, SSH and SFTP, port forwarding and its autocomplete, and states that the free tier may be used commercially. The paid tier at $10 per month paid annually is where the cloud vault and sync across mobile and desktop appear, along with session logs and snippet automation. Read in that order, the pricing makes the product clear: the client is free, the syncing is the product.
Prompt takes the other approach. Panic sells it as one purchase that covers Mac, iPhone, iPad and visionOS, and states that Panic Sync for servers, keys and passwords is included at no extra charge. Its own list leads with Mosh and Eternal Terminal support for connections that survive a bad network, jump hosts, and encrypting favourites behind Face ID or Touch ID.
Neither of those is a better answer in the abstract. Subscription versus one purchase is the same decision as anywhere else: a subscription keeps the latest version while the payments continue, and a single purchase covers what was bought. What is worth checking in both cases is where the vault lives, because a synced vault means the host list and the credentials leave the Mac, even when they leave encrypted.
The security details worth checking before committing
Clients differ most in where the private key is allowed to live, and this is the part of a feature list that repays reading closely.
The plain arrangement is a key file in ~/.ssh protected by a passphrase, with the passphrase in the login Keychain. It is simple and it is good enough for most people, with one property worth naming: a file on disk can be copied. Anything that reads the home folder reads the key too, and the passphrase is the only thing standing in the way.
The stronger arrangements remove the file. Secure ShellFish lists authentication with security keys, with short-lived SSH certificates issued by a certificate authority, and with keys held in the Secure Enclave, which means the private key cannot be exported at all. Prompt lists YubiKey support for two-factor use and encrypts favourites behind Face ID or Touch ID. If a hardware key is already in a drawer, checking that the client supports it is a five-minute decision that changes the risk profile permanently.
Certificates deserve a mention of their own, because they solve a problem that keys do not. With keys, every server needs a copy of every public key in authorized_keys, and removing somebody's access means editing files on every machine. With a certificate authority, servers trust the authority instead, certificates expire on their own, and revoking access is one change in one place. For anyone who already runs a CA for other reasons, client support for short-lived certificates is the feature to filter on, and it narrows the list quickly.
Two smaller checks round it out. Session logs, which Termius lists on its paid tier, are useful for reconstructing what was typed during an incident and are also a record of everything typed, so they are a decision rather than a bonus. And host key handling is worth one test: connect to a server whose key you have deliberately changed, and see whether the client warns clearly or simply reconnects. The client that reconnects quietly has removed a protection, not an annoyance.
The Mac and the phone are one question
The reason mobile apps appear in a Mac list is that the actual need is continuity. A job runs long, the laptop closes, and the question becomes how to see the output from a train.
There are two shapes of answer, and they are not equivalent. The first is a second SSH client on the phone, which opens a new connection to the server. Blink Shell, Secure ShellFish and Prompt all do this, and Mosh, which Blink and Prompt both support, exists precisely because a phone changes networks constantly and plain SSH does not survive that. Secure ShellFish adds a detail that matters more than it sounds: server directories appear in the Files app and in Finder, so a remote folder behaves like a local one.
The second shape is reaching the session that is already open on the Mac, rather than starting a new one on the server. That is a different job, and it is the only one that answers the case where the work is running on your own machine at home instead of on a server. A comparison of file managers is a strange place to look for this, but it is where the distinction shows up, because reading the Mac's own terminal from a phone belongs to the tool that owns the window rather than to an SSH client.
The four things you notice after a week
Feature lists are long. The differences that survive a week of use are short.
Where the host list lives. A text file, a synced vault, or your memory. This decides more of the daily experience than the terminal you picked.
Whether the passphrase prompt is gone. Keys in the agent with the passphrase in the Keychain, or a vault that unlocks with Touch ID. If a prompt appears on every connection, nothing else about the client matters much.
What happens when the network drops. Plain SSH ends the session. tmux on the server survives it. Mosh survives the roaming. Choosing nothing here means losing work occasionally and blaming the client.
How far away the files are. This is the one no SSH client fixes. The session is in one window and the material is in another, and every check is a switch. People who spend their day between a folder of source files and a running agent usually end up putting the folder and the terminal in the same window instead, which is a category of tool rather than a setting. Its pricing page is worth a look mainly because the part that replaces the two-window habit is generally the free part.
What to change first
Start with the free path: put the hosts you type most into ~/.ssh/config, get the key into the agent with the Keychain, and use the built-in client for a week. If the friction that remains is the host list, buy a connection manager. If the friction that remains is switching between the folder and the session, that is what Atriens is for.
Frequently asked questions
Is a paid SSH client necessary on a Mac?
No. The OpenSSH client that ships with macOS covers keys, port forwarding, jump hosts and file transfer, and ~/.ssh/config gives every server a short name. Paid clients sell the host list, the synced vault and the mobile side, not the connection itself.
What is the difference between iTerm2 and Termius?
iTerm2 is a terminal emulator, so it changes the window the ssh command runs in. Termius is a connection manager, so it stores and syncs the servers and credentials. They sit in different layers and are commonly used together rather than instead of each other.
Which client keeps a session alive when the network changes?
Mosh is the usual answer, and both Blink Shell and Prompt support it. Running tmux on the remote machine solves the same problem from the other side, since the session keeps running on the server after the connection ends.
Does a synced host list mean the credentials leave the Mac?
With a cloud vault, yes, in encrypted form, which is the trade for having the same list on a phone. Termius separates this explicitly by keeping the local vault on the free tier and putting the personal cloud vault on the paid one, so keeping everything on the machine is a choice rather than a limitation.
What is the cheapest way to reach a Mac at home from an iPhone?
Two parts: a way in that does not involve opening port 22 on a router, such as a private overlay network or a relay, and something on the phone to read the session with. The cost depends on whether the work is on a server, where any mobile SSH client will do, or on the Mac itself, where reaching the session already open there is the more direct route.