TermRoad

Keys and identities

Import or generate SSH keys, and keep a username with its password or key as an identity.

Keys and identities live in Keychain. Both are stored only in your encrypted vault, never as files on your Mac.

Import a key

Choose to add a key, then paste the private key or choose a file. The file is read into the app; nothing is copied to disk. Both OpenSSH and PEM private keys work.

As you type, the app checks the key and shows its type and fingerprint, or tells you the passphrase is wrong. If the key has a passphrase, save it with the key so the app can use it without asking. You can also add an OpenSSH certificate for the key.

Once saved, the private key is hidden; choose Show to see it again.

Generate a key

When adding a key, choose Generate and pick the type:

  • Ed25519 (recommended);
  • ECDSA P-256 or ECDSA P-384, for servers that don’t accept Ed25519.

The new private key goes straight into your vault.

Put the public key on a server

Every key shows its public key, with two buttons:

  • Copy Public Key;
  • Copy authorized_keys Line, which uses the key’s label as the comment.

Add the line to ~/.ssh/authorized_keys on the server, and you can sign in there with the key.

Identities

An identity is a username together with its password, its key, or both: for example “deploy” with the deploy key. Give a host or a group an identity instead of typing the same details on every host. Changing the identity changes every host that uses it.

An identity counts as one unit: if a host uses one, the identity supplies the username, password and key together, and nothing is filled in from the host’s groups. A username, password or key typed on the host itself still wins. The full rules are in credentials.

When signing in, the app tries the key first, then the password.

Agent forwarding

Turn on Agent forwarding for a host (or a group) to let the server use your vault’s keys when you connect onward from it, for example to git pull from a private repository. The keys never leave your Mac: the server can ask the app to sign with them while the session is open. Ed25519 and ECDSA keys work, and RSA keys with SHA-2 signatures.

Only turn it on for servers you trust: while you’re connected, anyone with control of the server can use the forwarded keys.