SSH keys, import, and export

TermiGram supports password and SSH key authentication. For long-lived access, a dedicated SSH key with restricted server permissions is usually easier to rotate and audit than a shared password.

My SSH keys

The SSH key button on the home screen opens a reusable key library. From there you can:

create a modern ED25519 key in one step;
import an existing unencrypted private key;
rename a key and review its SHA256 fingerprint;
copy or download the public key;
copy or download the private key after a separate confirmation;
delete a key only when no server card uses it.

The ordinary key list never returns private-key material. Standard protection still encrypts the private key with TermiGram's server-side encryption. With Master Password enabled, the client first creates a tgmp1 envelope and the server encrypts that opaque envelope again at rest.

Passphrase-protected files

The current import accepts unencrypted private-key files. Do not strip the passphrase from your only recovery copy; create a dedicated TermiGram key or retain the original in a protected key manager.

Attach a key to a server quickly

Open SSH key from an existing server card and choose a library key or create one.
TermiGram connects with the currently working method: password or an already installed key.
On first use, compare the displayed host fingerprint with the provider panel or console.
TermiGram carefully appends the public key to ~/.ssh/authorized_keys and opens a separate verification connection with the new private key.
The server card is linked only after that connection succeeds. On failure, TermiGram attempts to remove only its own new line and will not overwrite unrelated file changes.

When creating a card, select a library key directly if its public key is already installed on the server. For a new password-only server, enable Install an SSH key after the first login. The password is used for bootstrap, but it is persisted only when Save password is enabled.

Password login is not disabled automatically

SSH Key Center installs and verifies the key but does not edit sshd_config or remove the password. Disabling password login is a separate guarded operation with preflight and rollback. Perform it only after key login is verified and a recovery path exists.

Parse SSH config

The SSH config parser can reduce manual entry for hosts, ports, usernames, and identity references. Review every imported field before saving; local aliases and proxy settings may not be portable to a mobile environment.

Import and export profiles

Profile import/export is useful for backup or migration. An exported file can contain sensitive connection material depending on the selected flow.

Protect exported data

Store exports in an encrypted location, do not send them through public chats, and delete temporary copies after a verified import.

Rotate a key

Generate a new key.
Add the new public key to the server.
Test a new TermiGram profile or updated credential.
Remove the old public key only after the new path works.