Your agents.
Still running.
Close the laptop. Keep the momentum.
Connect to Claude Code, Codex, OpenCode, and Grok on your own machines. Pick up the same session from your desktop, browser, or phone.
Swipe horizontally to explore.
From your machine
to any screen.
Your work
goes with you.
Your hosts, already there.
Hosts saved in the desktop app appear on the web automatically — no re-entering addresses, users, and ports. The blob is encrypted in your browser before it leaves; the server stores ciphertext it can’t read.
Sessions that outlive the tab.
Sessions live on your machine, managed by aplexer — the session layer that knows which agent runs in each one. Close the laptop mid-refactor, attach again from anywhere, and the screen is exactly where the agent left it.
Works where clients can’t.
A tablet, a Chromebook, a locked-down work laptop — if it has a browser, it’s your terminal. A key you attach stays encrypted in that browser and travels once, over authenticated WSS, when you connect.
Choose your way in.
Desktop for the full workspace. Android for checking in. Web for a terminal in a tab.
Manage agent sessions, edit files, forward ports, and check provider usage. Import your hosts from ~/.ssh/config.
Manage agent sessions, dictate prompts and commands, and unlock key passphrases with biometrics. Your agents run on your own machines.
Connect to your synced hosts and use a real terminal in a browser tab. Works on tablets, Chromebooks, and machines where you can’t install an app.
Your infrastructure.
Your business.
Your host list is encrypted on your device. Here’s what happens before it reaches the sync server.
Read the security FAQStart with your passphrase.
PBKDF2-SHA256 derives an encryption key with 600,000 iterations. Your passphrase stays on your device, so there is no server-side reset.
Encrypt before it leaves.
AES-256-GCM encrypts your host list locally. Readable addresses, users, and ports never reach the sync server.
Sync only ciphertext.
The server stores the encrypted blob. Your other devices decrypt it with your passphrase; the server cannot.
They never sync. Each key is encrypted in your browser with your passphrase. On connection it travels over authenticated WSS to the PocketShell bridge, which uses it in memory and neither stores nor logs it.
Your graph could look like this.
Keep multiple agents working on your projects. Check their progress, review changes, and send the next prompt from wherever you are.
Alexey Grigorev’s GitHub activity across his projects. PocketShell is open source ↗
Notes from the terminal.
Practical notes on SSH, remote machines, and running AI agents on them.
Before you connect.
Who can see my host list?
Only you. The list is encrypted in your browser before it syncs — PBKDF2 with 600,000 iterations derives the key from your sync passphrase, AES-256-GCM encrypts the blob. The server stores ciphertext it cannot read, and the passphrase never leaves your device.
Is my SSH private key safe?
Private keys never sync. A key you attach to a host is encrypted with your sync passphrase and stored only in this browser. When you connect, the key travels once, over the authenticated WebSocket (WSS), to the PocketShell bridge — which uses it in memory to open your SSH session and neither stores nor logs it. The sync server never sees key material.
Do I need the desktop app?
No. The Android app works on its own. The one awkward part is getting an SSH key onto your phone, so we suggest configuring the key in the web or desktop app first, then using the mobile version from there.
Do I need to install anything on my servers?
Yes — the PocketShell CLI. That's the one thing to install on each host you want in PocketShell. Your agent sessions live on the machine — aplexer is the session layer that hosts them — and the desktop, web, and Android apps all work against those sessions. Nothing else to install.
Which devices can I use?
Desktop apps for Linux, macOS, and Windows, an Android app for your phone, and the web app in any modern browser — including tablets, Chromebooks, and locked-down machines where you can't install software.
What happens to my session when the tab closes?
The terminal in the tab ends with it — your agent doesn't. Sessions live on your machine under aplexer, the same session layer the PocketShell desktop and Android apps attach to. Reconnect from any browser, attach again, and the screen is exactly where your agent left it.
What if I lose my sync passphrase?
Then the synced blob is undecryptable — by design. Zero-knowledge means there is no reset: you set a new passphrase, re-upload your hosts, and re-encrypt the SSH key with it. That's the trade for a server that can never read your synced data.
What does it cost?
For now, nothing — PocketShell is in active alpha development, and it's free. Later, the open-source version stays free; syncing between your devices is the part that will be paid.
Step away.
Stay connected.
Check on your agents from your desktop, your phone, or any browser tab — same hosts, same account, same running sessions.
Open PocketShell ↗