Authentication
DR-Terminal supports three auth methods: password, private key, and FIDO2 (YubiKey) security key.
Password
The simplest route. A password entered on a saved connection lands in the platform's secure store — never in JSON config. If the password field is empty the app asks every time you connect.
Public-key → password fallback: when the server rejects a public key (e.g. it isn't in authorized_keys), DR-Terminal automatically asks for the password for the same user instead of dropping the connection.
Private key
Keys in OpenSSH, PKCS#1, PKCS#8, ssh.com or PuTTY PPK (v2/v3) format are all accepted — the format is detected automatically, so a .ppk key works without converting it first. You can:
- Paste the key directly into the connection form.
- Use the key manager (Settings → Security → SSH keys) and select a stored key. Key files imported here can additionally be raw binary DER.
If the key is encrypted with a passphrase, DR-Terminal asks for it the first time the key is used and then keeps it in memory only — like ssh-agent, one unlock per app run; closing the app locks every key again. Imported encrypted keys stay in their original encrypted form in the secure store. We support many algorithms — RSA, ECDSA (P-256, P-384, P-521), Ed25519, Ed25519-SK, ECDSA-SK (FIDO).
Key generator
Settings → Security has a Generate SSH key wizard. Pick the type (e.g. ed25519), set a passphrase (optional — it protects the key even inside the secure store), and the key is saved locally. The default key comment is ${user}@${host}@DR-Terminal — handy for spotting the key on the server. The public key can be copied to the clipboard for ~/.ssh/authorized_keys on the server.
Keys in the list can be renamed in-place; if the name you pick collides with an existing one, the app appends (2) automatically.
Key converter
Settings → Security → SSH keys → Convert re-serialises a private key between every common format — pick a source (a stored key, a file, or pasted text) and a target format, then copy, share or save the result.
Formats, both ways:
| Format | Read | Write |
|---|---|---|
OpenSSH (BEGIN OPENSSH PRIVATE KEY) | ✓ | ✓ |
PKCS#8 (BEGIN PRIVATE KEY) | ✓ | ✓ |
PKCS#1 (BEGIN RSA PRIVATE KEY, RSA only) | ✓ | ✓ |
| PuTTY PPK — v2 and v3 | ✓ | ✓ |
Input can be PEM (text), PuTTY PPK, or raw binary DER — the format is detected automatically. Key types: RSA, Ed25519 and ECDSA (P-256/384/521).
- PuTTY PPK export now works both ways (previously the app could only read
.ppk). Choose v3 (Argon2id KDF + HMAC-SHA-256, modern PuTTY) or v2 (older PuTTY) with the version selector. Files produced this way load in PuTTY/puttygenunchanged. - Optional export passphrase. Leave it blank for an unencrypted key; set it and the output is encrypted with a strong per-format KDF (bcrypt / PBKDF2 / Argon2id). See Security & data → Exported keys.
- If conversion fails (wrong source passphrase, incompatible format) the app now shows the actual reason rather than a generic error.
PKCS#1 only describes RSA keys, so that target is offered only when the source is an RSA key.
Switch a password connection to a key
You don't have to edit authorized_keys by hand. For a saved password connection DR-Terminal offers a guided upgrade in two places:
- Connections list — the key icon on a password connection's card starts the migration wizard.
- Inside a session — the terminal menu of a connected password session has Switch to SSH Key.
Both run the same flow: pick a stored key or generate a new one, DR-Terminal deploys the public key to the server over the existing password login, tests that key authentication actually works, and only then switches the saved connection to key auth. If the test fails, the connection is left unchanged.
Security key (FIDO2 / YubiKey)
DR-Terminal handles ed25519-sk and ecdsa-sk keys — and you can generate them from inside the app. No external ssh-keygen needed.
Generate a YubiKey-backed key in DR-Terminal
- Settings → Security → SSH keys → Generate SSH key.
- Flip the Security key switch on. Pick the algorithm — Ed25519-SK (recommended) or ECDSA-SK.
- Touch your YubiKey when prompted. The app asks the token to create a new credential and signs the public key.
- The key is stored in DR-Terminal's key manager. Copy the public key and paste it into
~/.ssh/authorized_keyson the target server.
Windows Hello: on Windows the FIDO2 PIN prompt is the native Windows Hello dialog (PIN / fingerprint / face), not an in-app dialog.
Resident keys (stored on the YubiKey itself) eliminate the need to carry the key file — the entire secret lives on the token. Keys generated in DR-Terminal are non-resident: the credential handle is kept in the key manager and is needed together with the token.
Using an existing SK key
If you already have an id_ed25519_sk / id_ecdsa_sk generated elsewhere (e.g. via ssh-keygen -t ed25519-sk), import it via the same key manager — DR-Terminal treats imported and generated SK keys the same way.
At connect time
DR-Terminal requests a touch on your key. The indicator blinks — tap it. iOS supports NFC and USB-C (YubiKey 5Ci and later). Android — NFC + USB (OTG). Desktop uses native FIDO2 APIs (Windows Hello, macOS, Linux via libfido2).