July 12, 2026 · Docker HQ Team

How to SSH Into a Server From Your Phone

You can SSH from phone to a server the same way you do from a laptop: install a terminal app that supports SSH, add your private key to it, then connect with ssh user@server-ip. On iOS, Termius or Blink Shell work well. On Android, Termius or JuiceSSH do the job. The only real difference from desktop is the on-screen keyboard, so key-based auth and saved connections matter a lot more.

This guide covers the full setup: picking an app, getting your key onto the phone safely, connecting, and running Docker commands once you're in. It also covers what to do when tapping out docker logs -f on glass gets old.

SSH from phone: what you actually need

Three things:

A terminal app with SSH support. Not the built-in Notes app, an actual client.
An SSH key pair, or a password if the server allows it (it usually shouldn't).
The server's address and username. An IP or hostname, plus the login user like root, ubuntu, or ec2-user.

If the server is behind a firewall, port 22 (or whatever port SSH listens on) has to be reachable from wherever your phone is. On mobile data that means the server needs a public IP or you need a VPN/Tailscale into the network. More on that below.

Step 1: Pick a terminal app

Here's the short list I'd actually recommend.

iOS

Termius: cross-platform, syncs hosts between phone and desktop, imports keys cleanly. Free tier is fine for basic SSH; some features are paid.
Blink Shell: a proper mosh + SSH client built for people who live in the terminal. Paid, worth it if you're serious.

Android

Termius: same app, same sync.
JuiceSSH: long-standing, lightweight, free with a cheap pro unlock.
Termux: a full Linux environment where you run the real ssh binary. Best if you want the actual OpenSSH client and shell scripting on your phone.

If you already use one on desktop, use its mobile version so your saved hosts and keys sync.

Step 2: Get an SSH key onto your phone

Password auth over a phone keyboard is miserable and less secure. Use keys.

You have two sane options.

Generate the key on the phone. In Termius, JuiceSSH, or Blink there's a "generate key" option. In Termux you run the real command:

ssh-keygen -t ed25519 -C "phone"

That creates ~/.ssh/id_ed25519 (private) and ~/.ssh/id_ed25519.pub (public). Then copy the public key to the server:

ssh-copy-id -i ~/.ssh/id_ed25519.pub ubuntu@203.0.113.10

Or append the .pub contents to ~/.ssh/authorized_keys on the server by hand.

Import an existing key. If you already have a key on your laptop, don't email it to yourself. Move the private key through your device's secure sharing (AirDrop on Apple, a password manager, or an encrypted note), import it into the app, and protect it with a passphrase. Treat a private key like a password, because it is one.

Use ed25519 keys. They're shorter and faster than RSA, and they're the modern default. RSA still works if you already have one, but ed25519 is what to pick for a new key.

Step 3: Connect

Save a host in your app: address, port, username, and the key. Tap it. You're in.

If you're in Termux or any client that gives you a raw prompt, it's the same command you already know:

ssh ubuntu@203.0.113.10

Non-standard port:

ssh -p 2222 ubuntu@203.0.113.10

First connection shows a fingerprint prompt. That's SSH asking you to confirm the server's identity. If you set this server up, accept it. If a fingerprint you've accepted before suddenly changes, stop and find out why before typing yes.

For a deeper walk through connection options and hardening, this complete guide to remote Docker management over SSH goes further than the phone-specific basics here.

Step 4: Run Docker once you're in

A phone shell is still a shell, so every Docker command works exactly as it does on a desktop. The catch is typing. Long flags on a touch keyboard are error-prone, so lean on short commands and saved snippets.

See what's running:

docker ps

Tail a container's logs:

docker logs -f --tail 100 my-container

Open a shell inside a container:

docker exec -it my-container sh

Check resource usage live:

docker stats

Restart something that's misbehaving:

docker restart my-container

Most mobile SSH apps let you save command snippets and give you an extra key row with |, -, /, ~, Tab, and arrow keys. Set that up early. Tab-completion and history (up arrow) save you from retyping container names.

If you connect to several machines, look at using Docker context to manage remote hosts so you can target a specific server without juggling SSH sessions manually.

Security: don't turn your phone into the weak link

A phone that can SSH into production is a production credential. Lock it down.

Disable password auth on the server. In /etc/ssh/sshd_config set PasswordAuthentication no and reload sshd. Keys only.
Put a passphrase on the private key and store it in the app's secure enclave / keystore. If your phone is unlocked in someone else's hand, the passphrase is the last gate.
Require the phone's biometrics to unlock the SSH app if it supports it. Termius and Blink both do.
Don't expose port 22 to the whole internet if you can avoid it. Use a VPN, WireGuard, or Tailscale so the server is only reachable from your devices. Tailscale is the easiest for a phone: install it, log in, and the server appears as a private hostname you can SSH to over any network.
Kill the key fast if the phone is lost. Because you copied only the public key to the server, revoking access is one line: remove that key from ~/.ssh/authorized_keys. That's a real reason to give each device its own key.

If you're weighing SSH against exposing the Docker daemon directly, read Docker over SSH vs TLS: which is safer before you open any daemon ports. Short version: SSH is the safer default for most people.

When the raw terminal gets tiring

SSH from a phone is great for a quick check or a restart. It's rough for anything longer. Reading wrapped log lines, scrolling docker ps output sideways, and remembering which of five servers you're on all fight the small screen.

This is the gap Docker HQ fills. It connects over the same SSH you just set up, using your existing key, and gives you tappable lists of containers, images, volumes, and networks instead of wrapped text. Logs are searchable, you can open a shell in one tap, and it pushes an alert to your phone when a host or a container goes down so you're not the last to know. There's a free tier and paid plans if you manage more than one host.

You don't have to choose. Keep a terminal app for the odd one-liner, use a purpose-built tool when you're actually on call.

Frequently asked questions

Can I SSH from my phone over mobile data (4G/5G)?

Yes, as long as the server is reachable from the public internet or you're on a VPN like Tailscale or WireGuard. Carrier NAT doesn't block outbound SSH, so the connection works fine on cellular. The server just needs a routable address your phone can reach.

Is SSH from a phone secure?

It's as secure as the key and the phone. Use ed25519 keys with a passphrase, disable password login on the server, lock the SSH app behind biometrics, and revoke a device's key immediately if the phone is lost. The SSH protocol itself is the same battle-tested transport you use on a laptop.

Do I need a jailbroken or rooted phone?

No. Every app mentioned here runs on a stock iPhone or Android device from the App Store or Play Store. Termux, Termius, Blink, and JuiceSSH all work without root or jailbreak.

How do I keep a session alive when my phone locks or switches networks?

Plain SSH drops when the connection changes. Use mosh (supported by Blink and Termux) instead, which survives IP changes and reconnects automatically after your phone sleeps or hops from Wi-Fi to cellular. For a persistent shell on the server side, run your work inside tmux or screen so you can reattach after a disconnect.

Next step

Generate an ed25519 key on your phone, copy the public half to one test server, and disable password auth on that box. Once key-only login works from your pocket, you've got the safe version of remote access. Roll it out to the rest of your hosts from there.