SSH, SFTP & remote tools

What you can do

• Search with Search hosts…: it matches the name, the hostname and the tags.
• Filter with the group chips: All, then one chip per group and subgroup (a group's chip includes its subgroups). Manage groups opens the group manager.
• With a group selected, Connect all (N) connects every host in it and in its subgroups.
• Starred hosts are listed under Favorites, the rest under All Hosts.
• Tap a host to connect. The menu on each card has Connect, Favorite, Edit and Delete.
• Add Host opens the form; Quick opens Quick Connect.
• In the group manager, New group takes a Name, a Parent group, a Theme (inherited by hosts) and Auto-record sessions: hosts in that group and its subgroups start the session log (the LOG badge) as soon as they connect. Delete group leaves its hosts without a group.

What you can't do, and why

• Save a second host on Free, by any door: Add Host, Quick Connect, the imports (JSON, SSH config, CSV) and the cloud-instance import all stop at 1 saved host and show the Terminal Pro wall. The limit is 1 saved host.Pro
• Give a whole group a proxy, a default identity or environment variables: only the theme and Auto-record sessions can be set on a group.Not yet

What you can do

• Connection: an optional Label, the Hostname, the Port (22 by default) and the Username.
• Authentication → Auth Method: Password, Key Pair or Keyboard Interactive. The password is stored encrypted; when you edit a host the field reads (unchanged).
• With Key Pair, pick a key from SSH Keys (device-bound ones are marked), or choose Paste manually and paste the private key, with its Key Passphrase if it has one. The passphrase field isn't shown for device-bound keys.
• With Keyboard Interactive the server asks for what it needs during the connection, for example a one-time code: You will be prompted during connection.
• Use identity fills in the username and the credential from a saved identity; Save as identity saves the current ones. An identity is a template copied into the host, not a live link: changing it later doesn't change hosts that already used it.
• Organization: pick a Group and add comma-separated Tags.
• Advanced: Proxy / Jump Host with a SOCKS5 or HTTP proxy (host and port); Jump host, another saved host used as a bastion, up to 3 hops, which appears once you have another saved host; and the Agent Forwarding switch.
• Pick a Color and star the host as a favorite.

What you can't do, and why

• Set a startup command or saved port forwards on a host: the form has no field for them, and saving a host from the form clears both.Not yet
• Use the SSH Jump Host chip on its own: it is kept for old data and does nothing. The working jump is the Jump host list.Not yet

What you can do

• Type user@host or user@host:port in Connection String; an IPv6 address goes in brackets, user@[::1]:22. A preview shows the user, the host and the port.
• Type the password in Password (optional) and tap Connect. The button stays off until the text contains an @.
• The host is saved in Hosts before connecting, when the plan has room. On Free with 1 host already saved, it still connects, but the new host isn't saved and the Terminal Pro wall opens.

What you can't do, and why

• Connect with a key or a one-time code: Quick Connect always makes a Password host, and without a password the tab says Error: No password stored for this host. Use Add Host for keys and Keyboard Interactive.Not yet

What you can do

• Read the Host, the Key Type and the Fingerprint (in SHA256: format) and compare it with the one your server shows.
• A new server shows Verify Host Key: Trust & Connect saves the key and continues; Reject cancels.
• If the saved key and the server's key differ, the dialog is titled Host Key Changed!, shows the Previous fingerprint and warns of a possible man-in-the-middle attack. Continue only if you know the server was reinstalled or reconfigured.
• If you don't answer within 60 seconds, the connection is refused.

What you can't do, and why

• See or remove the list of trusted servers: there is no screen for it. You can add entries by importing a known_hosts file.Not yet

What you can do

• Answer each prompt in its Response N field (the text is hidden or shown as the server asks) and tap Submit. Cancel drops the attempt.
• You have 120 seconds to answer.

What you can't do, and why

• Save the answers: every connection asks again.By design

What you can do

• Spot device-bound keys by their Device-bound badge.
• Import a private-key file from your phone with the system file picker; the file name becomes the label.
• Generate Key creates a new pair (next section).
• Copy Public Key puts the public key on the clipboard.
• Deploy appends the public key to ~/.ssh/authorized_keys on the server of the session in focus, creating the folder with mode 700 and the file with mode 600. The button appears while a session is open. The tab prints [Key deployed to authorized_keys] once the command has run; PocketCode doesn't check its result, so try the key afterwards.
• Delete removes the key; for a device-bound key it also deletes it from the Android Keystore.

What you can't do, and why

• Copy or deploy the public key of an imported key: the app keeps no public key for imports (the card shows imported instead of a fingerprint). An imported key only signs connections.Not yet
• Export the private key of a device-bound key: it never leaves the Android Keystore.By design

What you can do

• Fill Key Label and pick a Key Type with its Bit Size: RSA (2048 or 4096, 4096 preselected), ED25519 (256), ECDSA (256, 384 or 521), DSA (1024) or DEVICE-BOUND.
• Add an optional Passphrase to the private key (not for DEVICE-BOUND).
• DEVICE-BOUND creates an ECDSA P-256 key inside the Android Keystore. The private key can't be exported, copied or synced; only the public key leaves the phone. Require recent biometric/PIN to sign is on by default: the key then signs only within 30 seconds after you authenticate with your biometrics or device PIN. PocketCode doesn't show a prompt of its own when connecting.

What you can't do, and why

• Use a device-bound key on another phone or restore it from a backup.Device

What you can do

• A long press on a tab opens Rename, Duplicate session (for tabs that came from a saved host) and Close other tabs (when there is more than one).
• Closing a tab that is still connected asks Close active session?: closing disconnects it and stops its port forwards. Close other tabs always asks.
• When the network comes back, PocketCode reconnects dropped sessions by itself. The switch is Settings → Terminal → Terminal auto-reconnect, on by default. The tab prints [Network connection lost] and later [Network restored — reconnecting…].

What you can't do, and why

• Have more than one session open on Free: opening another tab, connecting a second host, Duplicate session and Multiplexed Shell show the Terminal Pro wall. The limit is 1 live SSH session; a local shell on the Terminal screen is counted separately.Pro
• Keep sessions running in the background without help from Android: it may pause or drop SSH sessions and port forwards when you switch apps unless PocketCode is excluded from battery optimization. The app asks once: Keep SSH sessions alive in the background → Open settings.Device

What you can do

• Multiplexed Shell opens another shell on the same SSH connection in a new tab named <host> (mux).
• Broadcast sends every command you type to all connected tabs at once; local-shell tabs that are connected receive it too. While it is on, the BROADCAST badge shows; tap Broadcast OFF to stop.

What you can't do, and why

• Use Broadcast on Free: it shows the Terminal Pro wall.Pro
• Reach Broadcast and Multiplexed Shell from the docked panel on a wide screen: they exist only in the tools menu, which the docked layout hides. Make the window narrower than about 660 dp, or switch split view on (Pro), to get the menu back.By design

What you can do

• Browse the server: folders first, then files, each row with its permissions and, for files, its size. Tap a folder to open it and use the back arrow to go up.
• New Folder, and from the More options menu of a row, Rename or Delete.
• Long-press a row to start selecting, tap to add more, then delete them together. You are asked Delete N selected items? This can't be undone. Each item is deleted on its own, so one failure doesn't stop the rest.
• Dual-pane view switches to the two-panel layout.

What you can't do, and why

• Download, upload or open a file from this view: tapping a file does nothing, only folders open.Not yet
• Delete a folder that still has files in it: folders are removed with the SFTP rmdir call, so empty them first.By design
• See why an operation failed: errors aren't shown. A folder that can't be read looks empty (This directory is empty), and a failed rename or delete leaves the list as it was.Not yet

What you can do

• The Local pane starts in the folder that holds your projects; the Remote pane starts at /. Tap a folder to open it and use the arrow at the top of a pane to go up.
• Go back with Single-pane view.

What you can't do, and why

• Copy a file between the panes by dragging it: the sheet offers it, but the drop isn't connected to the transfer yet, so nothing is copied.Not yet

What you can do

• See queued transfers (Waiting, Complete, Failed), cancel one, or clear the finished ones with Clear Completed.

What you can't do, and why

• Add a transfer to the queue: nothing in the app sends files to it yet, so it always reads No active transfers.Not yet

What you can do

• Tap Attach file and pick a file: it is uploaded over SFTP to /tmp/<file name> on the server, and the path is typed into the input bar, ready for your next command.

What you can't do, and why

• Choose the destination or keep an existing file: the file always goes to /tmp, and one with the same name is overwritten.By design

What you can do

• Add Rule opens a form: Type (Local (L), Remote (R) or Dynamic), Label, Local Port, Remote Host (preset to localhost), Remote Port and Auto-Start.
• Local (L) listens on a port of your phone and sends the traffic through the server to Remote Host:Remote Port, as the server sees it. For example, reach a database on the server through localhost:5432.
• Remote (R) listens on Remote Port on the server and sends the traffic to Remote Host:Local Port, reached from your phone (localhost by default). For example, expose a dev server running on the phone.
• Each rule shows Active or Stopped; start or stop it, or delete it.
• Closing the tab or disconnecting ends the session's forwards.

What you can't do, and why

• Have more than 1 rule at a time on Free (counted on the session in focus).Pro
• Use Dynamic as a SOCKS proxy: the rule is labelled SOCKS Proxy and logs SOCKS5 proxy on localhost:N, but the app implements it as a plain forward of that port to localhost on the same port number, not as a SOCKS5 proxy.Not yet
• Keep rules between sessions: they aren't saved with the host, so Auto-Start has nothing to start on the next connection.Not yet

What you can do

• New connection: protocol VNC (port 5900) or RDP (3389), a label, host, port, a username (RDP) and a password, a quality level and View only.
• Conectar opens a direct connection to that host and port (not through SSH), does the VNC handshake (no authentication, or a VNC password) and prints Connected: with the server's name and screen size in a new tab, plus any bell or clipboard text the server sends.

What you can't do, and why

• See or control the remote screen: the connection reads the screen updates and discards them, and there is no view and no mouse or keyboard input.Not yet
• Use RDP: choosing RDP runs the same VNC code and there is no RDP client.Not yet

What you can do

• See Detected devices, the USB devices Android reports.
• Add configuration: Device (empty = auto), Baud (115200 by default), Bits (8), Stop (1) and a parity menu labelled Paridad (Ninguna, Impar, Par, Mark, Space). That menu and the Guardar and Cancelar buttons are in Spanish whatever the app language.
• The play button of a saved configuration connects: it looks the device up through Android's USB host API, opens its serial data interface and sets the line coding; the tab says Connected to … on success.
• The first time, Android's own dialog asks for permission to use the USB device (the tab says Requesting USB permission for <device>…). Allow it and the connection goes on; PocketCode waits up to 60 seconds for your answer.

What you can't do, and why

• Connect after refusing the USB permission, or after 60 seconds without answering its dialog: the tab prints USB permission not granted for <device> and the session ends in error. Tap play again to retry.Device
• Use an adapter that doesn't expose a CDC or vendor-specific data interface with bulk endpoints: the tab prints USB device does not have expected CDC serial endpoints.Device

What you can do

• Tap a chip to run that provider's CLI on the server of the session in focus (aws ec2 describe-instances, gcloud compute instances list, az vm list, doctl compute droplet list, kubectl get pods, docker ps). The CLI has to be installed on the server. The tab prints [Cloud discovery (AWS): N bytes received].
• Import instances (JSON): paste a JSON array such as [{"provider":"AWS","name":"…","publicIp":"…"}]. Every instance with an IP address is saved as a host (user root, port 22, tagged with its provider) and appears under Instances (N) with Connect. On Free only as many as the 1-host limit allows become hosts, but every instance still appears under Instances (N); the Terminal Pro wall opens for the rest.

What you can't do, and why

• Import instances automatically: discovery only prints how many bytes the CLI returned and doesn't turn the output into instances. The JSON has to be pasted.Not yet
• Connect to an imported instance without adding credentials first: imported hosts are Password hosts with no password saved. Edit the host to add a password or choose a key.Not yet

What you can do

• Add watchdog: Label, Command (preset systemctl is-active nginx), Expected output (preset active) and Interval (seconds) (preset 60).
• Start or stop a monitor with its switch, or delete it. The first check runs after one interval.
• Each check runs the command over the session that was in focus when you started the monitor. If the output doesn't contain the expected text (case is ignored), the tab prints ⚠ Watchdog alert: <command> → <output> and the monitor is marked as failed.

What you can't do, and why

• Create a watchdog on Free.Pro
• Get a system notification: alerts are lines in the terminal tab, and monitors only run while the app is running.By design
• Tie a monitor to one host: it runs on whichever session is in focus when you start it.By design

What you can do

• Create webhook: Name, Select host and Command. Each webhook shows its link, pocketcode://terminal/webhook/<id>?secret=<secret>, masked on screen with a copy button, plus an Active / Inactive switch, N executions and Delete.
• When something opens the link, PocketCode checks the id and the secret. Only if the webhook is on and both match does it ask Run automation? (A link asked to run the rule “X” on HOST.). Run connects to the host and sends the command; Cancel does nothing. A wrong secret gets no reply at all.

What you can't do, and why

• Create a webhook on Free.Pro
• Run a webhook unattended: every trigger asks for your confirmation first.By design
• Trigger a webhook from the web: there is only the pocketcode:// link. The app doesn't open a listening port on your phone to run commands on your servers.By design

What you can do

• List the installed packages of the host (it reads pkg list-installed and, if that fails, dpkg -l, keeping the installed ones), search them with Search packages… and refresh.
• Update All (apt update && apt upgrade -y), List All, Clean (apt autoclean) and Install (asks Enter a package name: and runs apt install <name> -y).
• On a package: its info (apt show) and remove (apt remove <name> -y).

What you can't do, and why

• Use another package manager (yum, dnf, apk…): the commands are fixed to apt.Not yet
• Run commands with sudo automatically: they run as your SSH user as typed, so on a server where that user isn't root they can fail with a permission error.By design

What you can do

• Sync builds a backup of your hosts, your snippets and a few terminal settings; the switches under Data to sync choose what goes in. Last sync shows when it ran.
• Connections in your account (a separate path from this backup): with Enable Sync on in the Settings Sync dialog of Settings (Cloud Sync, a Pro feature) and Connections (SSH/DB) ticked, saving, editing, starring or deleting a host sends its details to your PocketCode account: name, address, port, username, authentication type, tags, favorite, group, proxy and the agent-forwarding setting. Passwords, keys, passphrases and the startup command stay on the phone. Hosts that arrive through the JSON, SSH config or CSV imports are not sent. The same box also carries the connections of the Database module, but only with their own, smaller set of details (name, host, port, engine and group): never a username or a password. With Cloud Sync off, or that box unticked, nothing is sent.
• End-to-End Encryption → Enable encryption asks for a Master password and encrypts the backup with AES-256-GCM, with a key derived from the password (PBKDF2, 100,000 rounds). It cannot be recovered if you lose it.

What you can't do, and why

• Get the synced hosts back on another device: the app keeps the list it downloads, but nothing turns it into hosts.Not yet
• Send this backup to another device or a cloud: the backup is written to a file inside the app (terminal_sync_backup.json) and nothing is uploaded; the app has no way to restore from it.Not yet
• Include SSH keys: the SSH Keys switch exists, but the backup never contains keys.Not yet

What you can do

• Host a room: give it a Room name and share the 6-digit code it shows.
• Join a room: nearby rooms are found on the local network, or you type the 6-digit code. The host sees New request (N wants to join) and taps Accept or Reject.
• The member list shows each role: Read only, Read & write or Admin. The host can change roles and remove members; anyone can Leave room and the host can End room.
• The traffic between devices is encrypted (ECDH key agreement and AES-GCM). On Android 13 and later, the first time you host a room, look for rooms or join one, Android asks for the nearby-devices (local network) permission; until you grant it, those three actions stay blocked.

What you can't do, and why

• Share hosts or snippets in a room: the hint says to host or join a room to share them live, but only members and roles work today.Not yet
• Use a room outside your local network: discovery and the connection are LAN only.Needs network
• Keep a room after the app restarts: a room exists only while it is active.By design

What you can do

• The JSON has your hosts (name, address, port, username, authentication type, tags, color, favorite and startup command), your groups (name, color, icon) and your own snippets, not the predefined ones.

What you can't do, and why

• Export passwords, keys or settings: they are never in the JSON. Importing it back recreates the groups but doesn't put hosts back in them.Not yet
• Encrypt the export with a password, save it as a file or show it as a QR code: the text is plain and copy and paste are the only way in and out.Not yet

What you can do

• JSON: the export above. Hosts already saved (same hostname, port and username) are skipped.
• SSH config: each Host block becomes a host; blocks with a wildcard pattern such as Host * are skipped. A block with IdentityFile becomes a Key Pair host without the key, and ProxyJump becomes a Jump host when it points to a host that exists.
• known_hosts: plain-text entries become trusted servers; hashed entries (the OpenSSH default) can't be recovered and are skipped.
• CSV: needs a header row. Recognized columns: label (or name), hostname (or host, address), port, username (or user) and group (or folder); only the hostname is required. A group is found by name or created.

What you can't do, and why

• Import from a file or a QR code: the sheet takes pasted text only.Not yet
• Import passwords or keys: no format carries them, so imported hosts need credentials added in Edit Host.By design