Security
Your keys, under your control
An SSH client holds the most sensitive credentials you own. Here is exactly how SigilTTY stores, protects and moves them.
Credentials live in Keychain
Passwords, private keys and passphrases are stored in the system Keychain — never in plain text inside the app database. If you enable credential sync, regular credentials travel through iCloud Keychain, Apple’s end-to-end encrypted keychain sync.
Biometric-protected keys stay on this device
Any private key can require Touch ID, Face ID or the device passcode before each use. Protected keys are deliberately device-local: they are excluded from iCloud Keychain sync and can only reach another device by re-importing or through Key Handoff.
Host keys are verified before credentials leave
On first connection SigilTTY records the server’s host key fingerprint (trust on first use). If the fingerprint ever changes, the connection is blocked before any credentials are sent. Jump-host chains verify every hop the same way.
Agent forwarding asks you every time
When a remote host requests a signature through agent forwarding, the approval happens on your device: biometric-protected keys prompt for Touch ID or Face ID, and other keys show an explicit confirmation dialog. No signature happens silently.
Key Handoff: encrypted, local, verified
Key Handoff moves a private key to another of your devices over the local network without ever writing a plaintext file. The channel is established with X25519 key agreement, HKDF key derivation and ChaCha20-Poly1305 encryption, and both sides confirm a 6-digit verification code before anything is transferred.
What syncs — and what doesn’t
Sync is deliberately three-tiered, so the most sensitive material never leaves the device:
| Data | How it moves |
|---|---|
| Server profiles, folders, snippets | CloudKit (your private iCloud database) |
| Passwords and regular private keys | iCloud Keychain — optional, off unless you enable credential sync |
| Biometric-protected private keys | Never synced. Device-local by design; move them with Key Handoff |
Questions?
Security questions and reports are welcome at support@sigiltty.com.
Be there when it launches.
SigilTTY is coming to the App Store for Mac, iPhone and iPad.