Every SSH manager markets a free tier. Almost none of them agree on what “free” should actually include. One caps you at three hosts and calls it generous, another lets you add unlimited hosts but throttles sync, a third stores your private keys in a format you can’t inspect or export. If you’re comparing a free ssh manager plan against another in 2026, the price tag tells you nothing, they’re all $0. What separates a usable free tier from a stripped-down trial is what’s quietly included and what’s held back until you pay.
This guide walks through the criteria that actually matter: host and session limits, how credentials and keys get stored, which features are commonly paywalled, and which security guarantees should never be conditional on payment. Near the end, we’ll check one free tier, termique’s, against the checklist as a single concrete data point. The criteria apply to any ssh manager you’re evaluating, that one included or not.
Why comparing free ssh manager plans on price alone is misleading
“Free” is a marketing label, not a specification. Behind it sit a dozen decisions a vendor made about what to meter: how many hosts you can save, how many terminal sessions you can run at once, whether file transfer counts as a separate feature, whether your encryption key ever leaves your device, whether the vault format is an open standard or a proprietary blob you can only read through that one app.
Two tools can both say “free forever” and land in completely different places. One gives you unlimited hosts but restricts AI assistance and sharing to a paid tier, reasonable, since those are genuinely compute-heavy or team-oriented add-ons. Another caps you at a handful of hosts while gating basic file transfer behind the same paywall, which is a different kind of decision: it’s rationing a feature that costs the vendor almost nothing to serve, purely to push you toward upgrading.
The only way to tell these apart is to read the actual pricing page’s fine print, and ideally install the client and try to hit the limits yourself, rather than trust the headline word “free”.
Host and session limits: the most common free-tier gate
The most visible free-tier restriction is a fixed host cap: a hard number of saved connections, often somewhere between three and ten, regardless of how you use the tool. A second, less common limit is a session cap, how many concurrent PTY (terminal) connections you can hold open at once, independent of how many hosts you’ve saved.
These two limits matter differently depending on who’s asking. A solo developer juggling a personal VPS, a couple of side-project boxes, and maybe one client server rarely needs more than five or six saved hosts, so a low fixed cap can be a non-issue in practice even if it looks stingy on paper. A small team is a different story: shared staging and production hosts, plus each engineer’s own boxes, adds up fast, and a cap sized for an individual becomes a real constraint the moment a second or third person needs access.
Session caps matter more for day-to-day friction than host caps do. Hosts are just metadata, cheap for a vendor to store and cheap for you to add. Sessions are what you actually touch every time you work: several tabs open across two or three servers while debugging something. A free tier that caps hosts tightly but leaves PTY sessions unlimited is prioritizing the thing you feel constantly (can I keep working) over the thing you feel occasionally (can I add one more server), which is the more honest tradeoff of the two.
How are credentials and ssh keys actually stored on the free tier?
This is the criterion worth spending the most time on, because it’s the one that determines what happens if the vendor gets breached. There are two fundamentally different models hiding behind the phrase “encrypted storage.”
In an on-device, zero-knowledge model, your master password never leaves your machine. A key is derived from it locally (commonly via PBKDF2), and that derived key encrypts your credentials and keys (commonly with AES-256-GCM) before anything is written to disk or sent over the network. The vendor’s server only ever holds ciphertext it has no way to decrypt, forgetting your master password means your data is unrecoverable by design, not a support-ticket fix. In a cloud-encrypted model, the vendor’s server participates in key handling, wrapping or unwrapping your credentials server-side, which means a sufficiently compromised backend could theoretically expose plaintext. Both models can be labeled “encrypted” in marketing copy; only one of them removes the vendor from the trust chain entirely. For a deeper walkthrough of how the on-device model chains together in a real implementation, see end-to-end encrypted ssh credential storage.
The second question is where your private keys physically live. Some tools store them in the OS-native secure store, Keychain on macOS, Credential Manager on Windows, libsecret on Linux, which means the operating system, not the vendor’s app, is the thing guarding the key material at rest. Others store keys inside a proprietary vault file or database that only that one client can open, which quietly locks you into the tool: switching clients later means re-generating or manually re-exporting every key. A quick way to check which situation you’re in is to see whether the tool actually lets you export a key in standard OpenSSH format and confirm it against the original:
ssh-keygen -l -f ~/.ssh/id_ed25519.pub
# Should print a standard fingerprint + key type (e.g. ED25519).
# If the exported file won't parse with ssh-keygen at all,
# it isn't a standard OpenSSH key underneath.If a client can’t produce a key that a plain, vendor-agnostic OpenSSH toolchain recognizes, treat that as a lock-in signal, free tier or not.
Does the free tier include sftp, snippets, and multi-device sync, or are they paywalled?
Three features get paywalled more often than any others, and it’s worth checking each on its own rather than assuming they travel together as a bundle.
SFTP (drag-and-drop file transfer over the same SSH connection) has historically been treated as a premium add-on across several tools in this category, even though it reuses the same authenticated connection a free-tier terminal session already opens. Command snippets, saved commands you re-run often, are usually free but capped in count on the free tier, which is a reasonable way to meter a genuinely low-cost feature. Multi-device sync is the trickiest of the three to evaluate, because “sync” can mean very different things: some plans sync only metadata (host names, groups, tags) for free while treating credential and key sync as the paid feature; others sync everything, but only if you can verify the sync payload is still encrypted the same way data at rest is. Syncing ciphertext across devices without the vendor ever seeing your master key is a real engineering commitment, not a checkbox, so it’s worth confirming which version of “sync” a free plan is actually offering. For more on what to look for here, see how to manage ssh credentials across multiple devices.
What security features should never require a paid plan?
Some things are reasonable to meter. Others shouldn’t be conditional on payment at all, because a security gap on the free tier is exactly as damaging as one on the paid tier, the data at risk doesn’t get less sensitive because you didn’t pay.
- No telemetry on session content: commands run and their output should never leave your machine, regardless of plan.
- Audit logging, where offered, should be opt-in per host, not a silent default that logs command history without you choosing to.
- Keys should be exportable in a standard format (OpenSSH, not a proprietary re-encoding) on every tier, including free.
- The stated encryption model should be public and specific (which algorithm, where the key is derived), not a vague “bank-level encryption” claim.
- You should be able to fully delete your account and data without needing to contact support or upgrade first.
- A zero-knowledge design means the vendor genuinely cannot reset a forgotten master password. That’s a tradeoff worth understanding upfront, not a bug to complain about later.
If a free tier fails any of these, that’s a signal about how the vendor treats security generally, not just about what you get for $0. If ssh key handling for a team is part of your evaluation, ssh key management for teams goes deeper into rotation and access policy on top of these baseline criteria.
A checklist for evaluating any free ssh manager plan
Condensing the sections above into something you can actually run down while comparing tools, a free ssh manager plan is worth taking seriously if you can answer yes to most of the following:
- Is the host cap a flat, published number rather than something you have to discover by hitting a wall mid-use?
- Are terminal sessions (PTY connections) unlimited, or capped separately from hosts in a way that matches how you actually work?
- Is encryption and decryption performed on-device, with the key derived from a password only you hold?
- Are private keys stored in the OS keychain or equivalent, not a proprietary vault file?
- Can you export your keys in standard OpenSSH format at any time, on the free tier, no upgrade required?
- Is SFTP available without upgrading, or is basic file transfer gated behind a paywall?
- Does sync, if offered for free, cover encrypted credentials and keys, or only host metadata?
- Is command or audit logging opt-in rather than a silent default?
- Is there zero telemetry on session content regardless of plan tier?
- Are the free tier’s exact limits published on a pricing page you can verify, rather than only described in an app store listing?
Where termique’s free tier lands on this checklist
As one concrete, verifiable data point rather than a pitch, here’s how termique’s free tier maps onto the checklist above. It’s a fixed cap of 3 hosts and 10 snippets, with unlimited PTY terminal sessions, SSH key management, and 15 hosted AI prompts a day. Credentials and private keys are encrypted on-device with AES-256-GCM, with the key derived locally from a master password via PBKDF2, the zero-knowledge model described earlier, meaning there’s no vendor-side password reset path by design. Private keys are stored in the OS keychain rather than a proprietary database. Cross-device sync (E2EE) is included on the free tier, not gated to Pro. SFTP, which used to sit behind the paid plan, has been open to every plan since v0.3.0.
Against the checklist: the host cap is real and would be tight for a small team sharing several servers, but workable for a solo developer with a handful of personal boxes. The encryption model, key storage, and now SFTP all clear the bar in the sections above. That’s one honest read of one plan, worth checking against your own usage before assuming any free tier, this one included, actually fits how you work.
Picking a plan that fits how you actually work
There’s no universal “best” free ssh manager plan, only a better or worse fit for a specific usage pattern. A solo developer with a small, stable set of personal servers should weight key portability and on-device encryption far more heavily than host count, since that cap will rarely bind. A small team evaluating the same tool should weight session and host headroom more heavily, and check specifically whether sharing and audit logging require a paid seat for every member or just an admin.
Whatever you land on, verify the claims yourself rather than taking a pricing page at face value: install the client, add a real host, export a key, and see what actually happens when you hit a stated limit. For a broader shortlist to run this checklist against, see the best ssh client for developers in 2026.
