Termius is a good SSH client. It is on five platforms, it has a real encrypted vault, and its team sharing works. This page is about the two places we actually differ: where your host data lives, and what the AI is permitted to do.
Termius describes itself as a "Modern SSH Client" built "for Productivity and Collaboration," and organises your infrastructure around three concepts — vaults, groups, and hosts. It runs on macOS, Windows, Linux, iOS and Android. If your job is "reach any of 200 boxes from any device I happen to be holding, and share access with six teammates," Termius is aimed squarely at you.
Tryssh is a native macOS SSH workspace with an agentic copilot attached to each host. You describe an outcome — "disk is at 89%, find what's eating it and clean up safely" — and the agent works over SSH, showing you the exact command before anything mutates state. Hosts, chats and history live in SQLite under ~/.tryssh; SSH keys and passphrases live in the macOS keychain and never touch a database.
Both are SSH clients. Only one of them is trying to do the work for you.
Verified as of July 29, 2026. Every Termius claim below is taken from termius.com or docs.termius.com, with the exact source URL in an HTML comment next to the claim in this page's source. Pricing and features change — if you spot something stale, tell us.
Read the "Termius" column first. It is longer than ours on purpose.
| Capability | Termius | Tryssh |
|---|---|---|
| Platforms | Yes macOS, Windows, Linux, iOS, Android | No macOS 14+ only (Apple silicon, arm64) |
| Free tier | Starter, free: local vault, SSH and SFTP, AI-powered autocomplete, port forwarding | Free: unlimited hosts, terminals and SFTP; 200 agent credits to start (one-time, nothing refills it) |
| Paid entry price | Pro from $10/month billed annually; Team $20/user/month; Business $30/user/month | Pro $19/month for 2,400 agent turns; Team $29/month for 4,500 |
| Where host records live | Local vault on the free plan; end-to-end encrypted cloud vault synced across devices from Pro up | SQLite under ~/.tryssh on your Mac; keys and passphrases in the macOS keychain. No vendor vault, no sync |
| Sync across devices | Yes From Pro | No Not offered |
| Team / shared vaults | Yes Team vault from Team; multiple vaults + granular access on Business | No Single-operator today |
| SFTP | Yes Included from the free plan | Yes Built-in browser and remote file editor over the same SSH session |
| Port forwarding | Yes Included from the free plan | No Not implemented |
| Jump hosts | Yes Host chaining | No Direct connections only |
Import from ~/.ssh/config |
Yes Imports ssh_config, known_hosts and key files (ProxyCommand ignored) |
No Hosts added by hand |
| Auth methods | Password, key, agent, and SSH certificates | Password, private key (one-off or saved in the key vault), and ssh-agent |
| What the AI does | Generates a shell command from a plain-language description; you run it | Runs the commands itself, multi-step, over a dedicated SSH exec channel — reads output, decides the next step, reports back |
| Approval gate on agent commands | Not applicable — you execute every command yourself | Yes Default-deny: only read-only, metacharacter-free commands auto-run; everything else waits for a click |
| Bring your own model key | Not documented | Yes With ANTHROPIC_API_KEY in the core's environment, chat talks to Anthropic directly — no gateway, no credits, no account |
| Compliance reports | Yes Lists a SOC 2 Type II report and SAML SSO on Enterprise | No None. We are a small independent team and hold no certifications |
Five rows above are straight losses for us, and they are not small ones.
Plus the unquantifiable one: Termius has been shipping for years across five platforms. Tryssh 0.1.6 shipped in July 2026. Maturity is a feature.
Two differences, and they are structural rather than a longer feature list.
In Termius the local vault is the free plan and the cloud vault is what you upgrade into. In Tryssh there is no cloud vault to upgrade into. Hosts, chats and history sit in SQLite under ~/.tryssh. SSH keys and passphrases sit in the macOS keychain under the service ai.definable.tryssh — never in any database, ours or yours. Your SSH traffic goes from your Mac to your servers; we are not in that path.
The honest asterisk: when you use the hosted copilot, the conversation for that turn — including the command text and the command output the agent read — is relayed through our gateway to Anthropic to generate the reply. That is how the agent works, we say so plainly in the privacy policy, and we do not train on it. If you would rather nothing left the machine at all, run the core with your own ANTHROPIC_API_KEY and the gateway is out of the picture entirely.
Termius's documented AI feature converts a plain-language description into a shell command. That is genuinely useful and it is also a fundamentally different contract: the tool writes, you run.
Tryssh's agent runs. It opens its own ssh2 exec channel — architecturally separate from your interactive PTY, so it cannot read your terminal or type into it — runs a command, reads the output, and decides what to do next. Which means the interesting question stops being "can it write a good command" and becomes "what stops it running a bad one."
The answer is the risk gate, and it is default-deny. A command auto-runs only if it matches a read-only allowlist (ls, cat, df, journalctl, systemctl status, kubectl get and friends) and contains no shell metacharacters. Everything else renders the exact command on a card and waits for your click. A separate denylist — mkfs, dd of=, recursive rm against a system path, flushing firewall rules, stopping the sshd you are connected through, piping a download into a shell — always asks, even if you have turned auto-approve on for that host.
Not a claim about safety in general. A default-deny gate is a real constraint, not a guarantee. It stops an agent surprising you; it does not stop you approving something you should not have. You are still the operator.
Tryssh is SwiftUI and SwiftTerm, not a webview. Each host gets its own chat with its own memory, its own metrics (CPU, memory, disk, network sampled while connected), background jobs for long-running commands, and recurring "watchers" the agent can set up for checks you want repeated. It is a workspace shaped around one machine at a time, not a tabbed terminal.
This is the weakest part of our story and we would rather you heard it from us.
Tryssh has no importer. There is no Termius import, and no ~/.ssh/config import either. Hosts are added by hand in the app. Termius, by contrast, imports your whole ~/.ssh folder including ssh_config, known_hosts and key files. If you have 80 hosts, budget for it.
Nothing about Tryssh requires you to remove it, and if you rely on port forwarding, mobile access, or a shared team vault, you should not.
Most people have five to ten machines they touch weekly and a long tail they touch yearly. Add the first group and see whether the copilot earns its place before doing any more typing.
Add a private key once to the key vault and reuse it across hosts. The key bytes and any passphrase go into the macOS keychain; the database only ever stores a reference. ssh-agent also works — pick "SSH agent" as the auth type and Tryssh uses your existing SSH_AUTH_SOCK.
"Why is nginx 502ing" tells you more in three minutes than an hour of feature comparison. The commands it proposes are the product.
~/.ssh/config. Hosts are added by hand. It is the single most requested migration gap and it is on our list.~/.tryssh on the Mac in front of you, keys in that Mac's keychain, no vendor-side vault. Termius syncs from its Pro plan up; we do not sync at all.ANTHROPIC_API_KEY and the gateway is skipped.That is the whole evaluation. 200 agent turns to start, no card required.