RoamTerm

SSH to your Mac from your phone, no port forwarding

Last updated:

The classic way to reach your Mac from outside your home is to turn on Remote Login, forward port 22 on your router and hope your IP address does not change. That exposes a service to the whole internet. RoamTerm avoids all of it.

How it works

Both your Mac and your phone connect outward over port 443 to a relay. The relay pairs them and forwards bytes; when the network allows it, the two connect directly instead. Your session is SSH end to end, so the relay cannot read it. Nothing on your Mac listens on the public internet.

Step by step

  1. On the Mac, install the agent. It lives in the menu bar and runs in your own login session, so the Keychain and your tools work:
curl -fsSL https://roamterm.com/install | sh
  1. The agent shows a pairing QR code. Open RoamTerm on your phone and scan it. The QR pins your Mac’s identity, which stops anyone from sitting in the middle.
  2. Tap the Mac in the machine list and you are in a shell. Your phone key is stored in the Secure Enclave or StrongBox and can be protected with Face ID or a fingerprint.

Why not just use a VPN?

A VPN is fine if you already run one. RoamTerm is for when you do not want to set one up, or when you need to reach a machine on a network you do not control. You also get tmux integration, a mobile key row and silent reconnects out of the box.

Headless Linux servers

On a server without a screen the agent prints the pairing code in the terminal and you enter it in the app. Everything else is the same.

Next: tmux on your phone and SFTP file transfer.