Checking your saved session.
Pick up your shell from a phone, tablet or computer. SSH authentication and AWS TLS run in your browser. The relay carries encrypted bytes.
Use a device you trust. A compromised browser or web application can still control an unlocked session.
Face ID, Touch ID, a security key or device PIN verifies your passkey. The site never receives your biometric data. A recovery password unlocks the vault on devices without passkey encryption support.
Use a local relay when a server only allows your IP address, needs your VPN, or is on your home or office network. Connections leave from your computer instead of ours. Use the hosted relay when you don’t need a specific network or IP address.
A relay opens the network connection to your server. Choose one that can reach it.
Start here for public servers
Connect through our server. Nothing to install, on your phone or computer.
Checks relay access. Your server’s firewall or IP restrictions can still block a connection.
3.146.148.58Allowlist this IP on your server. For CIDR rules, use /32. Shared with other accounts and may change; check here if a connection stops working. Local relays use their own outgoing IP.
Use its network or VPN
Reach private servers from the computer you’re using, or connect from its IP address.
Requires SHAI Connector on this Mac or Windows computer.
Use your desktop from anywhere
Use an approved computer’s network or VPN from your phone, tablet, or laptop.
That computer needs SHAI Connector and must stay awake. No app needed here.
Changing routes disconnects open terminals. You’ll be asked first.
Bring your own network. Install once on the computer you want to connect through.
Install the app on a Mac or Windows computer. On this device, use the hosted relay or a local relay from another computer.
SSH stays encrypted. SSH encryption happens in your browser. SHAI Connector forwards the encrypted traffic to your server.
You approve access. The app asks before allowing your account. Remote access is off until you enable it.
You stay in control. Revoke an account, disable remote access, or quit the app from Manage Connector. The app also saves files you choose to download.
Run on the Linux computer you want to use as a relay.
curl -fsSL https://shai.sh/connector/install.sh | sh && shai-connector setupOpen the authorization link on any device and approve the relay. It then appears in Choose a local relay.
Linux with systemd · x86-64 or ARM64 · Uses administrator access to install a service that runs under its own account.Compare this fingerprint using an independent trusted channel. Saving it trusts this server on every device using your vault.
Forward a remote web app to a private address, then choose Open app. HTTP, HTTPS and WebSockets are supported. Forwarding stops when the workspace locks or its SSH connection disconnects.
| Port | Forwarded address | Running process | Origin |
|---|
Comments, formatting and unknown directives are preserved. IdentityFile paths map to imported vault keys. Saved folders appear as # ShaiWorkspace ["host","/folder"] comments; edit or delete a comment to change or remove a bookmark.
Private keys and passwords are encrypted before upload. They are used inside browser WebAssembly, never sent to the relay as credentials.
No key selected
Add a named profile for each AWS account or role, then select it in the workspace’s SSM settings. Access-key profiles do not need browser authorization. Temporary session tokens are excluded from backups.
Browser authorization is only for IAM Identity Center (SSO). AWS access-key profiles do not need this step.
Choose the theme for this browser.
Your theme applies to terminals, editors and pop-out windows.
Passkeys grant account access. Vault encryption additionally needs a compatible passkey or your recovery password. The service cannot reset that password or recover your encryption key.
Enrollment requires fresh passkey verification. Keep a second passkey and an offline encrypted backup. Revocation cannot erase previously downloaded data; rotate exposed server credentials separately.
Switching windows hides content without immediately locking. Typing, clicking and scrolling in the workspace or terminal windows reset the timer; terminal output does not. A fresh passkey sign-in is required after eight hours, even while active.
tmux must be installed on your servers. Disconnecting detaches; closing a terminal terminates its managed tmux session. Unlocking reconnects the selected tmux tab; input is never replayed. Server reboot or process crash requires separate recovery.