# Keyway – full product information

Source: https://keyway.iotueli.com/ (English) and https://keyway.iotueli.com/de/ (German). Status: October 2026, Keyway 0.3.0.

## What is Keyway?

Keyway is a free, open-source, self-hosted web client for SSH, VNC and SFTP. It gives you an SSH terminal, a remote screen (VNC), a file manager (SFTP), an encrypted credential vault and offline command help in one browser tab. It runs as one small Docker container on your own hardware – no cloud service, no third-party account – and works on desktop computers, tablets and phones. The interface is available in English and German. Keyway is developed by IoTUeli (https://iotueli.ch) and published under the MIT License. It was formerly called SSH-App; the repository, program and container are still named ssh-app.

## Who is it for?

- Industrial maintenance: open the shell of a PLC gateway, check logs, copy configuration files and view the HMI screen of a production line from one tab at the control cabinet.
- Field service: the same hosts and screens on a phone, with a key bar and touch gestures.
- IoT and edge fleets: Raspberry Pis, gateways and edge devices in folders with device types and tags; "send to all" runs one command on many devices.
- Homelab and small IT: one container on a NAS or mini PC as a central, encrypted place for SSH and VNC access.

## Features

### Terminal (web SSH client)
- Tabs, 256 colors, full-screen programs (top, htop, vi), clickable links, copy and paste.
- Sessions keep running on the server for up to 12 hours and reattach after a reload or a dropped connection.
- Plain-language connection errors; gives up after about 20 seconds.
- Host key confirmation on first connection and a clear warning if it changes.
- Send to all: type into several sessions at once.
- Critical hosts (tag "critical"/"kritisch"): confirmation before dangerous commands such as rm -rf, dd or reboot from snippets, command help or send-to-all.

### Remote screen (VNC in the browser)
- A full VNC viewer in a browser tab, next to the terminals; several screens at once.
- Tunneled over SSH by default: encrypted, the VNC server can listen on localhost only, no open VNC port on the network. Requires AllowTcpForwarding on the SSH server.
- Direct mode for devices without SSH (unencrypted between Keyway and the device; use only on trusted networks).
- Keyway signs in to the VNC server itself (RFB 3.3, 3.7, 3.8 with None and VNC Authentication); the VNC password stays on the server. Other login methods (for example RSA-AES or VeNCrypt with username and password) are passed through to the browser (noVNC).
- Toolbar: fit, zoom, remote resize, quality, view only, clipboard, special keys (Ctrl+Alt+Del, Windows key, Alt+Tab, F1–F12), full screen, disconnect.
- On phones: tap to click, long press to right-click, drag, two-finger scroll, pinch to zoom, on-screen keyboard and key row.

### Files (SFTP)
- Upload (also drag and drop), download, rename, delete, create folders, copy a path, insert it into the terminal or cd there.
- Safe replace keeps owner, permissions, hard links and bind mounts; uses copy-data on OpenSSH 9.0 or later.
- On Linux hosts the Files panel follows cd in the terminal.

### Command help and search
- About 7,000 commands from tldr-pages, offline, in English and German.
- Explains the options of the command on the current line; examples with placeholders.
- Plain-word search ("extract archive", "free disk space"); snippets with placeholders; Ctrl+Shift+K (Cmd+K on Mac) searches hosts, snippets and commands.

### Hosts, vault, backup
- Device types with icons: PLC, HMI/panel, gateway, IoT device, wallbox, inverter, server, virtual machine, container, PC, laptop, Raspberry Pi, router, switch, firewall, NAS, cloud/VPS, printer. Folders, tags, colors, notes.
- The address field accepts user@host:port, ssh://…, "ssh -p 2222 user@host" and [fe80::1]:2222.
- Vault: credentials encrypted with AES-256-GCM, key derived from the sign-in password with Argon2id. Import keys, generate ed25519 keys, install the public key on a host with one click.
- Recovery key shown once during setup; it resets a forgotten password and unlocks backups.
- One encrypted backup file with hosts, folders, credentials, snippets and known host keys; restorable on another system.

## Security

- Secrets stored only encrypted; the key lives only in memory and is discarded when the vault locks (sign-out or 30 minutes of inactivity, configurable with SSHAPP_LEERLAUF_MIN).
- Sign-in lockout for 15 minutes after 5 failed attempts per address (IPv6 grouped per /64); HttpOnly and SameSite=Strict cookies; CSRF header; strict Content Security Policy; DNS rebinding protection.
- Keyway connects only to the address and port saved with a host.
- Container: no shell, unprivileged user 65532; Compose file sets read-only file system, drops all capabilities, no-new-privileges.
- Images built by GitHub Actions, tested before release, with provenance attestation and SBOM.
- Limits: the server must decrypt a secret briefly to connect; end-to-end encryption to the browser is impossible for an SSH gateway. Setup is open until the first account is created. Keyway is meant for your own network and should not be exposed to the internet unprotected.

## Installation

```
mkdir keyway && cd keyway
curl -fsSLO https://raw.githubusercontent.com/uiff/ssh-app/main/compose.yml
docker compose up -d
```

Or: `docker run -d --name ssh-app -p 8443:8443 -v ssh-app-daten:/data --restart unless-stopped --stop-timeout 30 iotuelich/keyway:latest`

Then open https://<address>:8443, create the account right away (password at least 10 characters) and store the recovery key. Images: iotuelich/keyway (Docker Hub) and ghcr.io/uiff/keyway; tags latest, 0.3.0, 0.3. Behind a reverse proxy set SSHAPP_TLS=aus, SSHAPP_COOKIE_SECURE=1 and SSHAPP_PROXY; the proxy must pass WebSockets (/api/ws, /api/vnc) and the Host header.

## Frequently asked questions

- Is Keyway free? Yes, MIT License, free of charge.
- Can Keyway replace desktop SSH and VNC clients? For SSH, SFTP and VNC, yes – in the browser, self-hosted, on any device. RDP and X11 forwarding are not included.
- Does Keyway support RDP? No. Use a dedicated RDP gateway for Windows Remote Desktop.
- Does Keyway need internet? No; even the command help works offline.
- Which hardware? Anywhere Docker runs; linux/amd64 and linux/arm64 (Raspberry Pi, industrial PCs).
- Can I reach it from the internet? Only protected, through a VPN or a reverse proxy with its own certificate.
- Can I use it on a phone? Yes, with key bar, gestures and 44 px touch targets; installable to the home screen.

## Links

- Product page: https://keyway.iotueli.com/ (EN), https://keyway.iotueli.com/de/ (DE)
- Whitepaper: https://keyway.iotueli.com/downloads/keyway-whitepaper-en.pdf (EN), https://keyway.iotueli.com/downloads/keyway-whitepaper-de.pdf (DE)
- Source: https://github.com/uiff/ssh-app
- Docker Hub: https://hub.docker.com/r/iotuelich/keyway
- Company: https://iotueli.ch