Web-based SSH client, with desktop and mobile apps
Open a real online SSH terminal from any computer. Close the laptop and your session carries on. Reach Grafana, a test site and other pages on private addresses securely in a browser tab, with no tunnel to set up.
Free desktop app. Plans from $6 a month, with a 14-day free trial.
Works on
Why GoTerm
Most SSH clients live on one computer, and their sessions drop when it sleeps. GoTerm keeps your sessions on its gateway, so they follow you instead.
Web terminal
Sign in from a work laptop, a borrowed PC or a Chromebook and your hosts and saved keys are there. vim, tmux and htop work the way you expect. Nothing to install, so it works as an online SSH client from any device.
Sessions that keep running
Your session lives on GoTerm’s gateway, not in a browser tab. Start a long job at your desk, close the lid, and check on it from your phone on the way home.
Web tabs
Grafana, a test site, a router’s admin page: if your server can reach it, GoTerm opens it in a browser tab, carried inside the SSH connection you already have. No new ports opened to the internet, and no tunnel to set up on the computer you’re using.
| What you get | GoTerm | Typical desktop client |
|---|---|---|
| Works from any browser, nothing to install | Yes | No |
| Sessions keep running after you close the window | Yes | Only with tmux or screen |
| Private web pages open through a host | Yes | With manual port forwarding |
| Share a live session, read-only or read-write | Yes | No |
| Team access with roles and an audit log | Yes | No |
Themes and fonts
Long sessions are easier on warm, calm colors. Pick from 15 themes and 13 fonts, and the terminal looks the same on every device you sign in from.
These are the real colors of each theme in GoTerm. Try a few.
Features
One app for connecting, moving files, opening tunnels, watching your sites and keeping keys safe, on every device you use.
The same hosts as the web, or no account at all with goterm Free. Direct mode connects from your own computer.
Check on a session or restart a service from your phone.
Reach servers on a private network through a bastion, like ssh -J, on any port, saved once with the host.
Mark a host to ask for its password on every connect, so it’s never saved anywhere.
Open a shell inside any running container on a host you already reach. No extra ports.
Open a Windows server’s desktop in a tab, right next to your SSH sessions.
Upload, download, rename and delete files beside your terminal, or copy them straight from one host to another.
Keep several sessions open in tabs, or split the view to watch two servers at once.
Save the commands you always forget and run them on up to ten hosts at once. Write it for me drafts one from a sentence.
Check sites and ports every minute, private ones through a jump host, and get an email when one goes down.
Pick a color scheme for each server, or import the one you already use.
Invite a teammate into a running session to watch or to type. Read-only is enforced on the server.
Give someone a host for a few hours, read-only or read-write, and the access ends on its own. Contractors reach only what they’re given.
GoTerm looks at each host before and after someone’s access, and reports new SSH keys, accounts, scheduled jobs and services.
Record what each session showed, search what was on screen, and play it back. Keystrokes are never stored, so passwords typed at a prompt stay out.
See who connected to which host, when, from which device, and from which address, city and country.
Changes to hosts, keys, teams and access, and the errors GoTerm hits, are recorded, with who made them.
Private web pages behind your servers, opened in a browser tab.
Local and SOCKS tunnels through GoTerm or from your own computer, and remote ones in Direct mode, saved in the desktop app.
Run a small agent inside your network and reach its servers without opening an inbound port.
One place for passwords and private keys, personal or shared with a team. Teammates connect with a team key without ever seeing it.
A team’s saved password is sent only to servers it already signs in to. A new server waits until someone lets it in.
A new browser or computer must be confirmed before it can use your account, and each one has an ID to check.
Your personal keys follow you to your confirmed desktop apps, sealed for each one.
Ed25519, RSA and ECDSA keys, agent forwarding, certificates and FIDO2 hardware keys.
Host keys are pinned on first connect. A changed key stops the connection and tells you why.
One organization, many teams, each with its own admins, hosts and keys.
Group your hosts, and on Business open each group only to the teams or people who need it.
A code from an authenticator app after the password, with recovery codes. Owners and admins always use it; you can ask it of everyone.
Open your workspace only from your office or VPN. Anyone elsewhere is turned away, and the audit log says from where.
On a server of your own, open your workspace only to your team’s devices on its own WireGuard VPN.
Your workspace runs in the US or Asia-Pacific, named in its address. That server holds its hosts, Vault, logs and recordings.
People sign in with your company’s identity provider.
Security
An SSH client holds the keys to everything you run. Here is exactly how GoTerm protects them.
Your secret
A password or a private key you save.
Sealed with its own key
AES-256-GCM, with a new key every time it’s saved.
That key sealed again
By a master key kept apart from the database. Master keys rotate without opening your data.
Stored
Only the sealed result is in the database.
Session output stays in the gateway’s memory so you can catch up. A recorded session is stored too, sealed the same way as your keys.
Each saved password and private key is sealed with AES-256-GCM under a key of its own. A copy of the database alone opens nothing.
A secret is decrypted in memory only when it’s used: as it’s saved, when the gateway connects with it, and when your own key is sealed for a desktop you confirmed. It never goes into logs, error messages or a teammate’s view.
Once saved, a password or key isn’t shown in the browser again. A key GoTerm makes for you can be downloaded once, as it’s made. After that, only your own keys leave the server, sealed for each desktop you confirmed. A team’s keys never do.
When you share a session read-only, the gateway drops the viewer’s keystrokes. It’s enforced on the server, not hidden in the page.
A new browser or desktop has to be confirmed before it’s trusted. Remove one and its sessions end at once.
GoTerm remembers each server’s host key. If it changes, the connection stops and you decide what happens next.
The gateway opens SSH connections to your servers and nothing else, with rate limits and a record of every refused connection.
Your workspace talks to GoTerm directly over TLS. Terminal traffic never passes through a CDN that could read it.
A code from an authenticator app comes right after the password, before anything else. Owners and admins always need one.
Open your workspace only from your office’s addresses, or, on a server of your own, only through its own WireGuard VPN.
A team’s saved password goes only to the servers it already signs in to, known by their host keys. A look-alike gets nothing.
A recorded session is sealed under a key of its own, like a saved password, and only the people allowed to watch it can play it.
Pricing
Pay by the month, or by the year for two months free. A seat is one person who signs in. Personal and Teams start with a 14-day trial, no card needed.
$0no account needed
The desktop app, connecting straight from your own computer.
Get the desktop app$6per month
Everything you need on your own, on every device. No team features.
14-day free trial, no card
Start a free trialFor teams
$35per month
5 seats included. Extra seats are $10 a month each.
Work on the same servers together.
14-day free trial, no card
Start a free trial$250per month
10 seats included. Extra seats are $15 a month each.
For organizations with many teams and strict rules.
Ask about Business+$100 a month
A server of your own, for Personal and Teams. Its own IP address for your firewalls, no limit on sessions, and VPN only. Business includes one.
Prices are in US dollars, before tax. Yearly is ten months’ price. VAT or sales tax is added at checkout where it applies.
Pick Personal or Teams and use the whole plan for 14 days, with 2 monitors rather than its full number. There’s no card: we email you a code to check the address is yours. Until sign-ups open on this site, email hello@goterm.net and we’ll set your trial up.
Pay, and everything stays as it is. If you don’t, the workspace is kept for 7 days, then deleted. The desktop app can keep your own hosts, passwords and keys, and goes on as goterm Free.
A seat is one person who can sign in to your workspace, contractors included. Teams comes with 5 seats and Business with 10. An extra seat is $10 a month ($100 a year) on Teams, and $15 a month ($150 a year) on Business.
The desktop app, with no account: SSH and tunnels from your own computer, with your hosts and keys kept on it. The web terminal, sessions that keep running and the Vault start with Personal.
In the region you pick when you sign up: the US or Asia-Pacific. The region is in your workspace’s address, and that server holds your hosts, Vault, audit log and recordings. Business, or the add-on, gives you a server of your own there.
Yes. GoTerm’s web terminal is a web-based SSH client: sign in, pick a host and open a real SSH session in any modern browser. The web terminal comes with Personal and above, and the Free plan is the desktop app.
US dollars, wherever you are. VAT or sales tax is added at checkout where it applies.
Email hello@goterm.net with the plan, the seats you need and your region, or ask for a trial. We’ll set up your workspace and reply with the next steps.
Download
One account, the same hosts and the same keys, wherever you sign in.
Windows now; for a Mac, Linux or a phone, we’ll email you a link.
Use cases
Whoever you are, the job is the same: get on the right server quickly, safely, and from wherever you happen to be.
Get paged at night, open a browser on any machine, and you’re back in the session you left running.
Keep every customer’s servers in one place, with access split by team and every connection logged.
Work on client servers from anywhere, and hand access to the client’s team when the job is done.
Give students a terminal in the browser, watch a session live when someone is stuck, and end access when the term is over.
Docs
Short, practical guides, written by the people who build GoTerm. If yours isn’t here, ask and an engineer will answer.
Tell us about your team and we’ll set up your workspace. Or start with the free desktop app today.
