Comparison of SSH clients
An SSH client is a software program which uses the secure shell protocol to connect to a remote computer. This article compares a selection of notable clients.
SSH clients provide encrypted network connections for remote system administration, file transfers, and secure tunneling. These clients range from lightweight command-line utilities to feature-rich graphical applications, serving use cases from simple terminal access to complex enterprise workflows. This comparison examines SSH clients across multiple dimensions: basic information and licensing, platform compatibility, protocol support and technical capabilities, user features, and cryptographic algorithm support.
General
This section provides fundamental information about each SSH client, including developer, initial release date, supported platforms, current version, licensing model, and interface type. Understanding these basics helps users identify which clients are actively maintained, compatible with their operating systems, and align with their licensing requirements.The SSH client landscape spans from foundational open-source projects like OpenSSH and PuTTY to commercial offerings such as SecureCRT and ZOC Terminal. OpenSSH dominates as the de facto standard, included by default in most Unix-like operating systems and recent Windows versions. Cross-platform support varies significantly: command-line tools like OpenSSH and Dropbear support the widest range of platforms, while graphical clients tend toward platform-specific implementations. The licensing divide is clear, with major open-source clients using BSD or MIT licenses, while commercial clients like SecureCRT and AbsoluteTelnet remain proprietary. Both GUI and CLI interfaces are well-represented, with some clients like PuTTY and ZOC Terminal offering both, while others specialize in one interface type.
Platform
Platform compatibility determines where SSH clients can be deployed and used. This section examines operating system support across desktop, server, mobile, and embedded platforms. The data reveals patterns in cross-platform development strategies and highlights platform-specific solutions versus universal clients.The operating systems or virtual machines the SSH clients are designed to run on without emulation include several possibilities:
- Partial indicates that while it works, the client lacks important functionality compared to versions for other OSs but may still be under development.
| Name | macOS | Windows | Cygwin | BSD | Linux | Solaris | OpenVMS | z/OS | AIX | HP-UX | iOS | Android | Maemo | Windows Phone |
| AbsoluteTelnet | ||||||||||||||
| Bitvise SSH Client | ||||||||||||||
| ConnectBot | ||||||||||||||
| Dropbear | ||||||||||||||
| lsh | ||||||||||||||
| OpenSSH | ||||||||||||||
| PuTTY | ||||||||||||||
| SecureCRT | ||||||||||||||
| SmartFTP | ||||||||||||||
| Tera Term | ||||||||||||||
| TN3270 Plus | ||||||||||||||
| WinSCP | ||||||||||||||
| wolfSSH | ||||||||||||||
| ZOC Terminal | ||||||||||||||
| Name | macOS | Windows | Cygwin | BSD | Linux | Solaris | OpenVMS | z/OS | AIX | HP-UX | iOS | Android | Maemo | Windows Phone |
Platform support analysis reveals distinct strategies among SSH client developers. OpenSSH demonstrates the broadest compatibility, running on virtually every major operating system including macOS, Windows, Linux, BSD, Solaris, OpenVMS, z/OS, AIX, HP-UX, iOS, and Android, reflecting its role as the industry standard. Dropbear similarly supports wide platform coverage, optimized for embedded and resource-constrained environments. In contrast, Windows-only clients like AbsoluteTelnet, Bitvise SSH Client, Tera Term, and WinSCP serve the large Windows user base with platform-specific features. macOS-focused clients like certain configurations of SecureCRT and ZOC Terminal cater to Apple ecosystem users. Mobile platform support remains limited, with ConnectBot dominating Android and only SecureCRT and WinSCP supporting iOS. The inclusion status on macOS, modern Windows, BSD, and most Linux distributions underscores its ubiquity and reduces the need for alternative clients on these platforms.
Technical
This section examines the technical capabilities and protocol support of SSH clients. Key areas include SSH protocol versions, additional protocols like TELNET and rlogin, tunneling capabilities, advanced features like session multiplexing and Kerberos authentication, and file transfer protocol support. These technical capabilities determine the versatility and security posture of each client.Protocol support reveals significant evolution in SSH client security. Modern clients universally support SSH2, while SSH1 support has been largely deprecated—OpenSSH removed SSH1 support entirely in version 7.6, and several newer clients like Bitvise SSH Client, Dropbear, and wolfSSH never implemented it. Port forwarding and SOCKS proxy capabilities are nearly universal among full-featured clients, enabling secure tunneling for various applications. VPN tunneling via TUN/TAP is less common, supported primarily by OpenSSH, Bitvise SSH Client, and WinSCP. Session multiplexing, which allows multiple SSH sessions over a single connection, is supported by advanced clients like OpenSSH, Bitvise SSH Client, lsh, PuTTY, SecureCRT, and TN3270 Plus, offering performance benefits for users managing multiple concurrent sessions. Kerberos integration, important for enterprise environments, is widely supported across both open-source and commercial clients. SFTP/SCP support for file transfers is nearly universal, though implementation quality varies—some clients offer only basic functionality while others provide full-featured file management interfaces. Proxy client capabilities are comprehensive in clients like PuTTY, SecureCRT, and WinSCP, supporting SOCKS 4/5, HTTP, Telnet, and custom proxy types.
Features
Beyond core protocol support, SSH clients differ significantly in user-facing features that affect usability, productivity, and workflow integration. This section compares features such as keyboard mapping, session tabs, file transfer protocols, text search, mouse support, Unicode handling, scripting capabilities, and security features like public key authentication, smart card support, and FIPS 140-2 validation. These features distinguish basic terminal clients from comprehensive remote access solutions.| Name | Keyboard mapping | URL hyperlinking | Hardware encryption | ||||||||||||
| AbsoluteTelnet | |||||||||||||||
| Bitvise SSH Client | |||||||||||||||
| OpenSSH | |||||||||||||||
| PuTTY | |||||||||||||||
| SecureCRT | |||||||||||||||
| SmartFTP | |||||||||||||||
| Tera Term | |||||||||||||||
| TN3270 Plus | |||||||||||||||
| wolfSSH | |||||||||||||||
| ZOC Terminal |
Feature comparison reveals the divide between basic terminal clients and comprehensive remote access solutions. Session tabs and advanced UI features are primarily found in commercial clients like SecureCRT, SmartFTP, Tera Term, TN3270 Plus, and ZOC Terminal, while command-line tools like OpenSSH rely on external terminal emulators for such functionality. ZMODEM file transfer support, once popular for serial communications, remains available in several clients but has largely been superseded by SFTP/SCP. Unicode support is now standard across modern clients, essential for international character sets and proper terminal display. Public key authentication is universally supported, representing the security standard for SSH connections. Smart card support and hardware encryption capabilities are concentrated in commercial and specialized clients, targeting enterprise and high-security environments. FIPS 140-2 validation, required for certain government and regulated industry deployments, is available in AbsoluteTelnet, SecureCRT, SmartFTP, and select OpenSSH configurations. Scripting support varies widely: some clients offer no scripting, while others provide comprehensive automation through platform-native languages or proprietary scripting engines. The emergence of FIDO2/security key support represents the latest evolution in authentication technology, enabling hardware-backed cryptographic keys for enhanced security.