Elio Free SSH Client and Terminal with Localtonet
Elio: A Free, Open-Source SSH Client and Terminal for Every Device, with Localtonet Built In
In this article 11 sections
Elio is a free, open-source SSH client and terminal that opens your servers in a fraction of a second, and reaches machines behind NAT through Localtonet
Most SSH clients make you choose: a fast native app that only runs on one operating system, or a cross-platform tool that ships a whole browser inside it. Elio is one native app for Windows, macOS, Linux, Android and iOS, with no Electron and no web view. The terminal is drawn straight to the GPU, your servers and keys follow you between devices with end-to-end encrypted sync, and when you sign in with Localtonet, computers behind a router or firewall appear in the sidebar and connect without opening a single port. This guide explains what Elio does, how to get started in a few minutes, and how the Localtonet integration works.
📋 What's in this guide
What is Elio?
Elio is a terminal and SSH client built to be the one tool you open all day. It connects over SSH, Telnet, serial ports and local shells, it browses remote files with a two-pane SFTP manager, it runs Mosh and tmux natively, and it keeps your whole server library in sync across every device you own. It runs on Windows, macOS, Linux, Android and iOS from a single codebase, and the project is released under the Apache License 2.0. The website is at elio.sh and the source code is on GitHub.
Nothing is held back behind a subscription. There is no paid tier inside the app, no account is needed to use it, and it collects no telemetry. The only request Elio makes on its own is an optional version check against GitHub, at most once a day on a computer, which you can turn off in Settings.
Why Elio feels instant
The terminal engine is libghostty-vt, rendered with Skia and HarfBuzz, so text is drawn directly on the GPU instead of through a browser layer. Output is pulled from the connection only as fast as the screen can take it. That detail matters in practice: running cat on a huge file does not freeze the window, and Ctrl+C still answers at once while a server floods the terminal with output.
Elio features at a glance
Everything below works without a Localtonet account. The table lists the main areas and what each one gives you.
| Area | What you get | Why it matters |
|---|---|---|
| SSH | Passwords, Ed25519, ECDSA and RSA keys, OpenSSH certificates, SSH agent and Pageant, FIDO2 security keys, jump hosts, SOCKS5 and HTTP proxies, local, remote and dynamic port forwarding, agent and X11 forwarding | Covers the setups real infrastructure uses, including keys that never leave a hardware token. |
| Mosh and tmux | Elio speaks the Mosh protocol itself, and tmux -CC turns tmux windows and panes into native Elio tabs and splits |
Sessions survive a sleeping laptop or a network change, and you keep native scrolling and selection. |
| SFTP | Two-pane browser, transfer queue with pause and resume, server-to-server copy, edit in place, Zmodem in the terminal | Transfers continue where they stopped, and a half-written file never replaces a good one. |
| Many servers at once | Open a group side by side, broadcast input to every pane, run one command on several servers and read each exit code in one table | Fleet work becomes a single window instead of a dozen. |
| Server library | Nested groups, tags, group defaults, a keychain of reusable identities, key generation, and imports from OpenSSH config, PuTTY, Ansible inventories, CSV, DigitalOcean and AWS EC2 | Bring what you already have in, and change a key once for every server that uses it. |
| Terminal tools | Find in output with regular expressions, shell marks, command suggestions, command history, Kitty graphics, terminal screenshots, session restore, portable mode | Small details that save minutes many times a day. |
| Sharing | Share any terminal with a link and a password, view-only or with typing allowed | Pair on a problem with no port opened and no account needed on either side. |
Elio and Localtonet: SSH to devices behind NAT with no open ports
The hardest SSH problem is rarely the client. It is reaching the machine. A Raspberry Pi at home, a workstation at the office, a server behind a carrier-grade NAT or a corporate firewall: none of them accept inbound connections, and opening a port on a router is both fiddly and risky. Localtonet solves exactly this, and Elio has the integration built in.
Once you sign in with Localtonet, your Localtonet devices show up in the Elio sidebar with their online state. They connect like any other server, file browser included, and the connection is end to end even when both sides are behind NAT. The integration is optional. Elio does everything else in this article without it.
The key Elio receives from Localtonet can only list your devices and prove your identity to the sync server. It cannot open a shell, and you can revoke it from your Localtonet account at any time. Opening a shell on a device takes either your approval in the browser or that device's access key.
Enable the terminal on the computer you want to reach
On that machine, with the Localtonet client installed and running, enable the terminal feature:
localtonet --terminal enableSign in with Localtonet in Elio
Press Sign in with Localtonet in the sidebar. A code appears in the browser and in Elio. Check that both show the same code, then approve.
Connect
The computer appears in the sidebar with its online state. Double-click it to open a shell, or open its files in the SFTP browser.
Optional: get access keys for all devices at once
Choose Get access keys for all devices… and approve once in the browser. Elio asks Localtonet for a key for every device, valid for one, two, five or ten years, and keeps them in the vault, so connecting no longer asks each time. A single device's key can also be entered or deleted from its right-click menu.
You can sign in to several Localtonet accounts at the same time with Add another Localtonet account, which is handy if you manage devices for a team or a client.
Get started with Elio in five steps
Download Elio
Builds for Windows, macOS, Linux and Android are on the GitHub releases page, each with its SHA-256 in SHA256SUMS. Linux comes as a tar.gz and a .deb for x64 and arm64, and macOS as an app for Apple silicon and Intel. The iOS app can be built from the same source.
Pick how to begin
The first window offers Local shell, Add server, Import OpenSSH config and Command palette. If you already have hosts in ~/.ssh/config or PuTTY, import them instead of typing them again.
Add a server
Press + in the sidebar and choose SSH, Telnet, serial port or a local command. Enter a name, an address and a user name, and optionally a private key, a group and tags. Elio shows the host key on first connection and asks you to trust it.
Connect fast
Double-click a server, or press Ctrl+Shift+T and type a few letters of its name. Ctrl+Shift+L opens a local shell. On macOS, use Cmd in place of Ctrl.
Learn one shortcut: the command palette
Ctrl+Shift+P lists every command, your snippets, plugin commands, servers and local shells in one searchable list. Everything in Elio can be reached from it.
To build from source instead, Elio targets .NET 10. dotnet run --project src/Elio.Desktop starts the desktop app, and the repository's README describes how to build the terminal engine and package each platform.
Sync your servers, keys and snippets with end-to-end encryption
Sync keeps servers, groups, snippets, identities and known host keys identical on every device. Saved passwords and keys sync too, if you leave Also sync saved passwords on. The important part is how it is protected:
- Encrypted on your device first. The key is derived from your password with Argon2id. The sync server stores ciphertext and nothing else.
- A recovery key is shown once when sync starts, so a forgotten password does not lock you out of your data.
- No account needed. The first device creates a sync code, and other devices join with that code and your password. Alternatively, sign in with Localtonet and the account identifies whose data it is, with no code to type.
- Adding a device takes a one-time code, not your password. The Sync window shows a code and a QR code valid for ten minutes and one use. On a phone, choose Scan QR code.
- Changes merge per item, so editing on two devices at once loses nothing, and a device that was switched off catches up when it opens.
The sync server is open source as well. If you would rather not use the default one, run your own with a single Docker command and enter its address in the Sync window.
An SSH client on your phone that is more than a keyboard
The Android and iOS apps are the same app with a layout made for a small screen. The server list slides in from the side, a finger scrolls the history, and two fingers resize the text. A keyboard button in the corner brings the keyboard up or puts it away.
Pair that with Localtonet and a phone can open a shell on a home server or an office workstation from anywhere, with no VPN to configure and no router to touch.
Built for AI tools and extensible with plugins
Elio is also a Model Context Protocol server. Point an AI tool at the command elio --mcp and it gets two tools: list_servers, which never exposes passwords or keys, and run_command, which runs one command over SSH and returns its exit code and output.
{
"mcpServers": {
"elio": { "command": "elio", "args": ["--mcp"] }
}
}
run_command works only after you enable it in Settings and then tick AI tools may run commands on this server on each server you want to allow. It only works on servers you have already connected to yourself, so their host key is trusted. Every command appears in the window with its exit code and output, and is written to a log in Elio's data folder.
Elio's tabs also recognise the AI coding tool running in them, including Claude Code, Codex, Gemini, Copilot, Aider and Cursor, and show a bar, a bell or a finished-task marker while you are in another tab. For anything else, a plugin is any program that exchanges a few JSON messages on standard input and output, in any language, and it adds commands to the palette. Plugins never see passwords or keys.
Security model
| Layer | How it is protected |
|---|---|
| Vault | AES-GCM encryption, key held by the operating system's key store, optionally behind Windows Hello on Windows |
| Host keys | Pinned on first use. A changed key stops the connection before any credential is sent |
| Sync | End-to-end encrypted with an Argon2id-derived key. The server cannot read what it stores |
| Shared terminals | Encrypted with a key made from the share password. The relay sees only ciphertext |
| Localtonet devices | End-to-end connections, with the device key checked against the one recorded at pairing |
| Privacy | No telemetry. Passwords and keys are never written to logs |
Because Elio is open source, you can read how each of these works, and a private way to report a vulnerability is described in the repository's SECURITY.md.
How Elio compares to a typical SSH client
| Question | Elio |
|---|---|
| Which platforms? | Windows, macOS, Linux, Android and iOS, one app |
| Built on a web view? | No. Native, with the terminal drawn on the GPU |
| Cost and licence? | Free, Apache 2.0, no paid tier, no account required |
| Sync across devices? | Included, end-to-end encrypted, self-hostable |
| Reach machines behind NAT? | Yes, with Localtonet and no open ports |
| Telemetry? | None |
Frequently asked questions
What is Elio?
Elio is a free, open-source terminal and SSH client for Windows, macOS, Linux, Android and iOS. It supports SSH, Telnet, serial ports, local shells, SFTP, Mosh and tmux, and syncs your servers, keys and snippets between devices with end-to-end encryption.
Is Elio really free?
Yes. Elio is licensed under the Apache License 2.0. There is no paid tier inside the app, no account is required to use it, and it sends no telemetry.
Do I need a Localtonet account to use Elio?
No. Elio works fully on its own, including sync. Signing in with Localtonet is optional and adds your Localtonet devices to the sidebar so you can reach computers behind a router or firewall without opening a port.
How do I SSH into a computer behind NAT or a firewall with Elio?
Run localtonet --terminal enable on the computer, choose Sign in with Localtonet in Elio, and approve in the browser after checking that both show the same code. The computer appears in the sidebar and connects like any other server, with no port forwarding.
Can the sync server read my passwords?
No. Everything is encrypted on your device with a key derived from your password using Argon2id before it leaves. The server stores ciphertext only, and without your password or the recovery key nobody can read it. The server is open source, and you can run your own.
Does Elio work on Android and iPhone?
Yes. The same app runs on Android and iOS with a touch layout, a key row above the keyboard, an app lock using the device's fingerprint, face or passcode, and QR code scanning to join sync. An Android package is on the releases page.
Does Elio support Mosh, tmux, SFTP and jump hosts?
Yes to all four. Elio speaks Mosh itself (the server needs mosh-server), turns tmux -CC windows into native tabs, includes a two-pane SFTP browser with a resumable transfer queue, and supports any number of jump hosts, each verified on its own.
Can I import my existing servers?
Yes. Elio imports from your OpenSSH config, PuTTY sessions, Ansible inventories, CSV or TSV files, DigitalOcean droplets and AWS EC2 instances. Importing twice never adds a server twice.
Take your terminal everywhere, and reach every machine you own
Download Elio, import your servers in a minute, then sign in with Localtonet to open the computers behind your router or firewall without opening a single port.
Get Started Free →
Localtonet is a secure multi-protocol tunneling and proxy platform designed to expose localhost, devices, private services, and AI agents to the public internet supporting HTTP/HTTPS tunnels, TCP/UDP forwarding, mobile proxy infrastructure, file server publishing, latency-optimized game connectivity, and developer-ready AI agent endpoint exposure from a single unified control plane.
