ShellDiver vs Wake

With software, free is usually a question rather than an answer. Here it is arithmetic: no server of ours, no accounts, no analytics — nothing for a subscription to pay for. Sync, startup commands, port forwarding: all of it is in the app. WHERE YOUR KEYS LIVE In your device's keychain. ShellDiver has no account and no sign-in — there is simply nowhere on our side for anything of yours to sit. An Ed25519 key either travels with you through iCloud Keychain, end-to-end encrypted, or stays on this device behind Face ID. A Secure Enclave key is created inside the security chip. It cannot be read out — not even by ShellDiver — never leaves the device, and will ask for Face ID on every sign-in if you want it to. THE VAULT Instead of iCloud you can take syncing into your own hands: an encrypted file in a place you choose. A USB stick, a cloud folder, or your own WebDAV server, so Nextcloud, ownCloud, a Synology, an Apache with mod_dav. It works across different Apple IDs and carries the secrets with it: saved server passwords and private keys. Only your devices encrypt and decrypt. Whoever runs the storage location sees nothing but unreadable files. You add a second device with a QR code, without typing your passphrase there. THE TERMINAL It does not hang up because you looked somewhere else for a minute: the connection belongs to the session, not to the screen. The running build and the half-typed line are still there when you come back. Up to 20 sessions as tabs, terminals and files mixed. Real xterm emulation: colour, UTF-8, resizing that works — htop, vim and colourful logs look the way you expect. Plus search through the scrollback, your choice of monospaced font including Nerd Fonts, and five colour schemes. On iPhone there is a row above the keyboard with esc, ctrl, tab, arrows and a paste key, because a phone has no ⌘V. When the link drops, ShellDiver notices through keepalives and rebuilds it by itself. This is SSH, not Mosh: the new shell starts fresh. SIGNING IN WITHOUT GUESSING ShellDiver asks the server which methods it offers and works through whatever it holds credentials for. That covers publickey followed by keyboard-interactive — 2FA after the key — and equally a server that only offers keyboard-interactive while the host is saved as "password". One-time codes are never pre-filled and never stored. You confirm a host key once, by its fingerprint. Every connection after that checks it, and a key that has changed is refused rather than waved through. THROUGH A JUMP HOST When a server is only open on the inside, you give it a jump host — OpenSSH's ProxyJump. The jump host then forwards nothing but encrypted bytes and cannot read along; both sign-ins are signed on this device. So your key does not have to sit on the machine in between, and a Secure Enclave key works here too. FILES AND TUNNELS The SFTP browser downloads and uploads, whole folders included, renames, and deletes recursively. Local port forwarding brings a database or an admin interface onto this device. It listens on 127.0.0.1 only and cannot be reached from outside; each rule holds its own connection, so a tunnel does not fall with a terminal. WHAT YOU ALREADY HAVE Your ~/.ssh/config is imported, with each IdentityFile matched against the keys you have and any ProxyJump resolved; so is known_hosts, hashed entries as far as they can be matched. Keys come in as Ed25519, RSA or ECDSA — from the OpenSSH container, from PuTTY's .ppk (v2 and v3), and from the PEM family. A passphrase on the file is used once during import and not kept. Snippets are also the buttons above the keyboard — global or bound to one host, with a confirmation step if you want one. One per host runs by itself as soon as the shell is open. The backup is a JSON file you can read — secrets sit inside an encrypted block under a passphrase you choose. Without it nobody gets at them, us included.

Your sessions live on your own machine, inside tmux. Close Wake, lose signal, reboot the phone — they keep running, and Wake reattaches exactly where they were. Built for the way people work with coding agents: several long-running sessions on a Mac or Linux box, checked on from a phone. THE DASHBOARD One row per session, with the state you actually want to know: producing output, quiet and probably waiting for you, or idle — plus the last line each one printed. Tap to attach. A REAL TERMINAL, NOT A CHAT Full xterm emulation with one-finger scroll and native selection. Search inside the session. A snippet bar above the keyboard with {{placeholders}} you fill in as you insert. Paste without the system prompt. Nerd Font glyphs, so prompts and TUIs look right. Light and dark themes. On iPad, two sessions side by side. HISTORY THAT DOES NOT EVAPORATE Every byte your sessions print is appended to a log on your own server, then synced to the phone and indexed. Search across sessions and across days, read it on the train with no connection, export a whole transcript to a file. Nothing is lost to a scrollback limit — and the list of what you were doing, and where, outlives the machine that ran it. PROJECTS, NOT CONNECTIONS Every git repo under the folders you choose, with dirty and unpushed badges so you can see where the work is. Launch templates turn one tap into the right command in the right directory. Browse files over SFTP with Quick Look, upload, rename, make folders. Read git status, log and diff; commit and push. WAKE THE MACHINE Your Mac is allowed to sleep. Tap the server and Wake sends a magic packet through another machine on that network, waits for SSH to answer, and puts you back into your sessions. WHAT IT NEEDS ON THE SERVER sshd, tmux 3.3 or newer, and git. Nothing else. No agent to install, no daemon, no account, no cloud service in the middle. A guided preflight checks every requirement and shows you the exact command to paste for anything missing. KEYS AND ACCESS Import an existing private key in any container: OpenSSH (encrypted too), PKCS#8, PEM, PuTTY .ppk. Ed25519 and ECDSA P-256/384/521 — RSA is not supported, generate an Ed25519 key instead. Keys live in the Keychain, host keys are pinned on first connection and a change blocks the connection. Face ID can lock the whole app. WAKE PRO Wake is free with one server and two live sessions, and every reading feature — history, search, export — is included. Wake Pro — monthly, yearly, or a one-time lifetime purchase — unlocks unlimited servers and sessions. Subscriptions renew automatically unless cancelled at least 24 hours before the end of the current period; payment is charged to your Apple Account at confirmation of purchase, and you can manage or cancel it in your App Store account settings. Nothing you created is ever taken away: if a subscription lapses, extra servers stay in the list and existing sessions remain attachable. PRIVACY No account, no telemetry, no tracking. Your logs stay on your server and on your phone, kept out of iCloud backup. Known secrets — API tokens, private keys — are masked in the search index. Retention is yours to set, on both sides. FROM ANYWHERE, NO OPEN PORTS Wake talks plain SSH, directly or through a Cloudflare Tunnel: pick "Cloudflare Tunnel", type your tunnel's hostname, and Wake opens the same connection cloudflared would — nothing to install on the phone, no port open on your router, service tokens supported for hostnames behind Cloudflare Access. WireGuard and Tailscale work too. Nothing is relayed through us, because there is no us in the path. Wake is not affiliated with or endorsed by any coding agent or service; their names are used only to describe what runs inside your terminal sessions. LEGAL Privacy Policy: https://marcotini.com/privacy-policy Terms of Use (EULA): https://marcotini.com/eula