# shell360 is an SSH client that treats the phone as a first class target

> shell360 is a cross-platform SSH and SFTP client built with Tauri, a TypeScript and React front end and a Rust core, and it ships for Windows, macOS, Linux, Android, iOS and HarmonyOS. The interesting parts are the Rust SSH implementation sitting underneath rather than a wrapper around an existing library, and the way a whole host's worth of configuration can be moved between a desktop and a phone.

**nashaofu/shell360** — Shell360 is a cross-platform SSH and SFTP client.

- Repository: https://github.com/nashaofu/shell360
- Website: https://nashaofu.github.io/shell360/
- Stars: 1,161 · Forks: 66
- Language: TypeScript
- License: GPL-3.0
- Published: 2026-10-19 · Updated: 2026-10-19 · Language: en
- Canonical page: https://hysenlabs.com/projects/nashaofu-shell360

## A console client with a phone app attached

Shell360 is a cross-platform SSH and SFTP client supporting Windows, macOS, Linux, Android and iOS, and the README frames the use cases as remote development, server management and secure file transfer, with the promise of a consistent experience across all of them. The screenshots are the clearest signal of the intent, since they are grouped as a mobile gallery, a pad gallery and a set of terminal themes, so the design is being thought about for a phone screen rather than adapted to one. The application layer is Tauri, which is what makes a single codebase produce a desktop binary and a mobile app, and the front end is TypeScript and React. The tree shows the shape of that: separate `desktop/`, `mobile/`, `android/`, `ios/` and `harmonyos/` directories, a `src-tauri/` directory for the desktop shell, a `packages/` directory for the shared front end, and `crates/` for the Rust core. HarmonyOS is a first class target rather than an afterthought, which is unusual for a terminal client.

## Three package managers on the desktop, four stores on mobile

The installation story is a good indicator of how seriously the project takes distribution. On macOS it is a single cask:

```bash
brew install --cask shell360
```

On Windows there are two:

```bash
winget install nashaofu.shell360
# or
scoop install shell360
```

And on mobile the README links the App Store, Google Play and the Huawei AppGallery, with the package identifier given as `com.nashaofu.shell360` in the store links, plus a TestFlight programme and a Google Play testing programme for early access to new features. The desktop downloads all point at the GitHub releases page rather than at a separate site, so the release artefacts and the store builds come out of the same repository. For anyone evaluating the project, the practical note is that the mobile builds are distributed through the stores rather than as sideloaded binaries, which means the code signing, the review process and the update cadence are the store's as much as the project's.

## The Rust side owns the SSH, not a wrapper

The Cargo workspace is where the engineering lives, and the member list is more informative than the feature list. Alongside the main `src-tauri` crate there are `crates/shell360-ssh`, `crates/shell360-store`, `crates/shell360-runtime`, `crates/shell360-ffi`, `crates/shell360-keygen`, `crates/shell360_ohrs` for the HarmonyOS side, `crates/jsb-core`, and three Tauri plugins, one for SSH, one for data and one for PTY. The SSH implementation is described as a custom Rust plugin, and the dependency list confirms the choice, with `russh` at 0.62.5 and default features turned off, `russh-sftp` at 2.4.0, `rusocks` for the SOCKS side, and tokio at 1.53.1 for the async runtime. The PTY plugin is what a terminal needs to run a real shell rather than a command runner, and the separate keygen crate is where the host key and user key handling lives. Turning off russh's default features and wiring the pieces by hand is what a project does when it wants to control the protocol surface itself.

## Authentication coverage is the part users check first

The secure connection section is where the feature list is most concrete. The client supports password, public key, certificate, SSH Agent and keyboard-interactive authentication, which is the full set you meet in practice, from a shared server with a passphrase prompt to a hardware token workflow. It also supports multi-factor authentication, and it handles ED25519, RSA and ECDSA keys, so the key types people actually generate are covered. On top of that there is application data encryption, which is the local half of the security story, and the data storage layer is described as encrypted local storage, with a Tauri plugin for the store and one for the machine UID. A jump host connection is supported for cross-server management, which is the feature that turns a phone client into something you can use for a server behind a bastion, and it is the one that most distinguishes this from a basic terminal.

## Port forwarding in all three directions

The port forwarding section is short but complete, and it covers the three shapes that exist. Local port forwarding, which opens a port on your machine and forwards it to the far side. Remote port forwarding, which is the opposite, opening a port on the server that forwards back to you. And dynamic port forwarding, which gives you a SOCKS proxy, and that is the one that turns an SSH connection into a general network tunnel for whatever else on the device needs it. That combination, with jump host support and SFTP for file transfer, is essentially the feature set of a full remote administration client, and the README lists it in four lines, which suggests these are the parts the project considers settled rather than the parts it is still exploring. The SFTP client is described as powerful without further detail, so the file management experience is one area where the documentation is thinner than the rest.

## Moving a configuration between a phone and a laptop

The cross-platform section carries one feature that is easy to miss and that matters a great deal in practice, support for importing and exporting app configurations so you can synchronise between devices. A host list, its credentials and its settings are not small pieces of data, and typing them on a phone is the kind of chore that stops people using a mobile SSH client at all. The export and import is a manual, file based synchronisation rather than a cloud account, which keeps the credentials in your hands and off someone else's server, and that fits the rest of the design. The theming section is the other mobile first detail, with light and dark themes, six built-in terminal themes and support for custom terminal fonts, since a terminal on a phone needs a legible monospace face at a comfortable size, and a theme that was designed for a 27 inch monitor rarely is.

## Licence, tooling and where the project stands

The licence is the GNU General Public License v3.0, and the README gives the SPDX identifier as GPL-3.0-or-later, with the text in the LICENSE file. There is a detail worth checking before you build on it, because the root JavaScript manifest declares the package as MIT licensed while the project itself is GPL, and the two declarations in the same repository are a discrepancy someone should reconcile. The JavaScript side is managed with pnpm, with a preinstall hook that refuses to let anything but pnpm install the workspace, and the root manifest asks for Node 24 or later. Formatting and linting are handled by biome with a check and a write variant, and the Rust side has its own rustfmt configuration. There is a `scripts/` directory with per-platform build commands for Android, iOS and HarmonyOS, each with a dev and a build task, and a workspace script that runs the tauri CLI. The releases are steady, v0.2.5 in July 2026, v0.2.6 in August and v0.2.7 on 2026-09-15, with the last push to the repository on 2026-10-11, so the project is actively worked on even though the version numbers are still in the zero series.

## Conclusion

shell360 suits someone who needs to reach a server from a phone or a tablet as easily as from a laptop, and it suits a developer who wants to read a Rust SSH implementation that uses russh directly rather than shelling out to an external binary. It is a poor fit if you need the full key management of a mature desktop client, since the feature list is compact and the plugin set is small, and it is a poor fit if the licence matters to you, because the project is GPL-3.0-or-later while the root JavaScript manifest declares MIT, and that mismatch needs resolving before you ship. Before you install it, check three things: which package manager you use on your platform, since the install path differs per platform, whether your servers use the authentication methods it supports, and where the project is in its release line, with v0.2.7 published on 2026-09-15 and the last push on 2026-10-11.

## FAQ

### How do I install shell360?

On macOS with `brew install --cask shell360`, and on Windows with `winget install nashaofu.shell360` or `scoop install shell360`. The mobile builds are distributed through the App Store, Google Play and the Huawei AppGallery, with TestFlight and Google Play testing programmes for early access.

### Which authentication methods does shell360 support?

Password, public key, certificate, SSH Agent and keyboard-interactive authentication, with multi-factor authentication support and key types including ED25519, RSA and ECDSA. There is also application data encryption and encrypted local storage for the data the app keeps on the device.

### Does shell360 support port forwarding and jump hosts?

Yes, all three forms of forwarding, local, remote and dynamic as a SOCKS proxy, plus jump host connections for managing servers across a bastion. The SFTP client handles file transfer on the same connections.

### How is shell360 built?

With Tauri for the cross-platform shell, a TypeScript and React front end and a Rust core. The Rust workspace contains a custom SSH plugin built on russh with default features disabled and russh-sftp for SFTP, a PTY plugin, a store plugin, a key generation crate and separate crates for the runtime, the HarmonyOS target and the FFI layer.

### What licence is shell360 under?

The GNU General Public License v3.0, with the SPDX identifier GPL-3.0-or-later and the text in the LICENSE file. The releases are v0.2.7 from 2026-09-15 with the last push to the repository on 2026-10-11, and the root JavaScript manifest separately declares an MIT licence for the workspace package.

## Sources

- [License: GPL-3.0](https://github.com/nashaofu/shell360/blob/master/LICENSE)
- [nashaofu/shell360 on GitHub](https://github.com/nashaofu/shell360)
- [Project website](https://nashaofu.github.io/shell360/)
- [README](https://github.com/nashaofu/shell360/blob/master/README.md)
- [Releases](https://github.com/nashaofu/shell360/releases)

---

Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/nashaofu-shell360