SECURITY
ZestSSH Juiced uses zero-knowledge end-to-end encryption. Your SSH connections, keys, and credentials are encrypted on your device before anything leaves it. The server stores only opaque encrypted data — we cannot read your information, and neither can anyone else.
Full architecture, threat model, and cryptographic primitives — for security reviews and compliance checks.
Every piece of synced data is protected with industry-standard algorithms:
AES-256-GCM Data encryption — authenticated encryption that detects any tamperingArgon2id Password-based key derivation — memory-hard, OWASP-recommended, resistant to GPU and ASIC attacksHKDF-SHA256 Verification-key derivation with domain separationSQLCipher Local database encryptionOS-native secure storage Keychain on iOS/macOS, Android Keystore, Windows DPAPI, and libsecret on LinuxNo custom or proprietary cryptography is used. Every primitive is a well-audited standard from maintained open-source libraries.
Your data is encrypted with a random 256-bit Data Encryption Key (DEK) that is generated once on your device and never leaves it in unencrypted form. This DEK is wrapped (encrypted) separately by two keys:
Either path can unlock the DEK, which in turn decrypts your data. This means changing your password never requires re-encrypting your data, and your recovery key provides a fully independent decryption path.
Everything syncable: SSH connections, identities, private keys, stored passwords, known_hosts entries, connection groups, snippets, and port-forwarding rules. Before any data leaves your device, it is serialized, compressed, and encrypted with AES-256-GCM. The server only ever sees the resulting ciphertext.
When you first set up sync, you're issued a one-time recovery key formatted as:
ZEST-XXXX-XXXX-XXXX-XXXX-XXXXThis key is generated on your device, shown only once, and never transmitted to our servers. If you forget your password, the recovery key can unlock your data and let you set a new one.
Save it somewhere safe — a password manager, a printed copy in a drawer, wherever you keep things you genuinely can't afford to lose.
All communication between the app and our servers uses TLS 1.2+ with certificate validation. Even if TLS were compromised on a given connection, your data would remain encrypted with keys the server never sees — the transport layer protects metadata, not your data's confidentiality.
On your device, your SSH credentials and sync keys are stored in your operating system's native secure storage (Keychain, Keystore, DPAPI, libsecret). The local ZestSSH database is independently encrypted with SQLCipher using a key held in that same secure storage. Both layers must be compromised for local data to be exposed.
Destructive operations — deleting your sync data, deleting your account — require proof that you hold your sync password, not just a valid login token. This means an attacker who steals your session cannot wipe your data out of spite or ransom.
ZestSSH contains zero analytics, zero crash reporting, and zero telemetry. No Firebase. No Crashlytics. No usage tracking of any kind. We have no idea how you use the app, how often you open it, what servers you connect to, or what commands you run. The only third-party service that receives any data is RevenueCat for purchase verification — and that contains only an anonymous app user ID.
ZestSSH's Automation Engine lets external apps trigger pre-configured SSH commands on your servers. Because this feature exposes an execution path, it's built with multiple layers of defense to keep that power under your control:
Local backups (.zest files) use the same encryption primitives as Juiced:
Because backups are encrypted with your password — not a ZestSSH-held key — you can safely store them in third-party cloud services (Google Drive, iCloud, Dropbox) without exposing your data to those providers.
ZestSSH is built by one person, and I take security reports seriously. If you've found a vulnerability, I'd love to hear about it.
Contact: [email protected]
I can't offer cash rewards — I'm a full-time college student working on this in my spare time — but validated security findings get a free ZestSSH Squeezed license or Juiced upgrade, public acknowledgment (if you want it), and my genuine thanks.
See the full disclosure policy for scope, safe harbor commitments, and disclosure timing.
This is not a policy. It is a mathematical property of how the system is built.
Try Juiced with confidence. We built it so even we can't see what you store.