Security model

TermBridge is end-to-end encrypted between your phone and your Mac. The relay in the middle routes sealed frames and never holds a key or sees plaintext.

End-to-end encryption

Every frame is encrypted with X25519 key exchange and AES-256-GCM. The relay only ever sees ciphertext. Your terminal data — commands, output, file paths, everything — is opaque to anything between your two devices.

Forward secrecy

Each connection uses a fresh ephemeral key. Your static pairing secret never directly encrypts a single byte of session data, so a compromise of one connection’s key can’t decrypt past or future sessions.

Channel binding

The fingerprint you confirm during pairing is an HMAC over both devices’ ephemeral keys. This blocks a malicious or compromised relay from sitting in the middle of the handshake — forge it and the handshake aborts. The relay is treated as untrusted infrastructure, by design.

Keys never leave your devices

Pairing derives the shared secret directly between phone and Mac. There is:

• No account — nothing to phish or take over.
• No key server — nothing central to breach.
• No password stored anywhere.

The keys live only on the two devices that derived them.

No inbound exposure

Your Mac holds a single outbound encrypted connection to the relay. There is no inbound port, no public IP, and no port-forwarding — so installing TermBridge exposes nothing new to the internet. This is a deliberate contrast with SSH, which needs a reachable, listening server.

The relay’s role

The relay is a thin router. It pairs a phone and a Mac into a private room and forwards sealed frames between them. It cannot read them, modify them undetectably, or impersonate either side. Tier limits (how many Macs/terminals your plan allows) are enforced here — at the relay — because it’s the one component neither device controls. See Plans & limits.

What touches your Mac

A small marked block in your ~/.zshrc sources a guarded hook that re-execs your interactive shell through the agent. TermBridge backs up your ~/.zshrc before adding it and asks your permission first. It always fails safe — a missing binary or bad state can never lock you out of a terminal — and everything is reversible with the bundled uninstaller.

Next

See how Plans & limits are enforced.