Build the exact SSH command you need.

Point-and-click your way from a plain login to multi-hop jump chains, SOCKS proxies and reverse tunnels — with a live diagram, a ready-to-paste ~/.ssh/config block and an explanation of every single flag.

100% static & offline-capable. No account, no server, nothing ever leaves this browser tab.

Start from a use case

Loads a working configuration you can then tweak

1 Destination where you want to end up

Host or IP *

Port

Username

Alias ssh_config

Name for the Host entry, so you can just type ssh prod-web.

2 Authentication how you prove who you are

Method

Identity files -i

Typical paths: ~/.ssh/id_ed25519, ~/.ssh/id_rsa, ~/.ssh/id_ecdsa.

Certificate file CertificateFile

PKCS#11 provider -I — smartcard / YubiKey

Only use these keys IdentitiesOnly=yes Stops the agent from offering every key it holds — fixes “Too many authentication failures”. Forward the SSH agent -A Anyone with root on the remote host can use your keys while you are connected. Prefer ProxyJump. Add key to agent after unlocking AddKeysToAgent=yes Type the passphrase once per session instead of once per connection. Batch mode — never prompt BatchMode=yes Fail instead of asking for a password. Use this in scripts and cron jobs.

Heads-up: OpenSSH deliberately refuses to take a password on the command line. For automation use a key; if you truly must script a password, wrap it: sshpass -p 'secret' ssh … …and be aware the password is then visible in your shell history and in ps.

3 Jump hosts bastions to hop through

Each hop is reached through the previous one. Your keys stay on your machine — no key material is ever copied to a bastion.

Legacy mode — use ProxyCommand For OpenSSH < 7.3 which has no -J. Generates ProxyCommand ssh -W %h:%p ….

4 Tunnels & proxies port forwarding, SOCKS

Abort if a forward fails ExitOnForwardFailure=yes Otherwise SSH connects happily with a dead tunnel — the classic “why is nothing listening?”. Let other machines use the tunnel GatewayPorts=yes Binds to 0.0.0.0 instead of loopback. For -R the server's sshd must allow it too. Clear forwards inherited from config -o ClearAllForwardings=yes

5 Session behaviour shell, TTY, X11, verbosity

Tunnel only, no shell -N Standard for pure port-forwarding sessions. Go to background after authenticating -f Detaches the process. Combine with -N; kill it later with pkill -f. Compression -C Helps on slow or metered links, costs CPU on fast ones.

Terminal allocation

Force it when running sudo, top or nested ssh remotely.

Output verbosity

-vvv is the first thing to try when auth mysteriously fails.

X11 forwarding

IP version

Remote command

Runs instead of an interactive shell. Quoting is handled for you.

Send environment variable SetEnv

Local bind address -b

Pick the outgoing interface on multi-homed machines.

6 Reliability & speed keepalive, multiplexing

Keep the connection alive ServerAlive* Stops NAT gateways and firewalls from silently dropping idle sessions.

Probe interval (s)

Missed probes before giving up

Connection multiplexing ControlMaster Reuse one authenticated TCP session for every later connection — subsequent logins become instant.

Control socket path

Keep master alive for

10m, 1h, yes (forever) or no.

Connect timeout (s) ConnectTimeout

Connection attempts ConnectionAttempts

Wrap in autossh Auto-restarts the tunnel if it dies. The go-to for permanent reverse tunnels.

7 Host keys & crypto trust and algorithms

Host key checking

Known hosts file

Man-in-the-middle risk. Disabling host key checking means you cannot tell the real server from an impostor. Acceptable for throw-away lab VMs, never for anything that matters. Pair it with UserKnownHostsFile=/dev/null to avoid polluting your real file.

HostKeyAlgorithms

Add +ssh-rsa to reach legacy appliances.

KexAlgorithms

Ciphers

MACs

LogLevel

8 Advanced raw options, binary

Client binary

Alternate config file -F

Extra -o options

Connection path

1 hop

Append this to ~/.ssh/config (chmod 600), then simply ssh host.

Saved profiles

stored in this browser only