SSH Keys

Generating a key

Open Key Generation and choose an RSA key size:

• 2048-bit (default)
• 3072-bit
• 4096-bit

Keys are generated on-device using JSch and saved to the app’s private storage (filesDir/ssh_keys) — private keys never leave the watch unless you explicitly send the public key to the phone.

Using a key to connect

When adding or editing a server, set Auth type to Key and select a generated key. WearSSH handles the handshake; no manual authorized_keys copy step is needed from the watch side — you still need to add the matching public key to the target server’s ~/.ssh/authorized_keys yourself.

Sending a key to the phone

From the key list, use Send to Phone to push the public key to the paired companion app over the Wear OS Message API (/ssh_key path). This is handy for copying the public key into authorized_keys on a target server via the phone.

Deleting a key

Keys can be removed from the watch at any time from the key list. Deleting a key does not remove it from servers that already trust it — remove the corresponding entry from the server’s authorized_keys separately if needed.