What is skiff?

Skiff is a self-hosted SSH connection manager for developers and operators who want full control over their SSH inventory. It runs an in-browser terminal where SSH sessions live on the server process — closing a tab or losing connectivity doesn't end your work; you reattach with recent scrollback. Its standout feature is Memory: a searchable, encrypted history of commands and their output across all hosts, plus before-and-after file diffs for supported edits, host notes, and reusable snippets. Sessions can be recorded in asciicast format for replay. Credentials are stored in an AES-256-GCM encrypted SQLite vault with argon2id key derivation; the key stays in memory only while unlocked. Team mode adds per-user logins sharing one vault, admin password reset, and an audit log. Deployment is a single docker compose command (or Node.js 20+ with pnpm), binding to localhost by default. The project does not support LDAP/SAML/SSO, SFTP file transfers, jump hosts, or RBAC in the open-source edition. Dark and light themes are included. A separate desktop edition adds file transfer, port forwarding, jump hosts, approvals, and a verifiable audit log.

Should you self-host skiff?

skiff scores 47/100 on selfhost.directory (how scoring works) and ranks #3 of 6 in SSH. It has 167 GitHub stars.

It shipped 6 stable releases in the past year. The latest, v0.4.0, came out on 10 October 2026. New versions land roughly every 3 weeks.

Setup is moderate: expect some configuration beyond a single command. It is AGPL-3.0-licensed and written mostly in Typescript.

Its closest alternative on selfhost.directory is Termix (76/100, 15 704 stars). It scores higher overall, so compare the two before you pick. See skiff vs Termix side by side.

Features

Auto-lock on idle
Command memory & searchBest-effort capture; full-screen apps are marked not recorded
Encrypted credential vault
File diff trackingNo automatic restore; small text files only
Folders, favorites, search
Host notes & snippets
In-browser terminal
Persistent SSH sessions
Session recording & playback
SSH config importDoes not handle Include directives or Match blocks
SSH fingerprint pinning
Team modeNo RBAC; all members see all hosts

How to configure skiff

HOST_ADDR127.0.0.1Docker only: address the port is published on the host
Docker only: address the port is published on the host
values: IP address
HOST_PORT8080Docker only: port published on the host
Docker only: port published on the host
values: port number
SKIFF_COOKIE_SECRETSecret for the cookie layer, required in production. Generate with: openssl rand -hex 32
Secret for the cookie layer, required in production. Generate with: openssl rand -hex 32
values: 32+ character random string
SKIFF_DATA_DIR./dataWhere the vault (skiff.sqlite) and recordings live
Where the vault (skiff.sqlite) and recordings live
values: absolute path
SKIFF_HOST127.0.0.1Address the server listens on (Docker image uses 0.0.0.0 inside container)
Address the server listens on (Docker image uses 0.0.0.0 inside container)
values: IP address
SKIFF_INSECURE_HTTPfalseAllow signing in over plain HTTP from other machines (trusted networks only)
Allow signing in over plain HTTP from other machines (trusted networks only)
values: true/false
SKIFF_MAX_SESSIONS_PER_USER20Maximum live SSH sessions one person may hold open
Maximum live SSH sessions one person may hold open
values: integer
SKIFF_PORT8080Port the server listens on
Port the server listens on
values: port number
SKIFF_SETUP_TOKENFirst-run token for vault initialization. Leave blank for auto-generated token printed to logs
First-run token for vault initialization. Leave blank for auto-generated token printed to logs
values: 16+ character string
SKIFF_TRUSTED_ORIGINSComma-separated list of origins allowed to call the API from a browser when proxying to a different domain
Comma-separated list of origins allowed to call the API from a browser when proxying to a different domain
values: comma-separated origins
SKIFF_TRUST_PROXYReverse proxy address (IP or CIDR) so Skiff sees real client IPs for rate limiting and audit log
Reverse proxy address (IP or CIDR) so Skiff sees real client IPs for rate limiting and audit log
values: IP or CIDR, comma-separated

FAQ

Can I self-host Skiff?

Yes. Run the webapp on your own hardware with Docker or Node.js, or install the desktop app locally. Skiff has no hosted vault service.

Is Skiff a replacement for Teleport?

Skiff focuses on SSH work with webapp Memory and desktop tools for approvals and audit. It does not provide Teleport's broader identity and infrastructure access platform.

What makes the audit log tamper-evident?

The desktop audit log links each entry to its predecessor with SHA-256. Local verification detects inconsistent entries and links, proving internal consistency but not authenticity against an attacker who can recompute the whole chain.

What is the difference between the desktop app and the server?

Desktop v1.0.0 provides local terminals, SFTP, tunnels, approvals, and a hash-chained audit log. The webapp provides browser access, persistent sessions, shared-vault team accounts, and Memory in v0.4.0.

Does Skiff send any telemetry?

No telemetry. Fonts and recording playback are bundled. The webapp only connects to SSH hosts you choose; the desktop has an optional update check you can disable.

Is Skiff free?

Yes, both editions are open source with no cloud account, license key, trial, or seat quota. The webapp is AGPL-3.0-only; the desktop engine is Apache-2.0 and its app is AGPL-3.0-only.