An SSH client is a software program which uses the secure shell protocol to connect to a remote computer. This article compares a selection of notable clients.
SSH (Secure Shell) clients provide encrypted network connections for remote system administration, file transfers, and secure tunneling. These clients range from lightweight command-line utilities to feature-rich graphical applications, serving use cases from simple terminal access to complex enterprise workflows. This comparison examines SSH clients across multiple dimensions: basic information and licensing, platform compatibility, protocol support and technical capabilities, user features, and cryptographic algorithm support.
General
This section provides fundamental information about each SSH client, including developer, initial release date, supported platforms, current version, licensing model, and interface type. Understanding these basics helps users identify which clients are actively maintained, compatible with their operating systems, and align with their licensing requirements (open-source versus proprietary).
The SSH client landscape spans from foundational open-source projects like OpenSSH (1999) and PuTTY (1999) to commercial offerings such as SecureCRT (1998) and ZOC Terminal (1995). OpenSSH dominates as the de facto standard, included by default in most Unix-like operating systems and recent Windows versions. Cross-platform support varies significantly: command-line tools like OpenSSH and Dropbear support the widest range of platforms, while graphical clients tend toward platform-specific implementations. The licensing divide is clear, with major open-source clients using BSD (OpenSSH, PuTTY) or MIT (Dropbear, WinSCP) licenses, while commercial clients like SecureCRT and AbsoluteTelnet remain proprietary. Both GUI and CLI interfaces are well-represented, with some clients like PuTTY and ZOC Terminal offering both, while others specialize in one interface type.
Platform
Platform compatibility determines where SSH clients can be deployed and used. This section examines operating system support across desktop, server, mobile, and embedded platforms. The data reveals patterns in cross-platform development strategies and highlights platform-specific solutions versus universal clients.
↑Included and enabled by default since windows 10 version 1803. Win32-OpenSSH can be installed as an optional component in the Windows versions before Windows 10 version 1803 to Windows 10 version 1709. Portable version can be download from Win32-OpenSSH for other versions.
↑The majority of Linux distributions have OpenSSH as an official package, but a few do not.
Platform support analysis reveals distinct strategies among SSH client developers. OpenSSH demonstrates the broadest compatibility, running on virtually every major operating system including macOS, Windows, Linux, BSD, Solaris, OpenVMS, z/OS, AIX, HP-UX, iOS, and Android, reflecting its role as the industry standard. Dropbear similarly supports wide platform coverage, optimized for embedded and resource-constrained environments. In contrast, Windows-only clients like AbsoluteTelnet, Bitvise SSH Client, Tera Term, and WinSCP serve the large Windows user base with platform-specific features. macOS-focused clients like certain configurations of SecureCRT and ZOC Terminal cater to Apple ecosystem users. Mobile platform support remains limited, with ConnectBot dominating Android and only SecureCRT and WinSCP (jailbroken only) supporting iOS. The inclusion status (where OpenSSH comes pre-installed) on macOS, modern Windows, BSD, and most Linux distributions underscores its ubiquity and reduces the need for alternative clients on these platforms.
Technical
This section examines the technical capabilities and protocol support of SSH clients. Key areas include SSH protocol versions (SSH1 vs SSH2), additional protocols like TELNET and rlogin, tunneling capabilities (port forwarding, SOCKS proxy, VPN), advanced features like session multiplexing and Kerberos authentication, and file transfer protocol support (SFTP/SCP). These technical capabilities determine the versatility and security posture of each client.
Protocol support reveals significant evolution in SSH client security. Modern clients universally support SSH2, while SSH1 support (now recognized as insecure) has been largely deprecated—OpenSSH removed SSH1 support entirely in version 7.6 (2017), and several newer clients like Bitvise SSH Client, Dropbear, and wolfSSH never implemented it. Port forwarding and SOCKS proxy capabilities are nearly universal among full-featured clients, enabling secure tunneling for various applications. VPN tunneling via TUN/TAP is less common, supported primarily by OpenSSH, Bitvise SSH Client, and WinSCP (limited). Session multiplexing, which allows multiple SSH sessions over a single connection, is supported by advanced clients like OpenSSH, Bitvise SSH Client, lsh, PuTTY, SecureCRT, and TN3270 Plus, offering performance benefits for users managing multiple concurrent sessions. Kerberos integration, important for enterprise environments, is widely supported across both open-source and commercial clients. SFTP/SCP support for file transfers is nearly universal, though implementation quality varies—some clients offer only basic functionality while others provide full-featured file management interfaces. Proxy client capabilities (connecting through intermediate proxies) are comprehensive in clients like PuTTY, SecureCRT, and WinSCP, supporting SOCKS 4/5, HTTP, Telnet, and custom proxy types.
Features
Beyond core protocol support, SSH clients differ significantly in user-facing features that affect usability, productivity, and workflow integration. This section compares features such as keyboard mapping, session tabs, file transfer protocols, text search, mouse support, Unicode handling, scripting capabilities, and security features like public key authentication, smart card support, and FIPS 140-2 validation. These features distinguish basic terminal clients from comprehensive remote access solutions.
↑OpenSSH supports the minimal certificate format since v5.4. "OpenSSH Release Notes: 5.4". OpenBSD Project. 2010-03-08. Retrieved 2021-08-30.
↑PuTTY does not support tabs directly, but many wrappers are available that do.
↑PuTTY does not support hyperlinks, but some forks of PuTTY do.
↑Putty v71.0 does not support OpenSSH certificates. See Ben Harris' 2016-04-21 wish.[14][15]
↑ZOC supports FIDO/sk keys with Version 9, see Version history and FIDO2 Instructions.[16][17]
↑ZOC supports OpenSSSH style CA Keys, see ZOC feature list (SSH features).[18]
Feature comparison reveals the divide between basic terminal clients and comprehensive remote access solutions. Session tabs and advanced UI features are primarily found in commercial clients like SecureCRT, SmartFTP, Tera Term, TN3270 Plus, and ZOC Terminal, while command-line tools like OpenSSH rely on external terminal emulators for such functionality. ZMODEM file transfer support, once popular for serial communications, remains available in several clients (AbsoluteTelnet, SecureCRT, Tera Term, ZOC Terminal) but has largely been superseded by SFTP/SCP. Unicode support is now standard across modern clients, essential for international character sets and proper terminal display. Public key authentication is universally supported, representing the security standard for SSH connections. Smart card support and hardware encryption capabilities are concentrated in commercial and specialized clients (AbsoluteTelnet, SecureCRT, SmartFTP, ZOC Terminal), targeting enterprise and high-security environments. FIPS 140-2 validation, required for certain government and regulated industry deployments, is available in AbsoluteTelnet, SecureCRT, SmartFTP, and select OpenSSH configurations. Scripting support varies widely: some clients offer no scripting (PuTTY, Dropbear), while others provide comprehensive automation through platform-native languages or proprietary scripting engines. The emergence of FIDO2/security key support (AbsoluteTelnet, OpenSSH, ZOC Terminal) represents the latest evolution in authentication technology, enabling hardware-backed cryptographic keys for enhanced security.
Authentication key algorithms
Cryptographic algorithm support determines both the security level and compatibility of SSH clients with various servers and security policies. This section examines support for authentication key algorithms including legacy DSA, widely-used RSA variants, ECDSA (Elliptic Curve Digital Signature Algorithm), modern EdDSA (Edwards-curve Digital Signature Algorithm), and hardware security keys. Algorithm support reflects both security best practices and backward compatibility requirements.
This table lists standard authentication key algorithms implemented by SSH clients. Some SSH implementations include both server and client implementations and support custom non-standard authentication algorithms not listed in this table.
↑By default, disabled at run-time since OpenSSH 7.0 released in 2015.
12PuTTY does not support security keys / FIDO tokens, but is supported in PuTTY-CAC
↑ZOC' SSH is based on OpenSSH and supports the same encryptions.
12ZOC supports FIDO/sk keys with Version 9, see Version history and FIDO2 Instructions.[16][17]
Authentication algorithm support demonstrates the ongoing evolution of SSH security standards. The deprecated ssh-dss algorithm, based on DSA and sensitive to weak random number generation, remains supported in several clients for backward compatibility but is disabled by default in security-conscious implementations like OpenSSH (since version 7.0, 2015). Traditional ssh-rsa enjoys universal support as the long-standing standard. Modern RSA variants using SHA-2 (rsa-sha2-256 and rsa-sha2-512) are widely adopted, offering improved security over the original SHA-1-based implementation. ECDSA algorithms across multiple curves (nistp256, nistp384, nistp521) provide strong security with smaller key sizes and are broadly supported. EdDSA algorithms, particularly ssh-ed25519, represent current best practice with superior performance and security characteristics—widely supported across modern clients, though ssh-ed448 support remains less common. Security key support (sk-ecdsa-sha2-nistp256 and sk-ssh-ed25519) for FIDO2/WebAuthn hardware tokens is emerging in leading clients (AbsoluteTelnet, OpenSSH, ZOC Terminal), enabling hardware-backed authentication resistant to key theft. The incomplete data for several clients (indicated by "?") suggests this comparison would benefit from community contributions to document full algorithm support across all implementations.
This page is based on this Wikipedia article Text is available under the CC BY-SA 4.0 license; additional terms may apply. Images, videos and audio are available under their respective licenses.
