Install latch, register your machines, and reach them through any NAT with the free relay.
latch is a terminal multiplexer with a built-in SSH server and web access. The relay is a free service that gives any machine running latch a stable SSH address you can reach through any NAT.
Install latch on each machine you want to reach:
curl -sSf https://unixshells.com/install.sh | sh
Then create a free account, either from the web or from the CLI (see below). An account is only needed for the relay. latch works locally and over your own network without one.
The relay lets you SSH to any machine behind NAT: a home server, a laptop, a box behind CGNAT. It is a dumb pipe. All traffic is end-to-end encrypted SSH ciphertext, so we structurally cannot read it. There are 9 network exchange points across 3 continents.
# First device, creates the account latch relay register # Additional devices on the same account latch relay add
This generates a relay key at ~/.latch/relay.key and writes the relay config. The device appears in your account's device list. You can register up to 10 devices per account.
latch relay enable latch relay status
Once a device is on the relay, reach it from any SSH client:
ssh -J relay.unixshells.com [email protected]
Or generate an SSH config block so you can use short names:
latch relay ssh-config >> ~/.ssh/config
That writes entries like:
Host *.alice.unixshells.com ProxyJump relay.unixshells.com User default
Then just ssh mydevice.alice.unixshells.com. This also works with VS Code Remote SSH and anything else that uses your SSH config.
The web terminal at unixshells.com/terminal gives you a terminal to your relay devices in any browser. It feels like a local terminal: keystrokes echo instantly, even over high-latency connections.
The web terminal uses Mosh over WebTransport (HTTP/3) by default. Mosh predicts your input locally and reconciles with the server, so typing feels immediate regardless of latency. Your session survives Wi-Fi switches, laptop sleeps, and network interruptions without dropping a character.
Mosh requires WebTransport, supported in Chrome, Edge, Firefox, and other Chromium-based browsers. Safari does not support WebTransport yet, so the web terminal falls back to SSH automatically there.
Your password never leaves the browser (OPAQUE zero-knowledge authentication). Your SSH key is encrypted client-side.
The mobile app is an SSH, Mosh, and SFTP client for iOS and Android. It auto-discovers all your relay devices.
Get it from the app page. The app is MIT licensed and open source.
Each device you register gets its own relay key. Manage devices from the web terminal (Devices tab), the mobile app, or the CLI.
# Add another device latch relay add # See your devices and their status latch relay status
Relay authentication uses the key at ~/.latch/relay.key. Standard SSH with Ed25519. Remove a device from the web terminal or mobile app to revoke its access.
latch is the terminal multiplexer running on your machines. It keeps sessions alive across disconnects. Think tmux, but with built-in SSH and web access.
Prefix key: Ctrl+] then:
c new windown / p next / previous window0-9 select window by numberx close windowd detachs admin panel# List sessions latch ls # New named session latch new work # Attach to a session latch attach work # Kill a session latch kill work
Sessions persist across disconnects, reboots, and network changes. Attach from SSH, the web terminal, or the mobile app.
Yes. The relay is free with any account, up to 10 devices. Need more? Get in touch.
Only for the relay. latch works locally and over your own network without an account. Sign up when you want to reach machines through NAT from the outside.
Yes. Generate your SSH config with latch relay ssh-config, then use VS Code's Remote SSH extension to connect by device name.
Yes. The relay forwards SSH ciphertext end to end. It never sees your plaintext or your keys. Standard SSH with Ed25519.
Linux and macOS. One static binary, no dependencies. The source is on GitHub.