$ jssh
Start free

SSH · RDP · VNC · behind any NAT

Every machine behind every router. One flat bill.

One line on the device, nothing on the router. Then $49 a month, whether you enroll ten machines or ten thousand.

Start the 14-day trial

1 14 days, up to 25 devices, 5 sessions at a time, no credit card.

NAT · CGNAT · FIREWALL ↑ OUTBOUND ONLY $ your laptop jssh relay TLS · 443 · cannot read SSH store-kiosk-12 RDP · nothing listens gateway-cust-42 SSH · nothing listens lobby-pi-3 VNC · nothing listens

The 60-second version

A machine behind a router, reachable from nothing

jssh-connect-20260801.mp4 · 60 s · captions on

  1. Install One line on the device. Nothing to paste, so it can go through a ticket.
  2. Approve It prints a code and a link. You approve the machine in your browser.
  3. Connect jssh ssh, or the ssh you already have. Same sshd, same keys.

The install

One line. Then it is reachable, forever.

curl -fsSL https://get.jssh.io | sh
iwr https://get.jssh.io/latest/install.ps1 -OutFile install.ps1powershell -ExecutionPolicy Bypass -File .\install.ps1

No token in the ticket

The device prints a code, you approve it in the browser. On Windows the installer registers a service, so a kiosk comes back on its own after a reboot with nobody logged in. For a fleet you inherited, one token pushed through your RMM enrolls all of it.

Listens on
nothing
Outbound
443/tcp one connection, held open
Agent
4 to 5 MB static, no runtime to install
Runs on
Win · macOS · Linux down to SysV, plus Termux
Updates
signed A/B automatic rollback, on by default
Per device
$0.00 at every fleet size, on every plan

Nobody learns a new CLI

After jssh login, a managed ssh_config block makes plain ssh work against every enrolled machine. scp, rsync, Ansible and VS Code Remote-SSH keep working with nothing rewritten.

How it works, step by step

The bill

Everyone else meters your devices

You are billed for how many sessions are open at the same time, never for how many machines you enrolled.

Everyone else meters per device

$300to$2,250

a month at 900 devices, on published list prices. It grows every time you enroll one.

jssh meters per session

$49or$199

a month at 900 devices, at 9,000, and at the first one you enroll. What we count is concurrent sessions.

3 Rounded from each vendor's published list price, retrieved June 2026 and archived. We cannot see what either agrees at 900 devices, so if you are under contract, compare against your own invoice. The exact figures, per vendor, with sources.

4 remote.it has a decade of GUI polish, a broader protocol catalog than ours, and a free tier for a handful of personal devices. SocketXP bundles OTA updates and device monitoring, and we do neither.

Who buys this

Built for the fleet you actually run

You manage other people's hardware

Sixty customers, nine hundred machines, and a bill that used to grow with every one you enrolled.

  • One organization per customer, isolated
  • An audit export per customer, not per fleet
  • Bulk enrollment with one token per customer
  • Machines name and tag themselves
  • Coexists with the tool you are replacing
  • No per-device line at any count
Everything an MSP asks

You ship the hardware

The agent goes in the firmware image, so every unit you ship is supportable the day it lands on a customer's network.

  • Baked into a Yocto or Buildroot image
  • Units enroll on first boot
  • A manufacturing token carries the batch tags
  • Signed A/B updates with rollback
  • No per-device cost against BOM margin
Everything an OEM asks

Somebody handed you a questionnaire

Least privilege that comes from the architecture rather than from a configuration somebody has to keep correct.

  • No network between devices, by architecture
  • Per-device, per-session authorization
  • Rules enforced by the agent on the device
  • Ed25519 device identity, OIDC for operators
  • SSO on every plan, no security tax
  • Answer the questionnaire with a filtered export
The security model

Before you move a fleet

The three questions that stop a rollout

Put it on the fleet you already have

The agent coexists with whatever is on the box today, so there is no cutover day to schedule.

Start the 14-day trial Talk to a person first