jssh vs SocketXP
SocketXP alternative: remote access without data caps or device fees
When to choose SocketXP: SocketXP bundles basic OTA updates and device monitoring into the same subscription, and jssh does neither. If you want one budget package that covers remote access, updates and monitoring, your fleet is small, and your sessions are light enough that the data caps do not bite, they cover more ground than we do.
A data cap on a remote access product
SocketXP’s plans cap data transfer per device: 100 MB (Free, Lite, Core, Basic) or 500 MB (Pro, Standard, Premium). Eco is the one plan we cannot quote, because their own page disagrees with itself about it: the Eco plan card says 300 MB per device and the comparison table further down the same page says 500 MB.
Source: socketxp.com/pricing, retrieved June 2026 (archived).
Think about when you actually open a shell on a field device: something is wrong. You pull logs, fetch a core dump, push a config, maybe copy a firmware image while you are in there. That is the moment a cap measured in hundreds of megabytes is the wrong constraint, and it arrives on whichever day of the billing cycle the failure happens to pick.
jssh has no per-device data caps. Anti-abuse limits exist at the organization level, as they do everywhere, and the one that bounds relay bandwidth is a ceiling on how often TURN credentials can be minted per minute. There is no byte budget to exhaust mid-incident.
The double meter
As of June 2026:
| Plan (Enterprise) | Base price | Devices included | Extra device | Data per device |
|---|---|---|---|---|
| Core | $99/mo | 100 | $0.30 | 100 MB |
| Basic | $299/mo | 100 | $0.30 | 100 MB |
| Standard | $499/mo | 100 | $0.50 | 500 MB |
| Premium | $799/mo | 100 | $0.50 | 500 MB |
A 500-device fleet on Premium is $799 plus 400 × $0.50, so $999 a month at list, still capped at 500 MB per device, and that is the only Enterprise tier with RBAC and mTLS. Granular access control for a team reaching remote devices is a baseline requirement. In jssh, single sign-on, per-service access rules and per-session audit are on every plan, and the device count is not a billing meter at all. If you are already under contract with SocketXP, compare against your invoice rather than against this table.
The agent and the hardware
Both agents install with a command and connect outbound, with no open ports. The differences that matter at fleet scale:
- Footprint: a static Rust binary, about 4 MB on ARM and about 5 MB on x86_64, with no runtime dependencies. The Linux builds link musl statically, so it drops into any rootfs. Builds for x86_64, aarch64 and ARMv7 Linux (OpenWrt routers and industrial gateways included), macOS, Windows and Android under Termux.
- Minimal attack surface: the agent proxies bytes to the local ports you declare
(
localhost:22for SSH) and never executes remote commands pushed from the cloud, so the device’s ownsshdstays an independent authentication layer. - Blind relay: SSH stays end-to-end encrypted between your client and the device’s
sshd, and the relay moves opaque bytes it has no key for.
Migrating
The agents coexist on the same box, so no cutover day is required:
- Enroll one device by hand with
curl -fsSL https://get.jssh.io | sh, which prints a code you approve in the browser. - For the rest, mint a bulk enrollment token and push
curl -fsSL https://get.jssh.io | JSSH_ENROLL_TOKEN=<token> shthrough your existing configuration management or OTA channel. Any paid plan takes an unlimited fleet, so enroll broadly and run both side by side. - Wire your identity provider over OIDC and map who can reach which devices.
- Move operators to
jssh ssh <device>and let the SocketXP subscription lapse at renewal.
Last reviewed .