# Tempest vs Termius, MobaXterm, PuTTY & iTerm2 A factual comparison of Tempest with Termius, MobaXterm, PuTTY, and iTerm2. Several of the classic SSH clients are platform-locked (PuTTY = Windows + Linux, iTerm2 = macOS, MobaXterm = Windows), which makes cross-platform support the first axis to compare on. ## At a glance (April 2026) | | Tempest | Termius | MobaXterm | PuTTY | iTerm2 | | ----------------------------------- | --------------------------------------------- | ----------------------------------- | --------------------------- | ------------------------ | ---------------------------- | | **Platforms** | macOS · Win · Linux · iOS · Android · **Web** | macOS · Win · Linux · iOS · Android | **Windows only** | Windows · Linux | **macOS only** | | **Native FIDO2 / YubiKey SSH** | ✅ | ✅ | ❌ | ❌ | Inherits from system OpenSSH | | **OpenSSH certificate auth** | ✅ | ✅ | ❌ | ❌ | Inherits from system OpenSSH | | **Post-quantum SSH (PQ KEX)** | ✅ default — ML-KEM + SNTRUP761 | ✅ | ❌ | ✅ | Inherits from system OpenSSH | | **Zero-trust platform presets**¹ | ✅ one-click wizard | ❌ | ❌ | ❌ | ❌ | | **Self-hostable sync server** | ✅ | ❌ | n/a | n/a | n/a | | **Browser-based access (Web Mode)** | ✅ | ❌ | ❌ | ❌ | ❌ | | **AI assistant** | ✅ — Claude / GPT / Gemini / self-hosted | ✅ — Termius AI Agent + Gloria | ❌ | ❌ | ❌ | | **E2EE sync** | ✅ zero-knowledge | ✅ zero-knowledge | ❌ (no built-in sync) | ❌ | ❌ | | **SFTP file manager** | ✅ | ✅ | ✅ | ❌ (separate PSCP) | ❌ | | **Mosh** | ✅ | ✅ | ❌ | ❌ | ❌ | | **Telnet · RCON · Serial** | ✅ | ⚠️ Telnet · serial | ⚠️ Telnet · serial | ⚠️ Telnet · serial · raw | ❌ | | **S3 / WebDAV / FTP browser** | ✅ | ❌ | ⚠️ FTP/SFTP only | ❌ | ❌ | | **Pro pricing** | $-affordable | $10/mo annual | $69/user/yr (was perpetual) | Free | Free | ¹ Built-in setup wizards for **Teleport, Cloudflare Access, AWS SSM Session Manager, GCP IAP TCP forwarding, and Tailscale**. See [SSH Client for Teleport, Cloudflare Access, AWS SSM, GCP IAP & Tailscale](/connect-to-servers/ssh-client-for-teleport-cloudflare-access-aws-ssm-gcp-iap-and-tailscale.md). ## When to pick each one ### Termius Cross-platform (macOS, Windows, Linux, iOS, Android), E2EE sync, AI assistant, native FIDO2, OpenSSH cert auth, claimed PQ KEX support. Differences from Tempest: * **Zero-trust platform integrations** — Tempest ships one-click wizards for Teleport, Cloudflare Access, AWS SSM, GCP IAP, Tailscale. Termius does not. * **Web Mode** — Tempest runs in a browser via a self-hosted server. Termius is desktop/mobile only. * **Self-hosted sync** — Tempest's sync server can run on your own infrastructure. Termius requires their cloud. * **PQ algorithm transparency** — Tempest documents specific algorithms (`mlkem768x25519`, `sntrup761x25519`). Termius states PQ support without naming algorithms in public docs. * **Pricing** — Termius Pro is $10/month annual; Tempest Pro is lower. * **Maturity** — Termius has a larger user base and longer-running mobile apps. ### MobaXterm Windows-only multi-protocol client (SSH, RDP, VNC, Telnet, FTP) with a bundled X server and Cygwin-style Unix toolset. Home Edition is free for single-user installs; Professional is $69/user/year subscription (changed from perpetual in 2024). Differences from Tempest: * **Platform** — MobaXterm is Windows-only. Tempest runs on macOS, Windows, Linux, iOS, Android, and the web. * **Modern auth** — MobaXterm's UI doesn't surface FIDO2, OpenSSH certs, or PQ KEX configuration; it inherits whatever its bundled OpenSSH supports. * **AI assistant** — MobaXterm has none. * **Zero-trust presets** — MobaXterm has none. * **E2EE sync** — MobaXterm has no built-in sync (settings live in `MobaXterm.ini`). * **X server** — MobaXterm bundles one. Tempest does not (use XQuartz / VcXsrv / WSLg). * **Bundled Unix toolset** — MobaXterm includes Cygwin tools. Tempest assumes the OS provides them. ### PuTTY MIT-licensed, free. Runs on Windows and Linux (no native macOS). Has post-quantum KEX (SNTRUP761 since v0.78, ML-KEM since v0.83). No native FIDO2 in mainline (PuTTY-CAC fork adds smart-card auth). Differences from Tempest: * **Platform** — PuTTY runs on Windows and Linux. Tempest also runs on macOS, mobile, and the web. * **Host inventory** — PuTTY's session list is flat with no grouping, tagging, or search. Tempest has a structured inventory with groups, tags, snippets. * **SFTP** — PuTTY ships PSCP / PSFTP as separate command-line tools. Tempest has an integrated SFTP file manager. * **Modern features** — Tempest has FIDO2, OpenSSH certs, AI, sync, monitoring, port-forward UI, jump-host UI. PuTTY mainline has none of these. * **Distribution** — PuTTY is a small single-purpose binary with no account or sync component. Tempest is a larger application that includes optional account-based sync. ### iTerm2 macOS-only terminal emulator. Not strictly an SSH client — relies on the system `/usr/bin/ssh` for the protocol, inheriting whatever that build supports (FIDO2 if installed via Homebrew OpenSSH, PQ KEX in newer versions). Differences from Tempest: * **Platform** — iTerm2 is macOS-only. * **Host inventory** — iTerm2 has none. Hosts are managed in `~/.ssh/config` directly. * **Built-in features** — iTerm2 doesn't include SFTP browsing, sync, AI, vault, monitoring, zero-trust presets. It's a terminal emulator that happens to launch shells. * **Terminal-emulator features** — iTerm2 includes shell integration, image rendering protocols, and tmux integration. Tempest's terminal does not implement these. ### SecureCRT VanDyke SecureCRT runs on Windows, macOS, and Linux. Per-seat pricing is roughly $110 plus $35/year maintenance. Includes scripting in VBScript, Python, and JavaScript, and supports terminal emulations such as TN3270, TN5250, Wyse, and SCO ANSI. Differences from Tempest: * **Pricing** — Tempest Pro is lower than SecureCRT's per-seat license + maintenance. * **Mobile, Web, AI, zero-trust presets, native FIDO2, PQ KEX, E2EE sync** — present in Tempest, not in SecureCRT. * **Scripting depth** — SecureCRT exposes VBScript / Python / JavaScript automation APIs. Tempest's snippets and scheduled runs cover ad-hoc fan-out but do not match SecureCRT's scripting surface. * **Terminal emulations** — SecureCRT supports legacy mainframe and minicomputer terminal types (TN3270, TN5250, Wyse) that Tempest does not implement. ## Migrating from another client Use Tempest's **Import Servers** feature. ## Download — free tier covers most use cases. Pro adds jump host chaining, port forwarding, monitoring, scheduled snippet runs, X11 / agent forwarding, custom proxies, and connection multiplexing. ## See also * [SSH Client for Teleport, Cloudflare Access, AWS SSM, GCP IAP & Tailscale](/connect-to-servers/ssh-client-for-teleport-cloudflare-access-aws-ssm-gcp-iap-and-tailscale.md) * [Post-Quantum SSH Algorithms](/authentication/post-quantum-ssh-algorithms.md) * [End-to-End Encryption](/account-and-privacy/end-to-end-encryption.md) --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://docs.gotempest.app/compare/tempest-vs-termius-mobaxterm-putty-iterm2.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.