stShare Terminal
HomeComparevs tmate
share terminal vs tmate

A tmate alternative that doesn't relay your keystrokes.

tmate ships your terminal bytes through ssh.tmate.io. share terminal ships them directly between host and viewer — peer-to-peer over an encrypted WebRTC DataChannel. Zero relay. No bytes touch our servers.

Open web terminalRead the protocol
$npx share-terminal start
verdict

If you're switching off tmate for security, compliance, or zero-trust reasons, share terminal is the architectural fix — not a different relay.

Featureshare terminaltmate
Transport✓WebRTC DataChannel (DTLS-SCTP)✗SSH reverse tunnel to tmate relay
Server sees keystrokes?✓No — bytes flow directly between peers✗Yes — every keystroke transits ssh.tmate.io
Authentication✓Google OAuth + identity-locked 6-digit pairing code✗SSH key auth + opaque session URL
Viewer install✓Zero — runs in any browser✗SSH client + matching SSH key
Host install✓140 KB npm packageNative binary + ncurses dependency
Compliance posture✓No data persistence — Redis holds only pairing codes (2 min TTL)✗Bytes traverse third-party infra — limits regulated environments
Read-only / multi-viewerSingle viewer per session by design (auditable trail)✓Read-only URLs + multiple SSH attendees
PricingFree CLI; affordable hosted signalingFree + paid tmate.io
migrate

Coming from tmate?

Most teams switch in an afternoon. SSH reverse tunneling habits map cleanly to share terminal — here's the translation.

  1. 01

    Stop the tmate session

    kill the tmate process or close the session URL — no more state to leak in chat.

  2. 02

    Install the share terminal CLI

    Run npx share-terminal start. The CLI signs you in with Google (device flow) and prints a 6-digit pairing code in your terminal.

  3. 03

    Have the viewer open shareterminal.cloud

    They sign in with the same Google account and type the code. No SSH client to install, no key to exchange.

  4. 04

    Confirm the WebRTC link is direct

    The CLI prints "datachannel open · direct · encrypted" when the peer-to-peer connection forms. From that point on the server is out of the path.

FAQ

Questions teams ask before they switch

Does tmate encrypt the session end-to-end?
tmate encrypts the SSH transport between you and the relay, and between the relay and the viewer. But the relay terminates both connections — at the relay your bytes are in clear. share terminal removes that hop entirely.
Why peer-to-peer over WebRTC instead of SSH?
WebRTC includes ICE for NAT traversal, DTLS-SCTP for transport-layer encryption, and runs natively in browsers. We get NAT-busting + e2ee + zero viewer install in one stack. SSH needs a relay or port forwarding to cross NATs.
Will share terminal work behind corporate NAT?
For 95% of NATs, plain STUN is enough. For symmetric NATs we fall back to a TURN relay, which only forwards encrypted DTLS packets — it can't inspect them. Configure your own TURN if compliance forbids ours.
Can I get a read-only viewer URL like tmate -r?
Not in v0.1. Pairing is one-host-one-viewer by design for an auditable trail. Multi-viewer + read-only modes are on the roadmap — request them via GitHub issues.
How fast is the connection compared to tmate?
Lower median latency, since WebRTC takes a direct route. tmate adds the round-trip to ssh.tmate.io regardless of where the viewer is sitting.
get started

One command. One encrypted tunnel.

No global install. No SaaS dashboard. No account to provision — sign in with Google, pair, share.

$npx share-terminal start
Open web terminalRead the docs
140 KB CLINode ≥ 20macOS, Linux