Record every SSH session on your Linux servers, encrypted end to end, in under two minutes.
shellz records every terminal session on your servers, including SSH logins, remote commands and file transfers. Encrypted on your server before it leaves. Watch live or replay later in the browser.
One command. Two minutes. Your token is generated in the browser after sign-up.
curl -fsSL https://get.shellz.dev | sudo sh -s -- szt_…started 21:04:00 from 203.0.113.24 on /dev/pts/0
Session recording you can set up before your coffee cools
Built for small teams running their own servers, teams going through audits, and anyone who has asked who ran that command on prod.
Up and running in two minutes
Sign up with Google, GitHub or a passkey, paste one command on your server, then SSH in and watch yourself live. No agents to configure, no keys to manage, nothing to host.
Every session, captured
Interactive SSH, remote commands, SFTP transfers and console logins. Passwords typed at hidden prompts like sudo and passwd are never captured.
Encrypted before it leaves the server
Each session gets its own key and is encrypted on your server. shellz stores ciphertext only, and every recording is decrypted in your browser.
Only your team can read it
With Perfect Secrecy, decryption keys are tied to your team's passkeys. Admins approve new teammates; people who leave lose access to anything recorded after.
Can't be disabled quietly
Users can't bypass or stop recording. Root changes are reverted and reported, a silent server raises an alert within a minute, and uploaded recordings can't be changed.
Live, not just after the fact
Watch sessions as they happen with about a second of latency, then replay at any speed, search transcripts and export to .cast or .txt.
How it works
Your server encrypts, shellz stores ciphertext, your browser decrypts.
- 1install
Paste one command
The server downloads the signed shellz binary, checks it and connects to your team.
- 2record
Every login is recorded
When anyone logs in, shellz records the session and encrypts it right there on the server.
- 3upload
Ciphertext streams out
Encrypted, signed pieces of the recording upload every second. Storage holds ciphertext only.
- 4watch
Decrypted on your device
Open the session in your browser. It's verified and decrypted locally, live or as a replay.
Security model
Tamper-evident by design, with the strictest option keeping shellz itself out of your recordings.
Encryption
- Each session gets its own key, wrapped with X25519 and encrypted with AES-256-GCM on your server.
- Every recording segment is signed by the server's own identity key and chained to the previous one, so missing or modified pieces are detected.
- Recordings are stored write-once with a retention lock and decrypted only in your browser.
Tamper resistance
- The recorder refuses manual stops, and configuration changes made with root are reverted within seconds and reported.
- A silent server raises an alert within a minute. Alerts go to email, Slack or a webhook.
- Removing shellz needs approval in the dashboard. Binaries and updates are signed, with automatic rollback.
Perfect Secrecy optional
- Only your team can decrypt. The organization key is held by your team members' passkeys, and shellz never has it.
- An admin approves each new member, whose browser then gets access. Removing a member rotates the key.
- A printable recovery kit protects you against losing every passkey.
Every recording view needs a fresh sign-in and is written to an audit log. Read the technical security overview.
What teams use it for
Compliance evidence
Auditors ask for privileged-access session logs. shellz gives you tamper-evident, encrypted session records with an audit trail of who watched what. It helps you meet SOC 2, ISO 27001, HIPAA and PCI requirements.
14/14 segments signed and chained
Incident investigation
"Who ran that command on prod?" Search every session by user, source IP or command, jump to the moment in the transcript and replay it.
$ grep sessions… systemctl stop
Contractor accountability
Give clients proof of exactly what was done on their servers, with a verifiable history per server they can replay themselves.
contractor-jl · SSH · exit 0
Frequently asked questions
Does it record passwords?
No. Input typed while the terminal hides it, such as sudo, passwd and read -s prompts, is never recorded. The player shows a "hidden input · not recorded" marker instead.
Can my users turn it off?
No, and attempts are reported. The recorder refuses manual stops, root changes are reverted within seconds, and removing shellz needs approval in the dashboard. Someone with full root access can always interfere with software on their own machine; shellz makes sure you hear about it.
Can shellz read my recordings?
Not with Perfect Secrecy. Then the decryption key is held only by your team's passkeys and shellz never has it. In standard mode, recordings are still encrypted on your server and decrypted in your browser, but shellz can release a session key to a signed-in member of your team.
What does it run on?
Ubuntu, Debian and other systemd-based Linux distributions, on amd64 and arm64.
What happens if the network goes down?
Sessions are buffered on the server and uploaded later. Your recording policy decides whether new logins are allowed in the meantime.
One command. Two minutes.
Sign up, paste the command on your server, then SSH in and watch yourself live.