Turn on SSH on the Pi, find its address on your Wi-Fi, then open any SSH app on the phone and connect to username@raspberrypi.local with the user name and password you chose when you set the Pi up. That works the same from an iPhone or an Android phone, as long as the phone is on the same network.

Two things trip people up. Raspberry Pi OS ships with the SSH server disabled, and since April 2022 there is no default pi user with the password raspberry. Reaching the Pi from outside your home is a separate step, covered in section 6.

1. Turn on SSH

New install, with Raspberry Pi Imager. This is the route Raspberry Pi recommends. After you pick the device, OS and storage, Imager walks through customisation: Hostname, Localisation, User, Wi-Fi and Remote Access. Set a hostname, create your user, enter your Wi-Fi details, and under Remote Access turn on Enable SSH, then choose Use password authentication or Use public key authentication. The Pi boots onto your network with SSH running and never needs a monitor.

Pi already running, with a screen. From the Preferences menu open Control Centre, go to the Interfaces tab, set SSH to Enabled and click OK. Control Centre arrived with the Trixie release in October 2025; earlier releases have the Raspberry Pi Configuration app instead.

From a terminal on the Pi. Run sudo raspi-config, open the interface options menu (the documentation calls it Interfacing Options), choose SSH, then Yes, Ok and Finish. Or create the flag file and reboot:

sudo touch /boot/firmware/ssh
sudo reboot

Headless, without Imager. Put the SD card in another computer, open its bootfs partition and create two files: an empty file named ssh, and userconf.txt containing one line, username:encrypted-password. Generate the encrypted password with openssl passwd -6. Raspberry Pi's docs warn that the openssl on macOS is LibreSSL, which does not support -6; install OpenSSL with Homebrew first. These two files cover SSH and the user only, so use Ethernet, or use Imager if you need Wi-Fi set up in advance.

2. Know your user name

Until April 2022 every Raspberry Pi OS image had a user called pi with the password raspberry. Raspberry Pi removed it, citing laws against default credentials on internet-connected devices. Your user is now whatever you entered in Imager, in userconf.txt, or in the first-boot wizard. Old tutorials that say ssh pi@raspberrypi only work if you created a user called pi yourself.

3. Find the Pi's address

Raspberry Pi OS announces itself over mDNS, so on the same network you can usually use the hostname with .local on the end. The default hostname is raspberrypi, giving raspberrypi.local; if you set a hostname in Imager, use that one. Not every device supports mDNS. If the name does not resolve from your phone, use the IP address:

  • On the Pi, hostname -I prints it.
  • Your router's admin page lists connected devices.

4. Connect from the phone

Any SSH app works; our roundup of phone terminal apps covers Termius, Blink Shell and others. Add a host with:

  • Host: raspberrypi.local or the IP address
  • Port: 22
  • User name and password: the ones you created

The first connection shows a security warning about the Pi's host key; accept it once. On an iPhone, iOS also asks whether the app may find and connect to devices on your local network. Allow it, since that is exactly what you are doing; the switch lives in Settings › Privacy & Security › Local Network.

A timeout usually means the wrong address, or a phone that is on mobile data instead of your Wi-Fi. For other errors see Fix SSH from your phone.

5. Switch from a password to a key

A password is fine for the first login. A key is better: nothing to guess and nothing to type on a phone keyboard. Generate the key in your SSH app so the private half stays on the phone, copy the public key it shows, and add it on the Pi:

mkdir -p ~/.ssh && chmod 700 ~/.ssh
echo 'ssh-ed25519 AAAA… my-phone' >> ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys

Replace the quoted text with your public key, on one line. If you are flashing a fresh card, Imager's Use public key authentication option takes the same public key and saves you this step.

Once key login works from the phone, you can turn passwords off. Open /etc/ssh/sshd_config with sudo nano, set PasswordAuthentication no and KbdInteractiveAuthentication no, then:

sudo sshd -t && sudo systemctl restart ssh
sudo sshd -T | grep -i passwordauthentication

The first line checks the file before restarting; the second prints the setting sshd is really using, which should be no. Keep your current session open and test a new connection before you close it. If you lock yourself out, you will need a keyboard and monitor on the Pi to get back in.

6. Reach the Pi from outside your network

raspberrypi.local and addresses like 192.168.1.42 only exist inside your home network. The classic fix, forwarding port 22 on your router, puts the Pi's login in front of every scanner on the internet; SSH without port forwarding compares the better options.

The one we recommend is Tailscale, which puts the Pi and the phone on a private network with nothing exposed. On the Pi:

curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up
tailscale ip -4

tailscale up prints a sign-in link, and the last command prints the Pi's Tailscale address. Install the Tailscale app on the phone, sign in to the same account, and point your SSH app at that address. The Tailscale SSH guide has the full walkthrough, and it applies to a Pi unchanged. One tip for a Pi you rarely touch: Tailscale keys expire after 180 days by default and the device drops off until you sign in again, so open the Machines page of the admin console and choose Disable Key Expiry from the Pi's menu.

Raspberry Pi's own Connect service is another route. It gives you a remote shell at connect.raspberrypi.com on Raspberry Pi OS Bookworm or later, but it runs in a web browser, not in your SSH app.

7. Keep work running when the phone drops

Phones drop SSH connections all the time: you switch apps, lock the screen, walk out of Wi-Fi range. Run anything long inside a terminal multiplexer so it survives:

sudo apt install tmux
tmux new -s main

Detach with Ctrl-b then d, or just lose the connection; tmux attach -t main picks up where you left off. Herdr does the same job and knows which panes are coding agents; see Herdr vs tmux. A Pi is a Linux computer, so Melta, our phone app for agents running in Herdr (coming soon), works with it like any other Linux machine.

Common questions

How do I SSH into a Raspberry Pi from an iPhone? Enable SSH on the Pi, install an SSH app, and connect to username@raspberrypi.local on the same Wi-Fi. Allow the Local Network permission when iOS asks.

How do I SSH into a Raspberry Pi from Android? The same way: any Android SSH app, the Pi's hostname or IP address, port 22 and your user name. If the .local name does not resolve, use the IP address.

What is the default SSH user name and password? There is none on current Raspberry Pi OS. You log in as the user you created in Imager or at first boot.

Is SSH enabled by default on a Raspberry Pi? No. Turn it on in Imager, Control Centre or raspi-config, or with an ssh file on the boot partition.

Can I SSH into my Pi from outside my network? Yes. Install Tailscale on the Pi and the phone and connect to the Pi's Tailscale address. Avoid forwarding port 22 on your router.

Sources