Port knocking for iPhone, iPad, Mac and Apple Watch
Knock. The door opens.
Secret Knock opens your server's hidden ports with a secret knock — a knockd sequence or an fwknop Single Packet Authorization — from your iPhone, your Mac or your wrist. Then it checks the port and hands you over to SSH.
iPhone and iPad with iOS 18 or later · Mac with macOS 15 or later · Apple Watch with watchOS 11 or later
How it works
-
Add your door
Enter a knockd sequence — TCP and UDP ports, delays, payloads — or an fwknop SPA key. Or import your knockd.conf or .fwknoprc.
-
Press and hold to knock
Each knock lands with a tap in your hand. On the Watch, from Control Center, with Siri or the Action button — wherever you are.
-
The door is ajar
Secret Knock checks that the port answers, counts down the open window on your Lock Screen, and opens your SSH app.
Everything a knock needs
Built for people who keep their servers closed — homelabs, VPSs, routers and office boxes.
-
Knock from anywhere
Apple Watch, Control Center, interactive widgets, Siri, Shortcuts and the Action button. On the Mac, from the menu bar.
-
knockd sequences
Any mix of TCP and UDP ports, per-knock delays and UDP payloads. Works with knockd and firewall rules that watch for sequences.
-
fwknop SPA
Single Packet Authorization with AES and HMAC, compatible with fwknopd. One encrypted, authenticated packet instead of a guessable sequence.
-
Port check and countdown
After the knock, Secret Knock checks the port and shows how long it stays open — in the app, on the Lock Screen and in the Dynamic Island.
-
Straight to SSH
Open Termius, Blink, Prompt or any ssh:// link the moment the door opens.
-
Knows where you knock from
Shows the public IP and IPv4 or IPv6 your knock comes from, and lets you pin the address family per server — the most common reason a knock fails.
-
Synced through your iCloud
Your servers follow you to every device. Knock sequences and keys live in iCloud Keychain, end-to-end encrypted.
-
At home on every screen
iPhone, iPad, Mac and Apple Watch, iPhone Duo folded or open, three themes and 33 languages.
Data Not Collected. Really.
A tool that guards your servers should not watch you. Secret Knock has no account, no analytics and no tracking.
Read the privacy policy →- No account and no sign-in — ever.
- No analytics or advertising SDKs inside the app.
- Your servers sync only through your own iCloud; knock sequences and keys stay in iCloud Keychain.
- The app talks to your servers, and to secretknock.app only to show the public IP you knock from — answered on the spot, never logged.
One door free. Every door, once.
Free
$0 forever
- 1 server
- Every feature, Apple Watch included
- iCloud sync across your devices
Unlimited
$4.99 one-time purchase
- Unlimited servers
- iPhone, iPad, Mac and Apple Watch with one purchase
- Family Sharing
US price. The App Store sets the price in your country. No subscription.
Questions
What is port knocking?
Port knocking keeps a service such as SSH hidden behind a closed firewall. The firewall opens it only for an address that first sends a secret pattern of connection attempts — the knock. knockd watches for a sequence of ports; fwknop accepts one encrypted Single Packet Authorization packet.
Which servers does Secret Knock work with?
Any server running knockd or fwknopd, and firewalls that open a port after a sequence of TCP or UDP connection attempts — for example on a Linux VPS, a home server, a NAS or a router.
Is port knocking secure?
A classic knock sequence travels in the clear, so treat it as one extra layer in front of strong SSH keys, not as a replacement. fwknop SPA is stronger: each packet is encrypted, authenticated with HMAC and cannot be replayed.
Does it work on Apple Watch?
Yes. Apple Watch apps cannot send raw network packets themselves, so the Watch knocks through your iPhone. Away from the iPhone, the Watch can send fwknop SPA over HTTP if your server enables it.
Why did my knock not open the port?
Most often the knock left over IPv6 while SSH connects over IPv4, or the other way round, or the server saw a different public IP. Secret Knock shows the address you knock from and lets you pin IPv4 or IPv6 per server. The port knocking guide covers the other causes.
Does Secret Knock collect any data?
No. There is no account, no analytics and no tracking. Your servers and keys stay on your devices and in your own iCloud.
How much does it cost?
One server is free with every feature. Unlimited servers are a one-time purchase that covers iPhone, iPad, Mac and Apple Watch and works with Family Sharing.
Keep the door shut. Carry the knock.
Secret Knock is coming to the App Store for iPhone, iPad, Mac and Apple Watch.
Coming soon to the App Store