Documentation — jump443

SSH config

Add this to ~/.ssh/config for the best experience:

Host jump443
    HostName ssh.jump443.net
    Port 443
    User jump443
    IdentityFile ~/.ssh/id_ed25519
    ControlMaster auto
    ControlPath ~/.ssh/cm-%r@%h:%p
    ControlPersist 60s
    ServerAliveInterval 30
    ServerAliveCountMax 3

Now you can use jump443 as a short name everywhere:

ssh -J jump443 user@your-server.com

Or make it permanent for a specific host:

Host myserver
    HostName your-server.com
    User kristian
    ProxyJump jump443

ssh myserver
# tunnels through jump443 automatically

ControlMaster

The ControlMaster / ControlPersist lines in the config above are important. Without them, every SSH invocation opens a new TCP connection and authenticates from scratch — each one costs a trial connection.

With ControlMaster, the first connection authenticates and all subsequent connections reuse that session for 60 seconds after the last one closes. One auth, many operations.

This means you can run management commands and ProxyJump connections back to back without burning extra trial credits:

ssh -J jump443 user@myserver    # auth happens here (1 trial credit)
ssh jump443 status              # reuses the session (free)
ssh -J jump443 user@myserver    # still reusing (free)

Command reference

All commands are run as:

ssh jump443 <command> [args]

(Assumes the SSH config above. Otherwise: ssh -p 443 jump443@ssh.jump443.net <command>)

Account

Command	Description
`status`	Show account info, plan, trial balance, hosts, and keys
`upgrade`	Show pricing and payment options

Destination hosts

Command	Description
`list-hosts`	List your whitelisted destination hosts
`add-host <host>`	Add a destination (hostname or IP, max 2)
`delete-host <host>`	Remove a destination

Hosts are hostnames or IP addresses — no port. Port is controlled on your SSH client side. jump443 allows all ports to your whitelisted hosts.

Replacing a host after your initial 2 slots are used triggers a 7-day cooldown to prevent abuse.

SSH keys

Command	Description
`list-keys`	List registered public keys with fingerprints
`add-key`	Read a public key from stdin and register it
`delete-key <fp>`	Remove a key by fingerprint (can't delete last key)

ssh jump443 add-key < ~/.ssh/id_ed25519.pub
Key added: SHA256:abc123...

ssh jump443 delete-key SHA256:abc123
Key removed: SHA256:abc123...

Lost your SSH key?

If you no longer have the private key for your registered key, use the email-based reset flow. You'll need access to the email address on your account:

Command	Description
`reset-request <email>`	Send a reset token to your registered email address
`reset <token>`	Add a new public key using the token from the email

ssh -p 443 jump443-signup@ssh.jump443.net reset-request your@email.com
ssh -p 443 jump443-signup@ssh.jump443.net reset TOKEN < ~/.ssh/new_key.pub

Reset tokens expire after 24 hours and can only be used once. See Getting started for the full signup flow.

Troubleshooting

"administratively prohibited"

Your trial has expired or you're trying to reach a host that isn't in your whitelist. Run ssh jump443 status to check your account and ssh jump443 list-hosts to verify your hosts.

"Permission denied (publickey)"

Your SSH key isn't registered with jump443. Make sure you're using the same key you registered with. Check with ssh jump443 list-keys and compare fingerprints against ssh-keygen -lf ~/.ssh/id_ed25519.pub.

"Connection refused" on port 443

The SSH service lives on ssh.jump443.net, not jump443.net. Make sure your config points to ssh.jump443.net port 443.

Connection works once, then trial runs out fast

You're probably not using ControlMaster. Every SSH invocation opens a new connection and burns a trial credit. See the ControlMaster section above.

Verbose debugging

ssh -vvv -J jump443 user@your-server.com 2>&1 | head -60

This prints the full SSH negotiation. Look for which key is offered, whether the tunnel opens, and where it fails.