Pricing

Machines per account

Accounts are free. A free account takes up to 3 machines running st. When you want more machines on one account, switch to Pro. Back on free, the three added first stay.

A machine over the limit: still reachable on st's temporary link. What goes is the fixed link and the notifications.

• Sessions, windows, notifications, documents: not counted. Only machines per account running st are.
• No charge for traffic.
• Pro includes a relay server run by sophonz. Through it, the machine keeps one address of three words, such as quiet-otter-lamp.relay.sophonz.io. From st 0.4.1 the machine fetches the relay address and token itself; there is nothing to type.

Security

Same on both: the share token in front of the shell, signing out a device, end-to-end encrypted notification bodies. Terminal content is not end-to-end encrypted.

How it is reached

FreeCloudflare quick tunnel, meant for testing and development, with no uptime guarantee

ProA relay run by sophonz

Address

FreeA new trycloudflare.com address each run. Anyone who knows it reaches the machine's proxy

ProFixed at a three-word address, such as quiet-otter-lamp.relay.sophonz.io. Only a machine holding the token sophonz issued for it serves that address

Who sees terminal content in plaintext

FreeCloudflare's edge

ProThe sophonz relay

In front of the shell

st's share token

Same on both

• A machine joins an account only after its owner approves a code in a browser.
• No port waits for connections from outside. The connection goes out from the machine.
• The share token becomes a cookie the first time the link is opened, and leaves the address.
• The dashboard and the Android app (0.1.100 and later) list the devices signed in to the account and sign any of them out. A device signed out leaves the list at once, and a token already issued to it expires within 5 minutes.
• Notification bodies are end-to-end encrypted to the receiving device's key. Terminal content is not end-to-end encrypted.
• The control plane caps request bodies at 64 KB and takes at most 50 machines on one account.
• When you run st yourself, Cloudflare Access can stand in front of it. Locking it down

* Limits of a Cloudflare quick tunnel (Free)

On Free, the way in is a Cloudflare quick tunnel. Cloudflare's documentation puts its limits like this.

• Quick Tunnels are for testing and development.
  For production, the documentation points to a standard tunnel.
• Anyone with the URL can access your local service.
  st asks for its share token in front of the shell.
• The URL stops working when you stop the cloudflared process.
  st restart and st upgrade hand the address over and keep it.
• Each Quick Tunnel supports up to 200 in-flight requests. Additional requests return a 429 response.
• Quick Tunnels do not support Server-Sent Events (SSE).
  From st 0.3.67, agent state, chat and metrics still arrive live over it.
• Quick Tunnels have no uptime guarantee.
• The hostname changes each time you create a Quick Tunnel.
  sophonz keeps the new address, so the fixed link /m/<slug> opens it. A tab already open on the old address has to be opened again from the link.

Source: Cloudflare documentation, Quick Tunnels. The documentation gives no limit on bandwidth, request size or timeouts, so neither does this page.