How to SSH into an AWS EC2 instance from a browser
The standard AWS docs tell you to download PuTTY, convert your .pem file to .ppk, set up a session, and then connect. That works fine on a Windows desktop you control. It gets annoying fast when you are on a borrowed machine, a Chromebook, or anything that isn't your usual setup.
Here is how to do it from a browser instead.
What you need before you start
You need three things: your EC2 instance's public IP address or DNS name, your .pem private key file that you downloaded when you launched the instance, and a browser-based SSH client. This guide uses SSHDock, which runs entirely in the browser tab with no install.
If you lost the .pem file, there is no recovery path. You will need to stop the instance, detach the root volume, attach it to another instance, add a new key pair, and reattach. Save your keys somewhere safe.
Step 1: Open SSHDock in your browser
Go to sshdock.com/app. The connection form loads directly. No account required.
Step 2: Enter your connection details
In the hostname field, enter your instance's public IPv4 address. You find this in the EC2 console under "Instances" after clicking your instance name.
The default username depends on the AMI you used:
- Amazon Linux:
ec2-user - Ubuntu:
ubuntu - Debian:
admin - RHEL/CentOS:
ec2-userorroot
Set the port to 22 unless you changed it.
Step 3: Add your private key
Click "Add Key" and paste the contents of your .pem file. The key starts with -----BEGIN RSA PRIVATE KEY----- or -----BEGIN OPENSSH PRIVATE KEY----- depending on how you generated it.
SSHDock keeps the key in your browser's local storage. It never leaves your machine.
Step 4: Connect
Click Connect. If the security group on your EC2 instance allows inbound TCP on port 22 from your IP address, you will get a terminal prompt within a few seconds.
If the connection times out, the most common cause is the security group. Go to EC2 console, select your instance, click "Security", click the security group name, and check the inbound rules. You need a rule allowing TCP port 22 from your current IP.
Using jump hosts with SSHDock
If your EC2 instance is in a private subnet behind a bastion host, SSHDock supports jump hosts. In the connection form, expand the "Jump Host" section and enter the bastion's public IP and credentials. SSHDock tunnels through the bastion automatically.
This is the same thing ssh -J does on the command line. See our bastion host guide for more detail on setting up the architecture.
Is this secure?
Your private key stays in your browser's localStorage. It doesn't go to any server. The SSH connection goes directly from your browser to your EC2 instance. That said, if you are on a shared or public machine, clear your browser data when you are done, or use the "Remove Key" option in SSHDock before you close the tab.
For production servers, also consider whether port 22 should be open to the internet at all. Restricting it to specific IP ranges in the security group significantly reduces exposure to automated scans and brute-force attempts.