ssh(1) General Commands Manual ssh(1)

the default ssh server and client implementation on many unix systems nowadays is OpenSSH. OpenSSH is a well made program, unsurprising as it was made by the people over at OpenBSD, who tend to do good work. however, i'd like to provide an alternative. i think for most use cases, OpenSSH is actually overkill, and dropbear SSH is a much better option. yes, even for desktop-facing users, which is not where dropbear is usually deployed, i think this still stands.

i like to bring up lines of code when talking about software complexity, and people get mad. so i'd like to preface this with the fact that lines of code of course do not always tell the whole story. however, that doesn't mean one codebase being 10x the size of another doesn't count for anything; at a certain point, a certain scale of codebase size means a certain scale of complexity.

OpenSSH is about 140k lines of code. dropbear is about 50k. that's already quite a big difference. people might bring up that fact that if you include the bundles libtom* libraries, dropbear is about the same size. that's unfair, as if openssh bundled OpenSSL or LibreSSL which provides their libcrypto, it might be closer to 700k lines of code. (also, OpenSSL derivatives aren't always great)

from this we can already see quite a big difference in size, which also implies a difference in complexity. of course, this isn't dropbear doing some secret magic, they simply have less features and do less work to be portable. OpenSSH has portability paths to irix, aix, cygwin, as well as a whole directory of openbsd libc functions. they also have auth partitioned into multiple OSes, pam, bsdauth, shadow, and more, and the same for sandboxing, which they have multiple codepaths for. of course, the goal here is to make sure that openssh is portable to as many platforms as possible. however, dropbear is also portable to most of these OS's, without providing specific portability paths. by doing less, dropbear doesn't need to have all these redundant portability paths.

in terms of features, again dropbear does more by doing less. OpenSSH supports FIDO, SElinux, KRL, and more. maybe you don't even know what most of that is for, and likely if you don't, then you don't need it. it's the same argument made in support of using doas over sudo: sudo has many features that are useful for large systems where extensive privilege management is necessary. but for a single-user system where you just want to do something every so often with root privileges, you don't need sudo's massive codebase. it's the same for dropbear. if your SSH needs are running an SSH server, SSH'ing into other SSH servers, using ssh to commit stuff to git, and an rsync or scp here and there, dropbear will absolutely do the job, without all the added complexity of OpenSSH.

sometimes people bring up the issue of security, arguing that dropbear is less secure than openssh. well, if there's one thing OpenBSD taught me, it's that a smaller attack surface is harder to attack and easier to audit. this definitely applies to dropbear. it's also no stranger to deployment, being the default ssh server on openwrt, which is literally millions of devices worldwide. also, ssh is a pretty secure protocol by design, no matter the server/client being used. and, as i often have to remind people, if you are administrating a single-user device, ie, your laptop, you are not really going to be the target of privilege escalation exploits that require shell access (this applies to many of the security exploits i often see people raving about, the key is to not run untrusted scripts and things like that, you'll always be secure)

so, overall, while i don't recommend dropbear SSH to everyone, it's perfectly adequate as a simple SSH server and client for most of your SSH needs, and it's smaller and simpler than OpenSSH. if you haven't tried it, i highly recommend it. one thing people often get confused is that it doesn't install a ssh(1) binary, it's ssh binary is called dbclient(1). you can make a simple wrapper script called ssh, to emulate OpenSSH's ssh(1) in your PATH that does the same job:

#!/bin/sh
exec dbclient -i '$HOME/.ssh/id_ed25519' $@  #change id_ed25519 if your ssh privkey is under a different name

you can also convert your old openssh privkey to dropbear's format using the dropbearconvert(1) utility, so you don't have to switch your key everywhere you use it. there are pretty comprehensive manpages that document how to use each of the utilities dropbear provides.

dropbear is available on github at https://github.com/mkj/dropbear, and is also highly likely to be packaged by your operating system of choice.

July 21, 2026 shrub