SSH

SSH encrypts everything between your terminal and the remote machine, which listens on port 22 by default. Passwords work, but key pairs are the norm: the private key stays on your computer and the public key sits on the server, so no secret crosses the network. The first connection records the server's fingerprint, so a machine that later pretends to be that server triggers a warning.

Beyond a remote shell, SSH copies files (scp and SFTP), carries Git pushes to services such as GitHub, and forwards ports, so a database that only listens locally on a server can be reached through the encrypted tunnel. OpenSSH is the standard implementation and comes with Linux, macOS and Windows. Servers open to the internet should switch off password logins and accept keys only.