ssh-tool

ssh-tool

Cross-platform SSH connection manager - terminal, port forwards, vault, all in one window.

Download for Windows Download for Linux v0.55.1 View other releases
UI theme
ssh-tool — Connections
🖥 db-prod-01 live
Host10.0.1.21 Userdeploy inherited from production Port22 inherited Credentialprod-key vault Jumpbastion1 → db-prod-01

Connection tree with inheritance

Hundreds of hosts in nested folders. Username, port, credential and jump chain cascade from the folder down — set them once, every host below picks them up. Live sessions glow green and bubble a count to the parent. Dynamic folders auto-populate from Proxmox, Hetzner and six more providers.

ssh-tool — Terminal
db-prod-01app bastion1app web-prod-01 +
⊕ BROADCAST app 
user@db-prod-01:~$ uptime
 14:02 up 89 days, load 0.27
user@db-prod-01:~$ █
⊕ BROADCAST app 
user@bastion1:~$ uptime
 14:02 up 42 days, load 0.13
user@bastion1:~$ █
● 3 connected⊕ broadcast: app (2)v0.25.0

Tabs, splits and broadcast input

Multi-tab terminal with horizontal and vertical splits inside a tab. Toggle broadcast and every keystroke fans out to a named group at once — a session can sit in several groups in parallel. Per-session paste guard, themes, search, configurable scrollback built in.

ssh-tool — tcpdump
db-prod-01bastion1
LIVE tcpdump · db-prod-01
Flat Flows 9 Decode 3 
dhcp xid 0x3e8f2a1  DISCOVER→OFFER→REQUEST→ACK  • 10.0.1.74
   client-mac   b8:27:eb:1a:44:9c
   requested-ip 10.0.1.74
   server-id    10.0.1.1
   lease-time   86400s
   router       10.0.1.1
   dns          10.0.1.1, 1.1.1.1
dns 14:02:21 A app.internal → 10.0.1.30
arp 14:02:22 who-has 10.0.1.21 tell 10.0.1.5 █
filter: port 67 or 533 decodedsudo via vault

Live tcpdump with protocol decode

Right-click a host and stream packets into a side panel — sudo fed from the vault, no prompt. Switch between Flat, Flows (grouped by 4-tuple) and Decode views. Tick Verbose and the decoder dissects DHCP transactions (DISCOVER/OFFER/REQUEST/ACK with lease fields), DNS and ARP down to the field level. BPF filter server-side, instant client-side row filter.

ssh-tool — Port forwards
db-prod-01Forwards
TypeBindTargetTraffic
L127.0.0.1:5432db-prod-01:5432⇅ 4.2 MB
R0.0.0.0:8080localhost:3000⇅ 812 KB
D127.0.0.1:1080SOCKS5 dynamic⇅ 19.8 MB
🌐 Launch isolated browser via :1080 temp profile
● 3 forwards activeSOCKS5 :1080

Tunneling: L / R / SOCKS5 + isolated browser

Local, remote and dynamic SOCKS5 forwards per session with live byte counters. One click launches an isolated browser pinned to the SOCKS port on a throwaway profile — reach an internal dashboard through the tunnel without touching your main browser. The in-app HTTP/SOAP probe routes through the same forward.

ssh-tool — Dynamic inventory
▢ lxc-pg-01 PROXMOX running
TypeLXC · node pve-node-01 · VMID 104 vCPU4 RAM8 GiB Uptime11 days
CPU34%
RAM61%
Disk23%
📌 Pin as permanent connection
refreshed 30s agoAPI token in vault

Dynamic inventory folders

Folders that auto-populate from Proxmox VE, Hetzner, DigitalOcean, Linode, Vultr, Scaleway, AWS EC2 and Ansible files. Tag and label filters narrow what shows; stopped guests grey out with a "connect anyway" prompt. Click a host for live CPU/RAM/disk bars, pin one as a permanent connection, or convert the whole folder to static. API tokens live in the vault.

ssh-tool — Themes
db-prod-01bastion1
Catppuccin Mocha 
deploy@db-prod-01:~/srv$ ls --color
config  deploy.sh  README.md  data
deploy@db-prod-01:~/srv$ git status
modified:   app.go
deleted:    old.go
deploy@db-prod-01:~/srv$ █
Settings · Terminal · Theme11 themes

Pick a terminal theme

Eleven curated palettes — Catppuccin Mocha/Latte, Dracula, Solarized dark/light, Gruvbox dark/light, Nord, One Dark and Tomorrow Night — set per app, applied live to every pane. Plus three UI themes (dark, light, high-contrast), configurable font, size and scrollback.

Built for daily use

Tree with folder inheritance

Manage 300+ connections in nested folders. Credentials, jump hosts, and SSH options cascade down. Drag & drop, multi-select, Ctrl+K quick palette.

Dynamic inventory

Auto-populated folders that pull live from Proxmox VE, Hetzner Cloud, DigitalOcean, Linode, Vultr, Scaleway, AWS EC2 and Ansible files. Tag/label filters, hide-stopped, on-demand refresh, pin-one-host, convert-folder-to-static.

Encrypted vault

Passwords, keys and API tokens sealed with Argon2id + XChaCha20-Poly1305. Machine-bound auto-unlock (DPAPI on Windows, machine-id on Linux), idle auto-lock, strength meter.

Tabs, splits, broadcast

Multi-tab terminal with horizontal/vertical splits, paste guard, themes, search. Broadcast input to multiple named groups in parallel - one session can broadcast to several groups at once.

Detach and redock windows

Tear off panes to separate windows, then snap them back. Tray icon, minimise-to-tray, close-to-tray.

Port forwards + isolated browser

Local, remote and dynamic SOCKS5 forwards. One click launches an isolated browser pinned to the SOCKS port. "Give internet" reverse-proxies an offline server's HTTP traffic out through your machine - no squid needed.

Debug with an LLM (MCP)

Share a live SSH session with an external LLM client (Claude Code, LM Studio, any MCP server) so it can read the terminal, pull logs, search and open your saved connections, and propose commands. Off by default and local-only: no session is reachable until you share it, read-only commands auto-run, and anything that changes state needs your approval. Terminal output is treated as untrusted data, and every action is recorded in an activity log.

Userspace VPN profiles

Route a connection's first SSH hop through WireGuard, NetBird or Tailscale without a TUN adapter, admin rights, or system routes. Assign a profile to a folder and the whole tree rides the tunnel. Auto-mode dials direct when you're on-site, tunnel when remote. NetBird and Tailscale ship as optional plugins.

opkssh auth, native

OpenPubkey SSH certificates issued via OIDC, no external binary or filesystem dance. Cert and key live in the vault.

Live tcpdump + network insights

Streamed packet capture inline with per-protocol decode, sudo via saved credential when needed. A live analyzer flags routing and wrong-interface problems (0.0.0.0-bound replies from the wrong source IP, half-open TCP, ICMP unreachable, ARP off-subnet) and a one-click route check confirms the kernel's actual egress. Captures run in the background and survive detaching the tab to its own window.

HTTP / SOAP probe

One-off REST or SOAP requests with auto-detected route via an active SOCKS forward. Endpoints behind VPN become reachable in-app.

Workspaces & snippets

Named bundles of tabs restore your usual six terminals in one click - or let the app offer to reopen the last session's tabs at startup. Snippet palette fires reusable commands into the active session.

Batch exec

Run a one-off command across a multi-selection of hosts. Aggregate view with stdout, stderr and exit per host.

VNC console, in-app

Open a Proxmox VM, LXC, or node console - or any VNC host - as a tab, rendered by noVNC inside the app with no external client, no X server, no install. Proxmox guests reuse your inventory API token (vncproxy + vncwebsocket, self-signed clusters supported); node shells use a realm login; generic hosts dial the RFB port directly or tunnel it through the connection's SSH session. Fit scaling, Ctrl+Alt+Del; the optional VNC password lives in the vault.

Encrypted sync, your server

Sync the whole profile - connections, credentials, vault, icons, settings - between machines over any WebDAV server or SSH/SFTP server you control. Sealed with argon2id + XChaCha20-Poly1305 before upload; the server only ever sees ciphertext. SFTP auth reuses a vault credential or a key/password you type in, so a fresh machine can bootstrap. Auto-sync pushes on change; incoming changes apply live with no restart and, optionally, in the background while you work.

Session recording + player

Record a session's terminal output to standard asciicast v2 .cast files - output only, keystrokes never touch disk. Built-in player with seek, speed and idle-skip; files also play in asciinema or any web cast player.

Verified self-update

In-app updates stream with a progress bar and are sha256-checked against the release manifest before the binary is swapped. Leftovers from the previous version are cleaned up automatically.

Import from your old tool

Bring 600+ Devolutions RDM entries in one pass, your ~/.ssh/config with ProxyJump chains intact, PuTTY / KiTTY registry exports, or MobaXterm session files. All imports are additive and safe to re-run.

Android app

The same Go core, vault and SSH stack on an Android phone (arm64, DeX-ready). Biometric vault unlock backed by the device Keystore, a single-pane touch layout with system-back navigation, an on-screen key bar (Esc/Tab/Ctrl/arrows/^C^D...), pinch-to-zoom font size, and a foreground service that keeps SSH sessions alive when backgrounded. opkssh login opens the system browser; ssh-tool:// deep links open the app. Sideload the APK - no store account needed.

Install

Windows

  1. Download ssh-tool-windows-amd64.exe (29.6 MB)
  2. Chrome and Firefox will warn — the binary is not code-signed yet. Why.
  3. Run it. SHA256 is published next to the download for verification.

sha256 c6f51aa9333a7e2189c5ca7e22967c8e97d5c094b6bc1d3c09afc3d81a09c58f

Linux

  1. Download ssh-tool-linux-amd64 (28.6 MB)
  2. Mark it executable: chmod +x ssh-tool
  3. Run it. SHA256 is published next to the download for verification.

sha256 010d3afcd9817a249954662f95eee1a44fdc2e6dfb504b7fc153b99ae8f180ce

macOS coming soon

Universal build planned once Apple Developer ID is sorted.