ssh-toolssh-tool
Cross-platform SSH connection manager - terminal, port forwards, vault, all in one window.
Built for daily use
Tree with folder inheritance
Manage 300+ connections in nested folders. Credentials, jump hosts, and SSH options cascade down. Drag & drop, multi-select, Ctrl+K quick palette.
Dynamic inventory
Auto-populated folders that pull live from Proxmox VE, Hetzner Cloud, DigitalOcean, Linode, Vultr, Scaleway, AWS EC2 and Ansible files. Tag/label filters, hide-stopped, on-demand refresh, pin-one-host, convert-folder-to-static.
Encrypted vault
Passwords, keys and API tokens sealed with Argon2id + XChaCha20-Poly1305. Machine-bound auto-unlock (DPAPI on Windows, machine-id on Linux), idle auto-lock, strength meter.
Live external secret backends
Reference a secret in KeePass, Vaultwarden / Bitwarden, or Infisical directly - the password or SSH key is read from the source at connect time and never copied into ssh-tool. KeePass reads a .kdbx (local or remote over WebDAV / SFTP, read-only); Bitwarden decrypts items from the server, organizations and collections included; Infisical reads secrets by project, environment and path. Sign-in is by API key (KeePass and Bitwarden also seal a master in the vault); each backend is reachable behind a WireGuard profile. Reads are fresh, and when the source is briefly unreachable the last value seen is served, flagged stale, rather than breaking a connect.
Interactive username and 2FA prompts
Leave a connection without a username and pick it at connect time - handy when one key logs into several accounts. When the server asks for a typed password or a verification code (keyboard-interactive / PAM 2FA), or a stored key is rejected, ssh-tool prompts and passes your answer through instead of failing. Configured auth is tried first; jump hosts keep their fixed credentials.
Tabs, splits, broadcast
Multi-tab terminal with horizontal/vertical splits, paste guard, themes, search. Broadcast input to multiple named groups in parallel - one session can broadcast to several groups at once.
Detach and redock windows
Tear off panes to separate windows, then snap them back. Tray icon, minimise-to-tray, close-to-tray.
Port forwards + isolated browser
Local, remote and dynamic SOCKS5 forwards. One click launches an isolated browser pinned to the SOCKS port. "Give internet" reverse-proxies an offline server's HTTP traffic out through your machine - no squid needed.
Debug with an LLM (MCP)
Share a live SSH session with an external LLM client (Claude Code, LM Studio, any MCP server) so it can read the terminal, pull logs, search and open your saved connections, and propose commands. Off by default and local-only: no session is reachable until you share it, read-only commands auto-run, and state-changing ones need your approval - or pick auto-run (YOLO) mode for hands-off work, where only catastrophic commands still prompt. Terminal output is treated as untrusted data, and every action is recorded in an activity log.
Share a session to a browser
Let a colleague watch - or, with your approval, type into - a live session from a plain web browser, no ssh-tool on their side. You pick the tabs, the network interface, and read-only vs full control; every guest waits for your OK, and you confirm a short word-code with them so a leaked link is worthless. Encrypted over a self-signed certificate; splits, tab switches, and added tabs follow through live. LAN or over your own VPN - no cloud relay.
Userspace VPN profiles
Route a connection's first SSH hop through WireGuard, NetBird or Tailscale without a TUN adapter, admin rights, or system routes. Assign a profile to a folder and the whole tree rides the tunnel. Auto-mode dials direct when you're on-site, tunnel when remote. NetBird and Tailscale ship as optional plugins.
opkssh auth, native
OpenPubkey SSH certificates issued via OIDC, no external binary or filesystem dance. Cert and key live in the vault.
Live tcpdump + network insights
Streamed packet capture inline with per-protocol decode, sudo via saved credential when needed. A live analyzer flags routing and wrong-interface problems (0.0.0.0-bound replies from the wrong source IP, half-open TCP, ICMP unreachable, ARP off-subnet) and a one-click route check confirms the kernel's actual egress. Captures run in the background and survive detaching the tab to its own window.
HTTP / SOAP probe
One-off REST or SOAP requests with auto-detected route via an active SOCKS forward. Endpoints behind VPN become reachable in-app.
Workspaces & snippets
Named bundles of tabs restore your usual six terminals in one click - or let the app offer to reopen the last session's tabs at startup. Snippet palette fires reusable commands into the active session.
Batch exec
Run a one-off command across a multi-selection of hosts. Aggregate view with stdout, stderr and exit per host.
VNC console, in-app
Open a Proxmox VM, LXC, or node console - or any VNC host - as a tab, rendered by noVNC inside the app with no external client, no X server, no install. Proxmox guests reuse your inventory API token (vncproxy + vncwebsocket, self-signed clusters supported); node shells use a realm login; generic hosts dial the RFB port directly or tunnel it through the connection's SSH session. Fit scaling, Ctrl+Alt+Del; the optional VNC password lives in the vault.
Encrypted sync - your server or your cloud
Sync the whole profile - connections, credentials, vault, icons, settings - between machines over a WebDAV or SSH/SFTP server you control, or your own Dropbox, OneDrive or Google Drive account. Sealed with argon2id + XChaCha20-Poly1305 before upload; the store only ever holds ciphertext. Cloud backends sign in with OAuth + PKCE using your own app credentials, so there is no shared app or rate limit. SFTP auth reuses a vault credential or a key/password you type in, so a fresh machine can bootstrap. Auto-sync pushes on change; incoming changes apply live with no restart and, optionally, in the background while you work.
Session recording + player
Record a session's terminal output to standard asciicast v2 .cast files - output only, keystrokes never touch disk. Built-in player with seek, speed and idle-skip; files also play in asciinema or any web cast player.
Verified self-update
In-app updates stream with a progress bar and are sha256-checked against the release manifest before the binary is swapped. Leftovers from the previous version are cleaned up automatically.
Import from your old tool
Bring 600+ Devolutions RDM entries in one pass, your ~/.ssh/config with ProxyJump chains intact, PuTTY / KiTTY registry exports, SuperPuTTY Sessions.xml, or MobaXterm session files - and import PuTTY .ppk private keys directly (converted to OpenSSH on the way in). All imports are additive and safe to re-run.
Local-shell connections
Save a local terminal as a tree entry, not just an SSH host: pick a shell (or auto) and a command it runs on open. A telnet client to a console server, a serial console (screen /dev/ttyUSB0), a REPL, docker exec, or Claude Code on a double-click. Name it, tag it, give it an icon, favourite it - it opens like any connection, and exiting the shell closes the tab. Nothing SSH gets in the way: no host, port, credential or forwards on a local entry.
Android app
The same Go core, vault and SSH stack on an Android phone (arm64, DeX-ready). Biometric vault unlock backed by the device Keystore, a single-pane touch layout with system-back navigation, an on-screen key bar (Esc/Tab/Ctrl/arrows/^C^D...), pinch-to-zoom font size, and a foreground service that keeps SSH sessions alive when backgrounded. opkssh login opens the system browser; ssh-tool:// deep links open the app. Sideload the APK - no store account needed.
Liveness probe
See at a glance which hosts are up: a reachability dot on connection rows inside folders you have open. Probes only what's expanded, routes through a connection's WireGuard profile or an open bastion, and never brings a tunnel up just to check. Dynamic-inventory hosts optional.
Live log tail, parsed
Follow journalctl, a file, a Docker/Podman container, or a whole Compose stack in one panel. Lines are parsed and coloured by severity (JSON, syslog, nginx access, or a level keyword); a smart filter goes beyond grep - level>=warn, status=500, -noise, quoted phrases - with autocomplete, and a group toggle collapses repeats into one counted row. Flip to raw any time. Detaches to its own window and auto-reconnects.
Snippet variables
Reusable command snippets with ${var} / ${var:default} placeholders that prompt for values before firing into the active session (broadcast-aware).
Install
Windows
- Download ssh-tool-windows-amd64.exe (31.9 MB)
- Chrome and Firefox will warn — the binary is not code-signed yet. Why.
- Run it. SHA256 is published next to the download for verification.
sha256 65e65be3fa5da3b2fd42ebc04bcfde2aa2b559bff815f8704f6103f596d57179
Linux
- Download ssh-tool-linux-amd64 (30.8 MB)
- Mark it executable:
chmod +x ssh-tool - Run it. SHA256 is published next to the download for verification.
sha256 cecb937b7f4435d450537c401a645f50bb1be2b62d34ae61291ee3d91214143e
macOS coming soon
Universal build planned once Apple Developer ID is sorted.