Conchshell

SSH · SFTP · FTPS · RDP — one window

Refusing to use this connection's saved credentials for
root@10.0.0.5:22. They were saved for a different
address. If the server really moved, type the password
in yourself — that connects now, and saving it moves
the stored copy to the new address.

Most clients would have typed your password at that address.

A saved credential belongs to the machine it was saved for. Conchshell binds it there — to the host, the port, the user, the proxy and the jump host — and refuses to send it anywhere else, even when the request comes from inside the app.

Free. No account, no telemetry you did not agree to, nothing of yours on anybody's server.

What it refuses to do — and what that saves you from

// the app, when a stored key changes The identity of prod.example.com:22 has CHANGED Previously trusted: SHA256:Kkz0CCPBnHsPKEmiy2XisyDgW8bem/j8shCgWfqL4yA Offered now (ssh-ed25519): SHA256:fMHSkV5cnwiy+ETp4qYLKLjWIEC2RrVWngecUi88WvM [ Cancel ] [ Replace key ]

Approving a host key is not the app's decision

That box is drawn by your operating system, not by the application window. A compromised interface cannot repaint it, cannot click it, and cannot make a key replacement look like a first connection. The safe button is the one the keyboard reaches first.

// every IPC command the interface may call vault_store_secrets → ok vault_delete_secrets → ok vault_has_secrets → true | false // there is no vault_get_secret. There never was.

The interface can store a password and delete it — never read one

Credentials are decrypted in the Rust core, at the moment a connection opens, and handed to the socket. No interface code path can enumerate your vault, because no command exists that would answer.

// what a stolen vault file looks like XChaCha20-Poly1305 · Argon2id · HKDF-SHA256 BLAKE3 key commitment one data key, independent key slots // records padded into buckets, so the file // size tells you nothing about what is in it

Losing the laptop is not losing the credentials

The vault opens from the OS keychain with no prompt, or from a master password if you prefer it stricter. Either way the file on disk is sealed, and the sealing is documented rather than described in adjectives.

// a window that renders a remote file window: file-viewer-1754239900 7 commands window: rdp-prod-1a2b3c4d 7 commands window: main all of them Refusing IPC command `trust_server_identity` from window `file-viewer-1754239900`.

A window that shows a remote file gets seven commands, not ninety-five

Pop-out windows render content that arrived from a machine you do not control. They are allowed exactly what they need and nothing else — a rule enforced in the core, not by the window agreeing to behave.

Facts, not adjectives

8.6 MB
installer
~34 MB
resident memory
4
protocols in one window
1 828
tests, run on every commit
0
accounts required

Where it is not finished

VNC does not connect. The protocol is stubbed out and the interface says so. Anyone claiming five protocols is counting one that would not open.

The builds are not notarised yet. macOS will object on first launch and you will have to allow it deliberately. That is being fixed, and until it is, it is written here rather than discovered by you.

Nothing here has been audited by anyone outside the project. The design and the format are published so that the claims above can be checked rather than believed.