Conchshell vs iTerm2 — a terminal against a connection client

iTerm2 is a macOS terminal emulator. SSH out of it and you are running the system OpenSSH binary inside a tab: ~/.ssh/config is the host database, OpenSSH is the implementation. That is a real strength — ProxyJump, ControlMaster, certificates and hardware keys behave exactly as OpenSSH implements them, because nothing was reimplemented.

Conchshell is the other shape. It carries its own SSH stack (russh 0.44, Ed25519 preferred among host keys, curve25519-sha256 at the head of the key exchange), its own list of saved connections, and three more things in the same window: a two-pane file manager, an RDP session and host monitoring. Neither shape wins in the abstract; the question is which one matches the day you have.

iTerm2 has no connection manager in the SSH-client sense: no list of servers with per-host credentials saved against them, only Profiles, profile tags and ~/.ssh/config. The Password Manager is a different thing — somewhere to keep a password and paste it, held in the macOS Keychain or, per the 3.5.0 changelog, in an external vault: 1Password and LastPass, with Bitwarden and Keeper added in 3.6.10. It names no cipher of its own; storage is delegated to Apple.

Conchshell keeps saved connections in an encrypted store: XChaCha20-Poly1305, with the key derived from your master phrase by Argon2id. Passphrase, OS keychain and a recovery code are independent slots over one data key, so revoking a method rewrites a slot rather than re-encrypting everything.

One thing to know before you commit: the interface can create a credential and delete it, but it cannot read one back, because no such command exists.

What is stored is bound to the route — host, port, user, proxy chain, jump host. Change any of those and the password is not offered. Host keys use a trust-on-first-use fingerprint store, with the confirmation drawn by the operating system, and RDP and FTPS certificates are checked the same way. Certificate pinning is not implemented yet: FTPS trusts what the system roots trust, and nothing narrower.

iTerm2 does move files, and more capably than people expect. Right-click a filename in the output to download it, option-drag from Finder to upload, it2dl and it2ul from the shell-integration utilities, and with SSH Integration on, remote hosts appear in the macOS open and save panels. It uses libssh2 and checks host fingerprints.

What it is not is a file manager. The documentation calls it scp throughout and never claims SFTP; there is no dual-pane browser, no documented transfer queue, and no transfer-only session without a terminal attached first. Out of ssh_config that path reads only Host, HostName, User, Port and IdentityFile, so a host needing anything more exotic works in the terminal but not in the transfer.

The file side of Conchshell is half the window: local and remote panes side by side, drag-and-drop between them, a queue with progress, speed, ETA, cancel and retry, directory comparison and synchronisation in four explicit steps, and remote files opened in your own editor so that saving pushes them back. Every server keeps its own directory history and pinned folders. FTPS is there too, over rustls, checking the system root certificates.

There is no RDP in iTerm2 — the string does not appear in their documentation. A terminal emulator has no business painting a Windows desktop. But if a Windows server is in your week, it is a second application on top.

Conchshell puts RDP in the same window as the terminal, with the limit stated up front: CredSSP with NLA is the only path. A host with NLA switched off will not connect, and this is not a drop-in replacement for the Microsoft client.

The other boundary is the platform. iTerm2 is one Mac binary: 3.6.11, built 2 June 2026, needs macOS 12.4 or newer, with the 3.5 branch still covering 10.15 and up. No Windows build, no Linux build, and third-party pages titled "iTerm2 for Windows" are not the vendor's. Conchshell ships for macOS on Apple silicon and Intel, for Windows, and for Linux as .deb, .rpm and .AppImage; the same saved hosts reach all three either through the JSON export bundle or through the sync feature, which is the one paid part, $19 once. iTerm2 has no phone app; Conchshell's Android build is an APK from the site, not in the stores, and there is no iOS one.

• You work on more than macOS and want the same hosts on a Windows or Linux machine, carried there by the JSON export or by the $19 sync.
• An RDP session or an FTPS server is in your week and you would rather not open three applications.
• You move files often enough to want two panes, a transfer queue and directory comparison instead of right-click-and-download.
• You want credentials in an encrypted store bound to host, port, user, proxy chain and jump host, with SOCKS and HTTP CONNECT proxies set in a dialog rather than assembled in ssh_config.

• Terminal emulation depth: well over a decade of escape-sequence coverage, 24-bit colour, ligatures, inline images, OSC 8 hyperlinks and a Metal GPU renderer. If a remote TUI renders anywhere, it renders there.
• tmux control mode. With tmux -CC, tmux windows become native tabs and panes, and a dropped link does not kill the session: reattach and the windows come back. Nothing here does that.
• Full OpenSSH behaviour, because it runs the system ssh: ProxyJump, ControlMaster, certificates, FIDO keys and agent forwarding all work. Conchshell does not use ssh-agent at all — password, private key and passphrase-protected key are the three ways in.
• An automation layer no small client will match: triggers that fire on regular expressions in the byte stream, Instant Replay, shell integration with prompt marks, Automatic Profile Switching that turns a production host red on its own, and a Python API.
• It is free software under GPL v2, source on GitHub, no account and no licence server. If your employer runs procurement reviews, that is hard to argue with.

1. Download the build for your machine and open it; leave iTerm2 where it is. On macOS 13 and newer the first launch needs System Settings, then Privacy & Security, then Open Anyway; on macOS 12 the path is System Preferences, Security & Privacy, General.
2. Open ~/.ssh/config beside the new-connection dialog and copy host, port and user across. There is no ssh_config or Dynamic Profiles importer — the JSON bundle carries only what Conchshell exported.
3. Point each connection at the private key it already uses. Keys stay in ~/.ssh, and encrypted keys are unlocked with their passphrase.
4. Type the passwords in once. They go into the encrypted store, bound to that host, port, user, proxy chain and jump host, and are offered nowhere else.
5. Connect once to each host and accept the fingerprint at the operating-system prompt; after that the key is pinned.

Download and keep iTerm2 too

Is Conchshell free, or is there a catch?

The application is free on every platform, with no account, no subscription and no trial that runs out. One feature is paid: syncing your saved connections between your own machines, $19 once — an introductory price that later becomes $29, with updates included and no limit on how many of your own machines it covers. That is the whole commercial part of it. iTerm2, when we checked on 20 August 2026, was free under GPL v2 with nothing withheld for a paid tier.

Does iTerm2 support RDP?

No. Remote desktop is out of scope for a terminal emulator, and the string RDP does not appear anywhere in iTerm2's documentation as of 20 August 2026. If you need a Windows desktop on a Mac, that is a second application either way. Conchshell has RDP in the same window as the terminal, over CredSSP with NLA only, so a host with NLA switched off will not connect.

Do I need an account for either of these?

Neither one has accounts. iTerm2 is a download you unzip and run, with no sign-in and no cloud of the vendor's. Conchshell has no account either, and its sync feature is not a cloud service: the encrypted store is mirrored into a folder you already sync, such as iCloud Drive, Dropbox or a git checkout. Without a folder like that, only the first copy travels, by reading a code off the desktop screen.

Can I import my iTerm2 profiles or ssh_config?

Not automatically. iTerm2 exports profiles as JSON and can keep a whole host list in its DynamicProfiles folder, but there is no importer for either format here, and none for ssh_config. Connections import from a Conchshell JSON bundle, which is how you carry them to a second machine. Credentials are deliberately left out of that file.

Is iTerm2's SSH integration safe to use?

Read the vendor's own notes before switching it on. They label SSH Integration a beta-quality feature and it wants Python 3 on the remote host. In January 2025 the 3.5.11 changelog disclosed that versions 3.5.6 to 3.5.10 logged session input and output to /tmp/framer.txt on the remote host, where other users could read it. It was fixed quickly and documented plainly.

Will Conchshell replace my terminal?

For connecting to servers, yes: a real PTY, xterm.js with WebGL rendering, search, four-way splits, tab groups, session restore, ten themes and local tabs that remember their directory. For the deep end of iTerm2 — triggers, Instant Replay, the Python API, tmux control mode — no, and it is not trying to.

If your work is a terminal and what a terminal can be talked into doing, iTerm2 is very hard to beat and costs nothing. Keep it as the default on the Mac.

If your work is a list of servers — some needing files moved both ways, one of them a Windows box, all of them reachable from whichever laptop you were issued — that is a different program. The application is free on every platform; one feature, syncing saved connections between your own machines, is $19 once, introductory and later $29.

Download and keep iTerm2 too

• What Conchshell is
• Download for macOS, Windows or Linux
• How credentials are stored
• Conchshell vs Tabby
• A Termius alternative that charges once