ConchshellSecure Shell is genuine OpenSSH, and this page is about the window around it
Secure Shell is Google's Chrome extension, and what runs inside it is genuine OpenSSH, compiled to WebAssembly and executed in the browser sandbox. It costs nothing, asks for no account and no licence key, and it tracks upstream OpenSSH within weeks. Nothing on this page argues that it is weak software, because it is not. The argument is narrower than that: one protocol family, inside a tab, in a browser that takes the keyboard first. Everything said about Secure Shell here was read on 20 August 2026 from its Chrome Web Store listing and the project's own documentation.
What each one costs
Secure Shell costs nothing and never has. The stable listing on 20 August 2026 shows a free extension from Google Secure Shell Developers, Google Ireland Ltd., version 0.79, updated 20 July 2026, with no paid tier, no licence key, no in-app purchase and no clause about commercial use. There is no pricing page because there is no price.
The Conchshell application is free on macOS, Windows and Linux. Exactly one feature is paid: syncing saved connections between your own machines, $19 once, an introductory price that rises to $29. It is a purchase rather than a subscription, updates are included, nothing counts your machines, and the licence key is checked on your own machine without a network. Neither side asks you to register.
It really is OpenSSH, and that settles part of the argument
Secure Shell bundles OpenSSH itself rather than reimplementing the protocol. A pasted ~/.ssh/config behaves the way OpenSSH behaves, ssh certificates work, ProxyJump works, known_hosts is a text file you edit on the options page, and any flag you already know goes into the SSH Arguments field, port forwarding included. Nothing is missing because a graphical interface forgot to expose it.
It keeps pace with upstream: OpenSSH 10.3 arrived in release 0.77 on 11 May 2026, 10.4 in 0.79 on 20 July 2026. The ssh binary runs as a sandboxed WebAssembly module under a strict content-security policy, which the vendor argues is a security gain in itself, and hterm underneath it is a serious terminal emulator: long scrollback, mouse reporting for vim and emacs, OSC 52 clipboard writes, inline images.
Conchshell speaks SSH through russh 0.44, prefers Ed25519 host keys and leads key exchange with curve25519-sha256. Sound work, and still one client tracking a moving upstream on its own. If protocol fidelity is the only axis you care about, stay where you are.
One protocol family, one browser tab
The SSH family is the whole surface: a terminal, an sftp command line, an alpha Mosh build for roaming links, and two documented HTTP-to-ssh relay protocols for networks that let nothing else out. There is no FTP or FTPS anywhere in it, no remote desktop on any channel, no host monitoring and no log viewer.
And it lives in Chrome, which takes the keys first. Every binding is rebindable through the keybindings preference, but Chrome keeps Ctrl+W, Ctrl+N and Ctrl+T in a tab, hands some of them back in a dedicated window, and the FAQ states that on macOS there is currently no way to capture Cmd-W at all. It will not run in Firefox, Safari or Edge as it stands, and the project ships no iOS or Android app.
Files are a prompt there and a pane here
SFTP is bundled with nothing extra to install, and it is a command line typed inside the terminal: get and put, mget and mput, reget to resume, tab completion of remote paths, progress bars. The graphical route the store describes is a ChromeOS Files-app mount, so on Windows, macOS and Linux the prompt is what you get.
Conchshell keeps the file browser in the same window as the terminal: local on one side, remote on the other, drag and drop between them, and a transfer queue with progress, speed, ETA, cancel and retry. Directory compare and sync run in four explicit steps, each server keeps its own directory history and pinned directories, and a remote file can be opened in your own editor and saved straight back.
FTPS, which is FTP over TLS and not SFTP, is in that same browser, over rustls, checked against the system root certificates. Certificate pinning is not there yet.
Remote desktops and the rest of the window
A Windows box means a second application on the Secure Shell side, because there is no remote desktop in it of any kind. Conchshell opens RDP beside the SSH tabs, with a limit better read before downloading: CredSSP, that is NLA, only, with no fallback, so a host with NLA switched off will not connect.
The same window also watches the host you are logged into: CPU, memory, disk and processes on live graphs, throughput per network interface, latency, open connections, and a log viewer that takes several sources at once with level filters, regex and live tail. Proxies over HTTP CONNECT, SOCKS4, SOCKS4a and SOCKS5 and an SSH jump host with its own credentials belong to the connection itself, and a dropped session reconnects on its own.
Where connections and credentials live
Secure Shell keeps connection profiles and terminal preferences in Chrome's synchronised storage in the clear: with Chrome Sync on, your hosts, usernames, ports and ssh arguments go to Google. Private keys are the exception, staying on the machine and never entering sync storage, though the FAQ warns that Chrome writes them as mode-600 files under your profile directory where non-Chrome applications may reach them, and advises a strong passphrase.
Asked about keychain support, the FAQ answers not yet, and the connection-profile schema has no password field at all, so a password login is typed at the ssh prompt every time.
Conchshell stores credentials with XChaCha20-Poly1305 under a key derived by Argon2id from a master phrase, with independent slots for that phrase, the system keychain and a recovery code over one data key; adding or revoking a method rewrites a slot rather than re-encrypting the store. The interface can create a credential and delete it, and cannot read one back, because no such command exists. Each is bound to host, port, user, proxy chain and jump host, and host keys go into a trust-on-first-use fingerprint store whose confirmation is drawn by the operating system rather than the application; RDP and FTPS certificates are checked the same way.
Where Conchshell is the better tool
- You move files by hand every day and want two panes, drag and drop and a queue with ETA and retry rather than get and put.
- Your week includes an FTPS server or a Windows host with NLA, and you would rather not open two more applications for them.
- You want CPU, memory, process, network and log views of the machine you are logged into, in the window you are already in.
- You want the terminal to own the keyboard, including the combinations Chrome keeps for itself, and to be there when Chrome is not running.
- You want passwords saved at all: an encrypted store bound to host, port, user, proxy chain and jump host, instead of retyping at the prompt.
Where Secure Shell is the better tool
- You cannot install anything. On a managed work laptop, a school Chromebook or somebody else's machine, Chrome is already there and no administrator is needed. Conchshell has no ChromeOS build.
- You need OpenSSH semantics exactly: a pasted ~/.ssh/config, ssh certificates, ProxyJump, an editable known_hosts, port forwarding typed as flags, and upstream fixes landing weeks after upstream ships them.
- You sign in with an OpenPGP smart card, a YubiKey or a Nitrokey. That path is documented there, with agent forwarding through a built-in agent. Conchshell does not support ssh-agent at all: a password or a private key typed into the application is the whole list.
- You want the same host list on several machines for nothing. Chrome Sync does that with no server to run and no extra account, and the same job is the one thing that costs money here.
- You are betting on longevity: public development since roughly 2011, the project's own code under BSD 3-Clause, a public changelog, bug tracker and mailing list, and a store listing reporting about 800,000 users on 20 August 2026.
What moving across actually involves
- Save what Secure Shell holds before anything else: options page, Save Backup, which downloads Secure Shell Preferences Backup.json with your hosts, usernames, ports and ssh arguments. A June 2026 store review reports an update wiping the connection list, so keep that copy whatever you decide.
- Install Conchshell: macOS on Apple silicon or Intel, Windows, or Linux as .deb, .rpm or .AppImage. On macOS 13 and later the first launch goes through System Settings, Privacy & Security, Open Anyway; on macOS 12 the path is System Preferences, Security & Privacy, General. The download page has the detail.
- Enter the hosts. Conchshell's import format is its own JSON bundle and a Secure Shell preferences backup is not that format, so the values move across by hand: under a dozen hosts, type them; past thirty, write the bundle.
- Collect the original key files. The vendor states that imported keys have never been synced, exported or backed up, and it wants the private and .pub parts as separate files rather than one .pem. Conchshell takes a private key, or an encrypted key with its passphrase.
- Type each password once. It is then bound to that host, port, user, proxy chain and jump host, and changing any of those stops it being offered.
- Keep the extension installed. It costs nothing, and it is still the client that works on a machine where you cannot install software.
Questions people actually ask
What exactly costs money in Conchshell?
One feature. The application is free on macOS, Windows and Linux; syncing saved connections between your own machines costs $19 once, an introductory price that rises to $29. It is a purchase rather than a subscription, so there is nothing to renew, updates are included, no limit counts your machines, and the licence key is checked on your own machine without a network. There is no cloud behind that sync: the encrypted store is mirrored into a folder you already sync, such as iCloud Drive, Dropbox or a git checkout, and without such a folder only the first copy travels, by reading a code off the desktop screen. Secure Shell has no paid tier at all.
Is Secure Shell really OpenSSH, or its own implementation of the protocol?
Really OpenSSH. The project compiles the OpenSSH client to WebAssembly and runs it inside the browser sandbox, so protocol behaviour, ssh certificates, ~/.ssh/config semantics and known_hosts are upstream's rather than an approximation of them. The changelog shows OpenSSH 10.3 in release 0.77 on 11 May 2026 and 10.4 in 0.79 on 20 July 2026. Conchshell takes the other bet: the russh library inside a native window, Ed25519 host keys preferred and key exchange led by curve25519-sha256.
Does Secure Shell do SFTP?
Yes, with nothing extra to install, but it is a command-line client typed inside the terminal: get and put, mget and mput, reget to resume, tab completion of remote paths, progress bars. There is no two-pane window, no drag and drop between local and remote, no transfer queue with retry and no directory compare. The graphical route the store describes is a ChromeOS Files-app mount, so on Windows, macOS and Linux the command line is what you have.
Can Secure Shell connect over RDP?
No. It has no remote desktop feature of any kind, on any channel; it is a terminal, an sftp command line and an alpha Mosh build. Chrome Remote Desktop is a separate Google product from a different team and is not part of it. Conchshell opens RDP in the same window as the SSH tabs, with one limit worth reading before you download: CredSSP, that is NLA, only, with no fallback, so a host with NLA disabled will not connect.
Does either one need an account?
No. Secure Shell needs no sign-in, activation or registration, and the only Google account involved is the optional one in Chrome itself; with Chrome Sync on, your saved connections and terminal preferences travel to Google in the clear, while imported private keys stay on the machine. Conchshell has no account and no cloud of its own, and its licence key is verified on your machine without a network.
Is Secure Shell the same as the DEPRECATED Secure Shell App?
No, and the confusion is the vendor's own doing. The old Chrome App is still on the store under the title DEPRECATED Secure Shell App, version 0.40, last updated 2 September 2023, and it tells everyone, ChromeOS users included, to move to the extension. The maintained product is the extension from Google Secure Shell Developers, version 0.79 as of 20 July 2026. A separate Dev-channel listing also exists, reachable only when you are signed in to the Chrome Web Store with an address subscribed to the chromium-hterm mailing list.
Can I import my Secure Shell connections?
Not automatically. The options page hands you a JSON preferences backup of your profiles, and Conchshell imports its own JSON bundle, so the two files are not the same format. Read the hosts, usernames and ports out of the backup and either type them in or build the bundle. Passwords are not in the backup, since the profile schema has no password field, and imported private keys are not in it either, which the vendor states plainly.
Which one belongs on your machine
If you work on ChromeOS, or on a machine where you cannot install software, this is not a close call: stay where you are. The same holds if OpenSSH fidelity, hardware tokens or agent forwarding are the job itself.
If the day involves moving files by hand, an FTPS server, an RDP host with NLA, or one more shortcut swallowed by the browser, a native window holding all four is a different tool. Plenty of people end up keeping both, and only one line of it costs money: $19, once, for sync.