ConchshellConchshell vs Xshell, side by side
NetSarang has been building this line since the 1990s, and Xshell does things Conchshell does not do at all. They are listed further down, not buried. For most people, though, the choice turns on two facts: Xshell runs on Windows and nowhere else, and no NetSarang product speaks FTPS, not Xshell and not Xftp. Everything about Xshell below was read from NetSarang's own store, manuals and support pages on 20 August 2026.
Windows, and only Windows
There is no macOS build of Xshell and none has been announced. There is no Linux build and no browser client: the whole NetSarang line-up, Xshell, Xftp, Xmanager and Xlpd, is Windows desktop software. The requirements say Windows 8 or higher; the all-features page adds Windows Server 2012, Terminal Server and Citrix MetaFrame. The route onto a Mac is Wine, which is why CodeWeavers keeps a CrossOver entry for it.
Conchshell ships native builds for macOS on Apple silicon and Intel, for Windows, and for Linux as .deb, .rpm and .AppImage. The same window on each of them; carrying your saved connections between them is the one paid part, $19 once. On a phone there is an Android APK from the site, with the same four protocols; it is not in Google Play, and there is no iOS build.
One rough edge on Windows: the installer fetches Microsoft Edge WebView2 over the network when the machine does not already have it. On a phone it is an Android APK served from the site — not in Google Play, and there is no iOS build. SHA256SUMS is published so the download can be checked before it runs.
What $119 buys, and what it does not
Xshell 8 was $119 a seat in NetSarang's own store on 20 August 2026, perpetual for the version you buy, with one year of maintenance. Volume brings it down: $113 from two seats, $107 from ten, $97 at a hundred. More maintenance is bought at checkout, $24 for another year or $47 for two.
The two-panel file transfer client is not in that price. Xshell gives you an SFTP session type, a Remote File Manager pane and, in an August 2026 build, SCP inside that manager. The graphical dual-pane client is Xftp: $59 alone, or $139 for the Xshell Plus bundle, both at the same date.
Conchshell is free on every platform, with the terminal, the two-panel file manager, FTPS, RDP and host monitoring in the one window. One feature is paid: syncing your saved connections between your own machines, $19 once at the introductory price and $29 after it ends. Nothing greys out if you never buy it.
FTPS is absent from the whole product family
Check this one before anything else, because SFTP and FTPS are different protocols and the shorthand blurs them. Xshell itself does no FTP of any kind. Xftp's specification lists SFTP over SSH2 and FTP, and the Xftp 8 manual contains the words FTPS, SSL and TLS nowhere at all. The only FTP on offer is plaintext, in a product bought separately.
NetSarang's shorthand, "SSH and SFTP/FTP client", reads as though it covers FTPS. It does not: FTPS is FTP wrapped in TLS, while SFTP is a subsystem of SSH, and having one says nothing about the other. Hand an Xshell user an FTPS endpoint over explicit TLS and they will be installing something else.
Conchshell does FTPS through rustls and validates against the system root store, with the certificate prompt drawn by the operating system rather than the application. Certificate pinning is not there yet, which is worth saying because a comparison page has every incentive not to.
Where the saved passwords sit
NetSarang's manual is blunt about this: passwords are encrypted with a fixed key, and the same paragraph calls that a risk of being exploited by hackers. The Master Password under Tools > Options > Security mixes your own keyword into the encryption, and it is off until you switch it on.
Sessions are ordinary files, one .xsh each, under your Documents folder. The scheme has been reverse-engineered in public, decryptors for it are freely available, and Metasploit carries a module that harvests saved Xshell credentials. Without a Master Password, whoever can read your Documents folder as you can read your passwords.
Conchshell's vault is XChaCha20-Poly1305, its key derived by Argon2id from your passphrase, with independent slots for the passphrase, the OS keychain and a recovery code. The interface can write a credential and delete one; it has no command that reads one back. Credentials are bound to the route as well, to host, port, user, proxy chain and jump host, so change any of those and the password is not offered.
Two machines, and the work of keeping them in step
Xshell has no sync at all. Moving sessions is File > Export, which writes an .xts bundle, a ZIP of the .xsh files, and File > Import at the other end. Credentials are the part to plan for: with a Master Password in play the same one has to exist on the receiving machine, and coming into Conchshell they are retyped in any case.
The $19 in Conchshell buys the other approach: the encrypted vault is mirrored into a folder you already sync, such as iCloud Drive, Dropbox or a git checkout, and the second machine reads it there. There is no Conchshell cloud and no account, which is also the limit, because with no such folder only the first copy travels.
Where Conchshell wins outright
- Any machine of yours that is not Windows. Xshell has no build for it and Wine is not a plan.
- FTPS over explicit TLS, which nothing in the NetSarang line speaks at any price.
- One free window with the terminal, both file panes, RDP and host monitoring, instead of $119 plus $59.
- Stored passwords under a key derived from your own passphrase, not a fixed one you must remember to replace.
- Two machines kept in step for $19 once, through a folder you already sync, with no account to create.
Where Xshell is the better tool
- Serial console sessions over a COM port with X/YMODEM and ZMODEM, plus telnet and rlogin. If your week includes a console cable into a switch, Conchshell has nothing for you.
- Enterprise authentication: GSSAPI with Kerberos and SSPI, PKCS#11 smart cards, Windows CNG certificate stores, OpenSSH CA certificates, FIDO2 keys. Conchshell does passwords and private keys, and it has no ssh-agent support at all.
- Scripting with a real object model in VBScript, JScript or Python, script recording, and triggers that fire when a string appears in the terminal.
- RDP against a host with NLA switched off, X11 forwarding into Xmanager, and deployment as a Terminal Server or Citrix published application. Conchshell's RDP is CredSSP with NLA only.
- A vendor: a support queue, resellers, published volume tiers, offline activation for estates that never reach the internet. Conchshell has an email address and no reseller channel.
Moving your sessions across
- In Xshell, File > Export writes an .xts bundle. Rename it to .zip and unzip it: inside are the individual .xsh session files, INI-style text with host, port and username in plain view.
- Conchshell has no Xshell importer. It reads its own JSON bundle of connections, folders, profiles and settings, so the values out of the .xsh files get copied, or scripted, into that. Forty hosts is one sitting.
- Credentials are re-entered at the Conchshell end whatever you do, because there is no importer and Conchshell keeps credentials out of its own export file. Inside Xshell they only follow the .xts to another machine when the same Master Password is set on both.
- Private keys do not move. They are files on disk: point each connection at the same path, and an encrypted key asks for its passphrase when you connect. Conchshell has no agent to fall back on.
- The first connection to each host raises a fingerprint prompt drawn by the operating system, not by the application. Check it once against ssh-keygen -lf on the server.
- Leave Xshell installed for what does not come across: serial sessions, telnet, triggers, your scripts. A paid licence is perpetual, so keeping it costs nothing.
Questions people actually ask
Is Conchshell really free?
The application is free on macOS, Windows and Linux, with the terminal, SFTP, FTPS, RDP and host monitoring in it. One feature costs money: syncing saved connections between your own machines, $19 once at the introductory price and $29 after that. No trial runs out, no tier greys itself out, and if you never pay, nothing about the application changes.
Does Conchshell need an account?
There is no account to create. Nothing signs in, nothing calls a portal to unlock a feature, and the $19 sync key is verified on your own machine with no network. Xshell's free tier is the other end of that: a name and a valid email address registered inside the app, and a licence that has to stay online.
Does Xshell do RDP?
Yes. RDP arrived with Xshell 8 as a protocol choice in the same session settings as SSH, on port 3389 and at no extra cost, so RDP tabs sit beside terminal tabs. Xshell's own manual documents it thinly; the detailed session settings are written up on the Xmanager side. Conchshell's RDP is CredSSP with NLA only, so a host with NLA switched off will not connect, and it is no replacement for mstsc.
Can Xshell connect to an FTPS server?
No, and neither can Xftp. FTPS is FTP inside TLS, not SFTP. Xshell has no FTP at all, and Xftp supports SFTP over SSH2 plus plaintext FTP, with no mention of TLS or SSL anywhere in its manual. An FTPS endpoint means a different application. Conchshell reaches FTPS from the same window as the terminal, checked against the system root certificates.
Is Xshell free for work?
Not legitimately. The Free EULA covers home and school use by one person on one desktop plus one laptop, and forbids business use directly or through outsourced or subcontracted services. NetSarang judges compliance partly from publicly available information such as IP ownership, and a free install found non-compliant stops being usable. Commercial use was $119 a seat on 20 August 2026.
What happens to my Xshell licence if I switch?
Nothing at NetSarang's end. A paid licence is perpetual for the version you bought, and what expires after the included year is maintenance, meaning the new builds and the technical support. Their pages do not describe anything else changing when it lapses. Keeping the installation for serial consoles and your scripts is a reasonable ending rather than a defeat.
How do I check a download before I run it?
Every release ships a SHA256SUMS file beside the downloads, so you can hash the file you got and compare it before anything runs. The packages the updater installs - .deb, .rpm, .AppImage, .msi, -setup.exe and .app.tar.gz - also carry detached .sig files. The two .dmg files are covered by the checksums only.
Which one to install
If every machine you touch runs Windows, and your day includes a console cable, a Kerberos ticket and a script watching the terminal for a string, Xshell is the better purchase and nothing above argues otherwise.
If a Mac or a Linux box is in the mix, if an FTPS endpoint has landed in your week, or if $119 plus $59 for one window has stopped making sense, install Conchshell and bring the hosts over.