A free Cyberduck alternative that also runs on Linux

Cyberduck's answer to a shell is to hand you off. Open in Terminal starts whatever else is installed, Terminal.app or iTerm2, PuTTY, ssh.exe, WSL bash, and Send Command runs a single command in a dialogue their documentation limits to FTP and SFTP. Neither is a session: no tabs, no split panes, no scrollback to search.

The cost is not the click. It is that the same twenty hosts now exist in two applications, and only one copy has the right port on it after somebody changes a port. Move a bastion in one place and you have moved it in one place.

Conchshell is built the other way round: the file panel and the shell read one host entry, one proxy chain, one jump host. Connect once and both halves are already pointed at the same machine, with the transfer queue on one side and a real PTY on the other.

The terminal is xterm.js drawn on the GPU, split four ways, with tab groups, search in the scrollback and sessions restored at launch. The file side shows speed and ETA in its queue, compares and syncs directories, and opens a remote file in your own editor, writing it back when you save.

The search suggestions give the first wall away, cyberduck linux, cyberduck ubuntu, cyberduck for linux, and comparison articles muddy it further by saying Cyberduck runs on Linux. As a desktop application it does not. What Linux gets is duck, the command-line tool, and it is a good one: 9.5.4 in the official APT repository when checked on 24 September 2026, the same version as the desktop release, reading the same bookmarks and connection profiles. The window never came, and a 2023 request for one was closed by the maintainer as a duplicate.

The second wall is Windows servers. The documented protocol index is nineteen entries long, none of them a remote-desktop protocol, and Cyberduck has never hidden that. Conchshell puts RDP beside the terminal, with the caveat to read before downloading: authentication is CredSSP (NLA) only, with no fallback path, so a host with NLA switched off will not connect. Nobody here is claiming parity with mstsc.

On Linux, Conchshell installs from .deb, .rpm or .AppImage, and it is the same application as on macOS and Windows rather than a reduced build.

Cyberduck has no proxy field of its own. Its documentation lists a SOCKS proxy and HTTP CONNECT tunnelling for all connections, both taken from the operating system: on macOS from System Settings, Network, with the bypass list and Exclude simple hostnames respected and an HTTP CONNECT proxy for SFTP and FTP set under FTP Proxy; on Windows from the LAN settings in Internet Options, with Integrated Windows Authentication for HTTP proxies. Automatic proxy configuration files are ignored on macOS. The only switch in Cyberduck itself is Use system proxy settings, so every bookmark takes the same route.

Conchshell sets the proxy per connection instead: SOCKS5, SOCKS4, SOCKS4a or HTTP CONNECT, with a username and password when the proxy asks for one, and a jump host with its own credentials. Both cover SSH, SFTP and RDP. FTP and FTPS connections can use neither in version 2.17.1, and a proxy or jump host configured on one stops the connection rather than letting it go out directly. With SOCKS5, SOCKS4a and HTTP CONNECT the proxy resolves the host name, so names that exist only on the far side of it still work.

Neither application includes a proxy server, free or paid. If a search for a free proxy brought you here, that part is something you bring: a SOCKS or HTTP proxy you run yourself or have been given.

Bookmarks do not migrate. Conchshell reads no .duck files, so hosts, ports and usernames are retyped, or arrive in a JSON bundle from another client. Passwords were never in the bookmark to begin with, they were in the macOS Keychain or Windows Credential Manager, and they get entered once more. Cyberduck is no easier the other way round: a .duck file leaves it by being dragged to the desktop, it imports another client's bookmarks automatically at first launch only, and its docs say there is no manual import function.

Your ~/.ssh/config comes across only in part. Cyberduck reads it on every connection and honours IdentityFile, IdentitiesOnly and ProxyJump; Conchshell imports its Host entries once — HostName, User, Port, IdentityFile and the first ProxyJump hop — into its own connection list. Imported entries arrive set to a key file or a password; on macOS, Linux and Windows (the OpenSSH agent, not Pageant) a connection can be switched to ssh-agent, so a key that lives only in an agent can stay there.

The buckets stay behind as well. Cyberduck's documented protocol index runs to nineteen entries, among them S3, Azure Blob, Backblaze B2, Google Drive, OneDrive, SharePoint, Box, Dropbox, WebDAV and SMB, plus vetted profiles for around thirty S3-compatible services and built-in Cryptomator vaults. Conchshell's list is short: SSH, SFTP, FTP with FTPS, RDP, Telnet and raw TCP, plus monitoring of the host you are already on. None of the rest exists here and none of it is planned. If any of it is a real part of your week, the honest plan is two applications rather than one.

The prompt appears when you quit, and again after an update. It comes back on their own tracker repeatedly: issues #3937, #4029, #4005 and #4507 all circle it, and a user-group thread asks how to remove it from office machines. Per their donate page, a donation of $10 or more returns a registration key that switches it off; whether it stays off through every update is what some of those issues dispute.

Buying in a store is the other route, $23.99 one-time in both, confirmed on 20 August 2026 through Apple's lookup API and Microsoft's catalogue API. It buys silence and a receipt, not features. One detail matters if you take that route on a Mac: their documentation notes that the sandboxed App Store build keeps SSH host key fingerprints in its own preferences instead of ~/.ssh/known_hosts, so its idea of which servers you trust is separate from your OpenSSH one.

Is it free for commercial use? GPLv3 permits it and there is no per-seat tier or enterprise product on their site, so organisations do deploy it freely; their documentation does not say so in those words, so run it past whoever signs off licences where you work. On price alone Cyberduck wins and it is not close: nothing is gated, there is no trial, and the source is on GitHub. If a bucket browser is what you need, you should not be paying us anything.

Conchshell is free on macOS, Windows and Linux, and one feature is paid: syncing saved connections between your own machines, $19 once, an introductory price that becomes $29 later, updates included and the key checked offline. There is no account to make because there is no server behind it. Syncing mirrors the encrypted vault into a folder you already sync, iCloud Drive, Dropbox or a git checkout. Devices linked by a code read off the desktop screen also sync directly over your own network while the app is open on both, so the folder matters only for machines that are rarely on the same network at the same time.

What the free part covers: an SSH terminal on a real PTY with four-way splits and tab groups, the two-panel SFTP and FTPS browser with its transfer queue and directory sync, RDP, and live monitoring of the host you are on, down to processes, per-interface bandwidth, latency and several logs tailed at once with level filters and regular expressions. Proxies are HTTP CONNECT, SOCKS4, SOCKS4a and SOCKS5, a jump host carries its own credentials, and shortcuts are editable in settings.

Saved credentials go into a vault encrypted with XChaCha20-Poly1305 once you accept it. On a Mac, iPhone, iPad or Android phone the system keychain opens it, with no master password; Linux and Windows have no keychain support, so there it opens with a passphrase of at least 12 characters, stretched with Argon2id and asked at every launch, and setup shows you a recovery code once. Until then saved passwords sit unencrypted in the app's local data, and the app offers to create the vault each time it starts while any remain. Each credential in the vault is bound to host, port, user, proxy chain and jump host together, so change any one of them and the password is not offered. The interface can create a credential and delete it; it cannot read one back.

• Cyberduck and a terminal are open at the same time, with the same hosts typed into both.
• There is at least one RDP session in every working day.
• Your desktop runs Linux and a command-line tool was not what you wanted.
• You want the file panel and the shell to share a host list, a proxy chain and a jump host.
• You would like to rebind a shortcut. Cyberduck's are fixed: asked in February 2025, the maintainer pointed at macOS System Settings, Keyboard, App Shortcuts, which matches menu items by exact title, and offered no Windows equivalent. Conchshell has a shortcut editor in its settings.

• Your files live in S3 or Backblaze B2. Versioning, lifecycle rules, Glacier restore, storage classes, ACL editing, pre-signed URLs and a CloudFront panel have no counterpart here, because no bucket browser of any kind does.
• Your organisation signs in through AWS IAM Identity Center, Microsoft Entra ID, OIDC via AssumeRoleWithWebIdentity, STS AssumeRole or the credential_process directive. That is enterprise identity work that takes years to build, and Cyberduck has done it.
• You open Google Drive, OneDrive, SharePoint, Box, Dropbox, WebDAV or an SMB share from the same window. Conchshell has none of them.
• You rely on Cryptomator vaults, or on the source being GPLv3 and readable before you trust it, with iterate GmbH as a named company standing behind the build. Conchshell's source is not published, so its claims have to be taken on trust or tested on your own machine.
• Your SSH setup lives in ~/.ssh/config, with IdentityFile, IdentitiesOnly and ProxyJump doing the work. Cyberduck reads that file on every connection; Conchshell only imports its Host entries once and does not honour IdentitiesOnly or IdentityAgent; its ssh-agent sign-in uses the agent named by SSH_AUTH_SOCK on macOS and Linux, and the built-in OpenSSH agent on Windows.
• You need a store receipt or an interface in one of roughly thirty-eight languages.

1. Download Conchshell for your platform and install it beside Cyberduck; nothing gets uninstalled today. Version 2.16.0 is a 9.3 MB download on Apple silicon, and version 2.10.1 took 18 MB on disk there, measured on 3 August 2026. On those Macs Conchshell opens with no extra step. On an Intel Mac with macOS 13 or later the first launch goes through System Settings, Privacy and Security, Open Anyway; on macOS 12 the same switch is in System Preferences, Security and Privacy, General. On Windows the installer pulls Microsoft Edge WebView2 from the network if it is missing.
2. Open your bookmarks in Cyberduck and pick the five hosts you actually touch. Those get retyped — address, port, username, and the jump host if you use one — unless they are already in ~/.ssh/config, whose hosts Conchshell offers on its first screen. The rest can wait until you need them, or arrive in a JSON bundle if another client gave you one.
3. Enter each password once. They were never inside the .duck file, the macOS Keychain or Windows Credential Manager held them, and Conchshell keeps credentials out of its own JSON export for the same reason.
4. Point at private keys where they already sit. Encrypted keys with a passphrase are handled, and on macOS, Linux and Windows a key that only an agent holds can be used through ssh-agent instead; on Windows that is the built-in OpenSSH agent, not Pageant.
5. Confirm each host key once. The confirmation is drawn by the operating system rather than by the application, and the fingerprint lands in Conchshell's own trust-on-first-use store. RDP and FTPS certificates are pinned in the same store, and one that your system already trusts for the name you typed is accepted without asking, except on Android.
6. Give it a week with both installed and watch which window you reach for. Buckets and Cryptomator vaults will keep sending you back to Cyberduck; the SSH, SFTP and RDP work probably will not.

Download Conchshell

Is this actually free, or is there a catch?

The application is free on macOS, Windows and Linux, with no account, no trial and no feature that stops working. One thing is paid: syncing saved connections between your own machines, $19 once rather than yearly, an introductory price that becomes $29 later, updates included and the key checked offline. If you never sync between two machines, you never pay anything at all.

Is there a Cyberduck alternative that runs on Linux?

This one does: .deb, .rpm and .AppImage, the same application as on macOS and Windows. Cyberduck itself ships only the duck command-line tool for Linux, kept at version parity with the desktop release, 9.5.4 on 24 September 2026, and the 2023 request for a Linux GUI was closed as a duplicate by the maintainer.

Can Cyberduck open an SSH terminal?

Not inside itself. Open in Terminal hands the session to Terminal.app, iTerm2, PuTTY, ssh.exe or WSL bash, and Send Command runs a single command in a dialogue their documentation limits to FTP and SFTP. That is enough to reload a config; it is not a place to work. There are no terminal tabs, panes or scrollback.

Does Cyberduck do RDP?

No. Their documented protocol index held nineteen entries when it was read on 20 August 2026, and not one of them is a remote-desktop protocol. Cyberduck is a file transfer and storage browser and has never advertised otherwise. Conchshell has RDP in the same app as the terminal, each remote desktop in a window of its own, over CredSSP (NLA) only, so a host with NLA disabled will not connect.

Does Cyberduck work through a proxy?

Yes, but only through the one your operating system is set to use. Cyberduck supports a SOCKS proxy and HTTP CONNECT tunnelling for all connections, taken from System Settings, Network on macOS or the Internet Options LAN settings on Windows; there is no per-bookmark proxy, and no proxy server comes with it. Conchshell sets SOCKS5, SOCKS4, SOCKS4a or HTTP CONNECT per connection, with a username and password if needed, for SSH, SFTP and RDP, but not for FTP or FTPS.

Why does Cyberduck keep asking me to donate?

By design. Their FAQ says the prompt is shown when you quit and again after installing or updating, and a donation of $10 or more returns a registration key that switches it off. Whether the key survives every update is disputed across several issues on their own tracker, and there is a user-group thread about removing the prompt from office machines.

Will my Cyberduck bookmarks import automatically?

No. Conchshell does not read .duck files, so hosts, ports and usernames are retyped, or brought in through a JSON bundle if another client gave you one. It is dull for twenty hosts and quick for five. Passwords would not have travelled anyway: they live in the macOS Keychain or Windows Credential Manager, never in the bookmark itself.

The honest end of this page is that most people who reach it should run both: Cyberduck for the buckets and the shares, Conchshell for the shell, the RDP session and the SFTP panel that used to be a second window.

If the wall you hit was Linux, or a Windows server, or a file client that cannot give you a prompt, that part costs nothing to fix. The application is free; only syncing connections between your own machines is $19, once.

Download Conchshell

• What Conchshell is, in one page
• Download for macOS, Windows or Linux
• If FileZilla is the other tab you keep open
• The same page written about WinSCP
• How the vault and host key checking work
• Conchshell on Linux: .deb, .rpm and AppImage