The four walls people hit in FileZilla

The Windows panel of FileZilla's download page still carries the line “This installer may include bundled offers.” The clean installer and the plain .zip are one click deeper, under “Show additional download options”. It has been written up before — BleepingComputer on 25 June 2018, a Hacker News thread on 6 March 2024 — and it is usually the first thing a security team asks you about.

Conchshell bundles nothing. The Windows installer pulls one dependency, Microsoft's WebView2 runtime, and only when the machine does not already have it. Every file is listed in SHA256SUMS, so a download can be checked against it. The iPhone and iPad app comes from the App Store; but on Android the app is an APK from this site, not in Google Play. That is friction of its own; it is just not a sponsored one.

Neither client is an Electron app, and both are small. Conchshell 2.16.0 is a 9.3 MB download on Apple silicon, and version 2.10.1 took 18 MB on disk there, 20.6 MiB for the Intel build, measured on 3 August 2026; FileZilla is native C++ in the same weight class. Between these two, size is not the argument.

Before exporting anything, find out what you have been storing. Edit > Settings… > Interface > Passwords shows which of the three modes you are in, and the knowledge base spells out what the default one means: “By default, FileZilla and FileZilla Pro save the passwords you enter in the Site Manager in plain text.” Base64, readable out of any export, with the decoding steps in the same article.

The master password has existed since 2017 and the cryptography under it is sound — PBKDF2-SHA256, at least 100,000 iterations, a 32-byte salt, an X25519 key — but it is opt-in, unrecoverable if forgotten, and nothing in it uses Windows DPAPI, the macOS Keychain or libsecret. The 2010 ticket asking for exactly that was closed by pointing at the master password.

None of it travels. Conchshell's vault is XChaCha20-Poly1305 with independent key slots over one data key. On a Mac, iPhone, iPad or Android phone the system keychain opens it, so one click creates it and there is no master password; Windows and Linux have no keychain support, so there it takes a master passphrase of at least 12 characters, stretched with Argon2id and asked at every launch, plus a recovery code that is shown only once. It is optional too: without it, saved passwords stay unencrypted in the application's local data, and the app offers to create it each time it starts while any such password remains. Each credential in the vault is bound to its route: change the host, port, user, proxy chain or jump host and it is not offered.

The cost of that is real: credentials are excluded from Conchshell's own JSON bundle and the interface has no command that reads one back, so every password you keep gets typed once more, by hand.

Host identity works the same way underneath: a trust-on-first-use fingerprint store, with the confirmation drawn by the operating system rather than by the application, and RDP and FTPS certificates checked against the same store.

Both clients speak SFTP, FTPS and plain FTP, so the file transfer you do today carries on. FTPS is FTP over TLS, not SFTP. In Conchshell it runs through rustls, and the server's certificate is pinned on first use: a certificate that chains to a root your system trusts, is valid today and names the host you typed is accepted without a question and pinned all the same (Android has only the pin); any other certificate is shown in a dialog drawn by the operating system so you confirm its fingerprint once, and a changed one is not used until you confirm the replacement in the same OS warning dialog. Closing that dialog without pressing a button counts as a refusal, on every platform; in version 2.16.0 and earlier, closing it on Windows or Linux, or pressing Back on Android, counted as trust, which 2.17.0 fixed.

Plain FTP sends the password and the files unencrypted; Conchshell says so in the connection dialog and recommends switching FTPS on. FileZilla does explicit and implicit FTPS; Conchshell does explicit only, so a server that expects implicit TLS on port 990 will not connect. The paid FileZilla Pro build adds WebDAV and a dozen-odd cloud back ends, from S3 to SharePoint. Conchshell has none of those and will not pretend otherwise.

Every FileZilla edition ships without a terminal — their own comparison page prints “Built-in terminal emulator: No” about FileZilla Pro. No port forwarding, no jump host, no SCP. For most people that is fine for years, and then stops being fine on the day a deploy needs one command run straight after the files land.

Conchshell puts the file panel and the shell against a single connection definition: a real PTY, xterm.js drawing through WebGL, four-way splits, tab groups, sessions restored at launch, shortcuts you can remap, and the host's CPU, memory, disk and network on live graphs while the queue runs, with a log viewer that takes several sources at once with level filters, regex and live tail. The same connection carries its proxy — HTTP CONNECT, SOCKS4, SOCKS4a or SOCKS5 — and a jump host with its own credentials. There is no remote desktop in any FileZilla product; here RDP is in the same app, each remote desktop in a window of its own, CredSSP (NLA) only, so a host with NLA switched off will not connect. Keys are files, encrypted ones opened with a passphrase; on macOS, Linux and Windows it can also sign in with keys held by ssh-agent (on Windows, the built-in OpenSSH agent, not Pageant), and a phone has no agent at all.

The FileZilla client itself is free with no restrictions, personal or commercial: GPLv3, no key, no seat count, five hundred machines for nothing. WebDAV and every cloud connector are FileZilla Pro, and so are batch automation, a support channel and Site Synchronization, the feature that carries your Site Manager between machines. On 20 August 2026 Pro is listed under “Subscription plans and prices”: 12.99 euro a year for one device, 29.99 euro for three. Their terms still describe one-off purchases, so older perpetual keys exist; what is on sale today renews.

Credit where it is owed. Their Site Synchronization is built the way a careful person would want it: it writes to a server and path you nominate, over any protocol the client speaks, encrypted with a key derived from your own passphrase, and it deliberately refuses to sync OAuth tokens and the master password. No vendor cloud anywhere in it.

Conchshell answers the same problem with the same shape and a different bill. The app is free; one feature is paid — syncing saved connections between your own machines, $19 once at the introductory price, later $29, updates included, no machine limit, licence checked on your own machine — and it works by mirroring the encrypted vault into a folder you already sync. Devices linked by a code read off the desktop screen also sync directly over your own network while the app is open on both, so the folder matters only for machines that are rarely on the same network at the same time. If what you actually need is an S3 bucket in a file panel, Pro is the product and this one is not.

• You are tired of explaining the bundled offer to a security team.
• Half your FileZilla sessions end with you opening a terminal anyway.
• You reach production through a bastion. FileZilla has HTTP and SOCKS proxies but no SSH jump host.
• You would rather the client offered to encrypt saved passwords than rely on a setting you have to know exists.
• There is an RDP box in the estate and a third application open for it, and CredSSP (NLA) is all it needs.
• You move hosts between two machines of your own and would rather pay $19 once than a subscription every year.
• You remap keyboard shortcuts. FileZilla's are fixed, and the request has sat open in their tracker since 2005.

• Free at any scale, GPLv3, source published for every release, packaged in apt, dnf, pacman, Homebrew and winget. Conchshell's source is not published, and if that settles it, it settles it.
• Cloud storage. Pro speaks the real APIs of S3, B2, R2, Google Cloud Storage, Azure Blob and File, Drive, Dropbox, Box, OneDrive and SharePoint, and WebDAV besides. Conchshell speaks none of them, and nothing here should suggest it will.
• The old and the odd: 32-bit Windows and Linux, Intel Macs back to macOS 10.13.2, *BSD, an interface in more than forty languages. Conchshell asks for macOS 12 or later and ships Android only as an APK from the site.
• Twenty years of FTP behaviour: server-type settings for hosts whose paths are not POSIX, PASV quirks, per-site connection limits, a wizard that tests your router. Conchshell speaks plain FTP too, but has none of that behind it, so if your one problem host is a shared-hosting FTP box from 2009, keep FileZilla for it.
• An organisation: security fixes funded through EU-FOSSA, a SHA-512 for every download, a moderated forum, a public tracker since 2005, and a free AGPL server for the other end of the transfer. Conchshell is one person.

1. Find out what you have been storing: Edit > Settings… > Interface > Passwords shows which of the three modes you are in. If it says save passwords and you never set a master password, they are Base64.
2. File > Export…, tick Export Site Manager entries, and save the XML somewhere you will remember to delete afterwards.
3. Install Conchshell: .deb, .rpm or .AppImage on Linux, and every file is listed in SHA256SUMS to check it against. On a Mac with Apple silicon, Conchshell opens with no extra step. On an Intel Mac with macOS 13 or later, clear the first launch through System Settings, Privacy & Security, Open Anyway; on macOS 12 the path is System Preferences, Security & Privacy, General. Both are set out on /download/.
4. Type your hosts in from that export. Conchshell's own import and export is a JSON bundle of connections, folders, profiles and settings; it does not read FileZilla's XML, so this part is manual, and it is once.
5. Keys stay in ~/.ssh where they are — point at the file, passphrase-encrypted included. On macOS, Linux and Windows a key that lives only inside ssh-agent can be used through the agent (on Windows, the built-in OpenSSH agent); Pageant does not work yet, so for a Pageant key, point at its .ppk file.
6. Re-enter the passwords you use, delete the XML, and keep FileZilla for the odd FTP host that only it talks to properly.

Download Conchshell

Is Conchshell really free, or does it stop working later?

It does not stop. The app is free on macOS, Windows and Linux, with no trial clock, no expiry and no feature that greys itself out. One thing is paid: syncing saved connections between your own machines, $19 once at the introductory price and $29 later, with updates included, no limit on the number of machines, and the licence checked offline on your own machine. There is no account to create either: no sign-in screen, no cloud and no server of ours in the path.

Does FileZilla have a built-in SSH terminal?

No, and it never has. Their own comparison page lists no built-in terminal emulator among the cons of FileZilla Pro. SSH exists in FileZilla only as the transport underneath SFTP: no console tab, no port forwarding, no jump host, no SCP. If you need a shell, it is a second application, which is the most common reason people go looking.

Does FileZilla store passwords in plain text?

By default, yes. Their own knowledge base says the Site Manager saves passwords in plain text, Base64-encoded, and documents how to decode them out of an exported file. Switching on the master password fixes that with PBKDF2-SHA256 and an X25519 key, but you have to know to switch it on, and there is no recovery if you forget the passphrase.

How do I download FileZilla without the bundled offers?

On the download page, ignore the big button and open Show additional download options, then take the plain installer or the .zip. Or install it from a package manager, which does not carry the offers: apt, dnf or pacman on Linux, Homebrew on macOS, winget or Chocolatey on Windows. Distribution packages usually lag the current release, which on 20 August 2026 is 3.71.0.

Can Conchshell connect to S3 or Google Drive?

No. There are no cloud connectors here at all: the file side is SFTP, FTPS and plain FTP, and that is the whole list. If a bucket has to appear in a file panel, FileZilla Pro genuinely does that better than anything Conchshell will offer, with the provider APIs rather than a WebDAV shim over them.

Is Conchshell open source like FileZilla?

No. FileZilla is GPLv3 with a source tarball for every release and a public bug tracker going back twenty years; Conchshell's source is not published. If reading the code is a requirement of yours, that is a real reason to stay, and no amount of feature comparison changes it.

What happens to my saved FileZilla passwords?

They stay in FileZilla until you remove it, and they travel inside any export you make. Nothing imports them here: credentials are deliberately excluded from Conchshell's JSON bundle, so each password is entered once by hand and, once it is in the vault, bound to its host, port, user, proxy chain and jump host.

You give up the cloud connectors, the published source and twenty years of FTP corner cases, and you retype every saved password once. You keep SFTP, FTPS and plain FTP, and you gain a terminal, RDP against NLA hosts, live host graphs and a vault the application offers before you go looking for the setting.

If none of the four is yours, close this page. FileZilla is free, it works, and nobody should change clients for the sake of changing clients.

Download Conchshell

• What Conchshell is
• Download for macOS, Windows and Linux
• How the vault and host keys work
• Looking at WinSCP instead
• Looking at Cyberduck instead