A free RDP client for Mac
Conchshell opens Windows Remote Desktop sessions on a Mac from the same connection list as your SSH terminals and file transfers. Each session gets a window of its own, which can go full screen; its tab in the main window brings it to the front or ends it. Version 2.17.1, for macOS 12 Monterey or later on Apple silicon or Intel.
It connects only to hosts that use Network Level Authentication, and it leaves some things out: sound, shared drives, a gateway, a second monitor. They are listed below, before you install anything.
What it does on a Mac
Each Windows desktop in its own window
An RDP session opens in a window of its own, which can be moved to another display or taken full screen and keeps its size and position for that connection. In the main window the session has a tab next to your SSH and SFTP tabs: it brings the window to the front, and closing it ends the session. Fit to window or 1:1, and a toolbar that sends Ctrl+Alt+Del and the Windows key. The desktop is asked for at the size of the window and follows it as you resize, or at a fixed 1024×768, 1280×720 or 1920×1080. Windows' own pointer shapes, such as the text cursor and the resize arrows, show over the session.
Cmd does what your fingers expect
By default Cmd+C, Cmd+V and the other Cmd shortcuts arrive in Windows as their Ctrl versions. Per connection, Cmd can be the Windows key instead, or left alone. Cmd+Q, Cmd+W, Cmd+M and Cmd+H always stay on the Mac, the right Cmd key is the Windows key, Cmd+Arrow becomes Home or End, and Cmd+Shift+Esc hands the keyboard back to the Mac.
Copy and paste across
Text copied on the Mac pastes in Windows, and text copied in Windows pastes on the Mac with an ordinary Cmd+V. Files copied in Finder paste into Explorer, up to 256 at a time and each under 4 GiB; folders are refused. Paste as typing (Ctrl+Cmd+V, or the toolbar button) types the clipboard into the session instead, for a field or a console that will not take a paste; Cmd+Shift+V now reaches Windows as Ctrl+Shift+V. Text a password manager marks as concealed is never offered to the remote host.
The host's certificate, pinned
The first connection shows the fingerprint of the host's key in a macOS dialog. A certificate macOS itself vouches for — issued by a CA the Mac trusts, for the name you typed, and in date — is accepted without the dialog. After that, a different key stops the connection until you confirm it, unless macOS vouches for the new certificate and the old one was accepted that way too. Self-signed certificates — what almost every Windows host has — work without switching any check off, because the key itself is what is remembered.
A proxy or a jump host per connection
A SOCKS5, SOCKS4, SOCKS4a or HTTP CONNECT proxy, or one SSH jump host, can sit in front of any RDP connection. If the proxy or the jump host cannot be used, the connection stops instead of quietly going direct.
Next to the rest of your work
The main window holds SSH terminals, the SFTP and FTPS file manager and host monitoring over SSH, and RDP connections are saved in the same list, so the Windows build machine and the Linux server it deploys to sit side by side.
What it does not do in 2.17.1
Stated plainly, so you can rule it out in a minute rather than an evening.
Network Level Authentication only
Sign-in goes through CredSSP (NLA) with NTLM. A host with NLA switched off, or a server that does not offer it — xrdp in its default setup, for one — will not connect. Kerberos and smart-card sign-in are not supported.
Old Windows and TLS
Conchshell first offers modern TLS 1.2 or 1.3 with current cipher suites, which Windows 10, 11 and Server 2016 onwards accept out of the box. Windows 7, 8.1, Server 2008 R2, 2012 and 2012 R2 do not, and no Windows update changes that. On a Mac, Conchshell can still reach them through macOS's older system TLS once you allow it for that host: the host's key is still checked, but the encryption is weaker, and the session is marked Outdated TLS.
One screen
The session is one monitor and cannot span several displays. A desktop asked for at the window's size follows the window as you resize it, and a fixed size stays as chosen. A server that cannot change its resolution on the fly — anything older than Windows 8.1 or Server 2012 R2 — gets Reconnect at window size on the toolbar instead.
No sound, drives or printers
Remote audio is not played, and there is no microphone, shared folder, printer, USB or smart-card redirection.
Files go one way
Files copied in Finder paste into Windows. Copying files in Windows and pasting them into Finder is not implemented; for that direction use a file share or an SFTP connection.
No gateway
Remote Desktop Gateway is not supported. A host reachable only through a gateway is out of reach unless an SSH jump host, a SOCKS or HTTP proxy or a direct route gets you there.
Keyboard layout, per connection
What you type arrives as the character you typed: characters found on the US layout go as key presses, anything else as Unicode, and a new session is asked for the US layout. A session that is already running keeps its own layout; if that layout is not US, choose Unicode typing under Server Keyboard Layout in the connection, which some apps, such as Hyper-V and VMware consoles, do not accept.
What you need
Mac
macOS 12 Monterey or later, Apple silicon or Intel — separate native builds
Download
11.0 MB for Apple silicon, 12.2 MB for Intel
Windows side
Remote Desktop turned on, with Network Level Authentication required — which Windows sets by default when Remote Desktop is enabled on Pro, Enterprise and Server editions. Home editions cannot accept Remote Desktop connections at all.
Network
TCP 3389, or whichever port the host listens on, directly, through a SOCKS or HTTP proxy, or through an SSH jump host
Account
Not required — there is nothing to register
Price
Free. Syncing connections between your own machines is the one paid feature — $19 once
First launch
Apple silicon: no extra step. Intel: System Settings → Privacy & Security → Open Anyway; on macOS 12, System Preferences → Security & Privacy → General. Once, on the first launch; the
download page has the details.
Questions about RDP on a Mac
Is the RDP client free?
Yes. Remote desktop is part of the free build — no trial, no tier, no account. The one paid feature is syncing saved connections between your own machines, $19 once.
Why does a Windows host refuse to connect?
Almost always Network Level Authentication is off on the host: turn it on in the host's Remote Desktop settings. An old Windows (7, 8.1, Server 2008 R2 to 2012 R2) does not accept the TLS Conchshell uses, and no update changes that; on a Mac, Conchshell asks whether it may reach such a host over outdated TLS and remembers the permission for it. A first connection also stops for the certificate prompt, which is expected.
Does copy and paste work between the Mac and Windows?
Text goes both ways. Files go from Finder to Explorer, not back. Ctrl+Cmd+V, or the toolbar button, types the clipboard into the session instead of pasting it, for places that refuse a paste.
Can I use a domain account?
Yes — put the domain in the Domain field of the connection. Sign-in uses NTLM inside CredSSP, so a domain that has switched NTLM off will not accept it.
Can I reach a host through an SSH jump host?
Yes, since 2.17.0: set one SSH jump host on the RDP connection, and the session is carried through it. The jump host signs in with a password or a key, not ssh-agent, and its own host key is checked. Only one hop is supported.
Does it run natively on Apple silicon?
Yes. The Apple silicon build is native arm64, so Rosetta is not involved.
Related
The same application, from the side of the job you came for.
Conchshell