The Secure Shell App is deprecated. Here is what to use instead

Secure Shell has shipped in two builds from the same Google team. The Chrome App came first; the extension launched in August 2018, and the project's FAQ says the two have had complete feature parity since December 2019 and that everyone should use the extension now. The App's listing is titled DEPRECATED Secure Shell App, shows 100,000 users, and has not changed since 2 September 2023.

Two things ended it. The first is Chrome apps as a platform: Google's policy text gives June 2022 as the date support was removed on Windows, macOS and Linux, the enterprise policy that kept them running there covered Chrome 104 to 113 only, and on ChromeOS, version 138 of July 2025 was the last release with support for user-installed Chrome apps. The second is Native Client, which the App is built on: the project's own timeline records Chrome dropping it in version 120 on Windows and macOS and 121 on Linux, with ChromeOS 138 the last to support it at all.

The extension moved on. Release 0.70 of 3 November 2025 removed Native Client, ssh now runs as OpenSSH compiled to WebAssembly, and the stable listing on 24 September 2026 shows version 0.81, updated 17 September 2026, with 900,000 users. The project keeps the old App only for Chromebooks that stopped receiving updates before ChromeOS 80.

For most people the answer is the Secure Shell extension in the Chrome Web Store, published by Google. It costs nothing, needs no account, and lives in the toolbar rather than the app launcher. It opens as a window by default, which is also what lets it catch Ctrl+W, Ctrl+N and Ctrl+T.

Three things do not follow you, by the vendor's own account. Imported keys were never synced, exported or backed up, and the old App's options page lists them by name with no way to save one, so each is imported again from the original files, the private key and its .pub as two separate files. ~/.ssh/config and known_hosts are not preserved anywhere, so copy their text out of the old App's options page, SSH Files, while it still opens. Bookmarks pointing at chrome-extension://pnhechapfaindjhompbnflcldabbghjo need the extension's ID, iodihamcpbpeioajjeobimgagajmlibd, instead.

Saved connections can travel as a file: Save Backup on the App's options page writes Secure Shell Preferences Backup.json, and Restore Backup on the extension's options page reads it. The source code notes that an invalid backup fails silently, so check the list afterwards. If the old App no longer opens, there is no options page left to press Save Backup on, and the connections are typed again.

Secure Shell is OpenSSH inside a browser, and Windows, macOS and Linux all ship an OpenSSH client of their own. On Windows 10 from build 1809 and on Windows 11 it is Microsoft's OpenSSH Client, an optional feature that is often installed already: check Settings, Optional features, then run ssh user@host in PowerShell. On a Mac it is the ssh command in Terminal, which also offers Shell, New Remote Connection for ssh and sftp.

That is the same protocol with no browser in the way, and also with nothing around it: no saved connection list, no file pane, no remote desktop. If those are what you were missing, a free SSH client for Windows covers the Windows side, and Conchshell for macOS the Mac one.

The extension bundles OpenSSH itself rather than reimplementing the protocol. A pasted ~/.ssh/config is read by OpenSSH's own parser, ssh certificates work, known_hosts is a text file you edit on the options page, and any flag you already know goes into the SSH Arguments field, port forwarding included. The limit is the sandbox: asked whether your own ~/.ssh/config will work, the FAQ answers “probably”, because directives that need access outside it, X11 forwarding, syslog and anything needing a domain socket among them, will not. Under it, hterm is a serious terminal emulator: long scrollback, mouse reporting for vim and emacs, OSC 52 clipboard writes, inline images.

The SSH family is the whole surface: a terminal, an sftp command line typed inside it (get and put, mget and mput, reget to resume, tab completion of remote paths, progress bars), an alpha Mosh build for roaming links, and two documented HTTP-to-ssh relay protocols for networks that let nothing else out. The graphical file route the store describes is a ChromeOS Files-app mount, so on Windows, macOS and Linux the prompt is what you get. There is no FTP or FTPS, no remote desktop on any channel, no host monitoring and no log viewer; Chrome Remote Desktop is a separate Google product from a different team and not part of it.

It also lives in Chrome, which keeps some keys for itself. In its own window it catches Ctrl+W, Ctrl+N and Ctrl+T; opened in a tab it loses them to Chrome, and the FAQ states that on macOS there is currently no way to capture Cmd-W at all. The project says it has only been tested with Chrome, and it ships no iOS or Android app.

Connection profiles and terminal preferences are ordinary Chrome preferences with no passphrase of their own, and with Chrome Sync on they travel with your Google account: hosts, usernames, ports and ssh arguments. Private keys stay on the machine and never enter sync storage, though the FAQ warns that Chrome writes them as mode-600 files under your profile directory, where non-Chrome applications may reach them, and advises a strong passphrase. Asked about keychain support, the FAQ answers not yet, and the connection profile has no password field at all, so a password login is typed at the ssh prompt every time.

1. Save what the extension holds first. Its options page, Save Backup, downloads Secure Shell Preferences Backup.json with your connections: hosts, usernames, ports, ssh arguments and terminal profiles. Keys, ~/.ssh/config and known_hosts are not in it, and release 0.81 of 16 September 2026 exists to fix known_hosts corruption on update, so copy that file as well.
2. Copy the SSH files out. Options, SSH Files, shows known_hosts and config as editable text. Paste each into the same file on your own machine, ~/.ssh/known_hosts and ~/.ssh/config, which on Windows live in %USERPROFILE%\.ssh, adding to what is there rather than replacing it. The same page also has synced /etc/ssh/ssh_known_hosts and /etc/ssh/ssh_config boxes; if they hold entries, append those to the same two files, because Conchshell reads only ~/.ssh/known_hosts and ~/.ssh/config. Point every IdentityFile line at the real key file on disk.
3. Do that before Conchshell starts for the first time. On its first start, while it has recorded no host key of its own, it reads ~/.ssh/known_hosts once and pins what it can: plain and [host]:port entries become trusted keys, while hashed lines, wildcard patterns, @revoked and @cert-authority entries are skipped, and those hosts get the ordinary first-connection prompt.
4. Install Conchshell: Apple silicon or Intel on macOS, Windows, or .deb, .rpm or .AppImage on Linux. On a Mac with Apple silicon, Conchshell opens with no extra step. On an Intel Mac with macOS 13 or later the first launch goes through System Settings, Privacy & Security, Open Anyway; on macOS 12 the path is System Preferences, Security & Privacy, General. The download page has the detail.
5. Bring the hosts across. Settings, Advanced, Import from ~/.ssh/config reads every Host entry the way ssh would, defaults from Host * included, and takes HostName, User, Port, IdentityFile and the first ProxyJump hop. Match blocks are skipped, and nothing is saved until you have seen the list. Connections that exist only in the backup JSON have no importer: write each as a short Host block in ~/.ssh/config and import that, or type them in.
6. Bring the keys. Options, SSH Files, Identity lists every key imported into the extension, and clicking a file name downloads it: save the private key and its .pub. Put them in ~/.ssh, where on macOS and Linux ssh expects the private key at mode 600, or add them under Settings, Keys, Add a key file. Conchshell reads OpenSSH and PuTTY .ppk private keys, passphrase-protected ones included, and unencrypted PEM keys, lists the keys it finds in ~/.ssh, and refers to them where they are. Only a key that exists nowhere any more needs a new pair from ssh-keygen, with the .pub added to authorized_keys while Secure Shell can still log you in.
7. Type each password once, since Secure Shell never stored any. Conchshell offers to create its encrypted vault when it starts, at every start while a saved password is still unencrypted; until you accept, saved passwords stay unencrypted in the application's local data. On a Mac it takes one click; on Windows and Linux it asks for a master passphrase of at least 12 characters.
8. Answer host-key prompts with a button. The confirmation for a new or changed key is drawn by the operating system, and closing that window without pressing a button counts as a refusal, on every platform; in 2.16.0 and earlier it counted as trust on Windows and Linux, which was fixed in 2.17.0.

Keep the extension installed. It costs nothing, and it is still the client that works on a machine where you cannot install software.

Conchshell is a native application for macOS, Windows and Linux, with an Android build installed as an APK from this site and a free iPhone and iPad app in the App Store. On a computer it gives you a real PTY, xterm.js drawn on WebGL, tabs, tab groups, draggable tabs, a four-way split, search, link recognition, twelve themes and seven fonts, local shell tabs that remember their working directory, and session restore at launch. Shortcuts are rebindable per action in settings, with no browser standing in front of them.

Files stop being something you type. Local on one side, remote on the other, drag and drop between them, a transfer queue with progress, speed, ETA, cancel and retry, directory compare and sync in four explicit steps, and a remote file opened in your own editor with every save sent back. FTPS, which is FTP over TLS rather than SFTP, sits in the same browser over rustls; a certificate the system already trusts is checked and accepted without a prompt (except on Android), and any other is pinned on first use once you confirm it, after which its chain, name and dates are not checked.

RDP opens in a window of its own beside the SSH tabs, with one limit to read before you download: CredSSP, that is NLA, only, with no fallback, so a host with NLA switched off will not connect. The main window watches the host you are on: CPU, memory, disk and processes on live graphs, network throughput, latency, open connections, and a log viewer with level filters, regex and live tail. Proxies over HTTP CONNECT, SOCKS4, SOCKS4a and SOCKS5, and an SSH jump host with its own credentials, belong to the connection itself.

The Apple silicon download of version 2.16.0 was 9.3 MB and the Windows installer 7.4 MB. Installed, it took 18 MB on Apple silicon and 21 MB on Intel when measured on version 2.10.1. On Windows the installer fetches Microsoft Edge WebView2 if the machine does not already have it.

The application is free on macOS, Windows, Linux, Android, iPhone and iPad. One feature is paid: syncing saved connections between your own machines, $19 once, an introductory price that rises to $29. It is a purchase rather than a subscription, updates are included, nothing counts your machines, and the licence key is checked on your own machine without a network. Secure Shell costs nothing and always has, so this is the only line where money appears at all.

The rest of the cost is not money. You leave the upstream OpenSSH client behind: Conchshell speaks SSH through the russh library, version 0.54 since 2.17.0, prefers Ed25519 host keys and leads key exchange with curve25519-sha256. That is sound work, and still one client tracking a moving upstream on its own. It keeps its own connection list, and signs in through ssh-agent on macOS, Linux and Windows (the OpenSSH agent, not Pageant), but has no smart-card or hardware-token support of its own and no agent forwarding. Sign-in is a password, a private key (with its passphrase if it is encrypted) or the agent, and an OpenSSH user certificate beside the key file is presented automatically. Keyboard-interactive is answered only with the saved password, so one-time codes cannot be entered. OpenSSH host certificates and port forwarding stay on the Secure Shell side. A jump host goes the other way: Conchshell sets one per connection, with its own credentials and its own host-key check, while the Secure Shell documentation does not mention ProxyJump and its FAQ warns that config directives needing access outside the browser sandbox will not work.

What you get in exchange is a vault. Credentials go into a store encrypted with XChaCha20-Poly1305 under one data key, with independent slots for a passphrase (its key derived by Argon2id; required on Windows and Linux), the system keychain (macOS, iOS and Android) and a recovery code, and each credential in it is bound to host, port, user, proxy chain and jump host. The interface can create one and delete one; it cannot read one back, because no such command exists.

• You cannot install software: a managed work laptop, a school Chromebook, a machine that is not yours. Chrome is already there and no administrator is needed, and Conchshell has no ChromeOS build.
• You depend on upstream OpenSSH: a pasted ~/.ssh/config read by OpenSSH's own parser, within what the browser sandbox allows, OpenSSH host certificates and CertificateFile, port forwarding typed as flags, and upstream releases arriving within weeks, OpenSSH 10.3 in May 2026, 10.4 on 20 July and 10.5 on 24 August.
• You log in with an OpenPGP smart card, a YubiKey or a Nitrokey. That path is documented there, with a built-in agent and agent forwarding; Conchshell has no built-in agent and no agent forwarding, though it signs in through an ssh-agent you already run (on Windows the OpenSSH agent, not Pageant), and a hardware key held in that agent has been checked on macOS and Linux only.
• You want your host list on several machines for nothing, which Chrome Sync does with no server to run and no extra account.
• You value the sandbox: ssh runs as a WebAssembly module under a strict content-security policy, so a client-side exploit is contained by Chrome rather than by your user account.
• You are betting on longevity: a public changelog going back to February 2012, the project's own code under a BSD licence, a public bug tracker and mailing list, and a store listing reporting 900,000 users on 24 September 2026.

Can I still download the DEPRECATED Secure Shell App?

The listing is still in the Chrome Web Store, at version 0.40 from 2 September 2023, but on an up-to-date system it will not run. It is built on Native Client, which Chrome dropped in version 120 on Windows and macOS and in 121 on Linux, and ChromeOS 138 in July 2025 was the last release to run user-installed Chrome apps. The project keeps the App only for Chromebooks that stopped receiving updates before ChromeOS 80; on anything newer, install the Secure Shell extension, which is free, published by Google and was last updated on 17 September 2026. The App's own description says it receives no updates and tells every user, on ChromeOS too, to move to the extension.

Is the Secure Shell extension the same as the old App?

Near enough. The same team builds both, and the project's FAQ says they have had complete feature parity since December 2019. The extension lives in the toolbar rather than the app launcher and opens as a window by default. What does not come across by itself is local state: the vendor says imported keys were never synced, exported or backed up, and that ~/.ssh/config and known_hosts are not preserved anywhere, so those move by hand.

How do I move my Secure Shell connections to Conchshell?

In four parts. Copy known_hosts and config out of the options page, SSH Files, into ~/.ssh on your machine before the first launch: Conchshell then reads known_hosts once, and Settings, Advanced imports the Host entries of ~/.ssh/config. Connections that live only in the Save Backup JSON have no importer, so write them as Host blocks or type them. Keys download one file at a time from the Identity list on the same SSH Files page, the private key and its .pub, and go into Conchshell under Settings, Keys. Passwords are typed once, because Secure Shell never stored any.

Is there a Secure Shell client for Windows or Mac that is not in a browser?

Yes. Windows 10 from build 1809 and Windows 11 carry Microsoft's OpenSSH Client as an optional feature, and macOS has ssh in Terminal, with Shell, New Remote Connection for ssh and sftp. Both are the same OpenSSH that Secure Shell runs, without a connection list, a file pane or a remote desktop. Conchshell is a native application for Windows, macOS and Linux with SSH, two-pane SFTP, FTPS and RDP in one window; the application is free, and only sync costs $19 once.

Is Conchshell really free?

The application is, on macOS, Windows, Linux, Android, iPhone and iPad, with no trial timer and nothing that greys itself out after a month. The one paid feature is syncing saved connections between your own machines: $19 once, an introductory price that rises to $29, a purchase rather than a subscription, updates included, no count of your machines, and a licence key checked on your own machine without a network.

What do I give up by leaving the extension?

Upstream OpenSSH itself and what follows from it: a pasted ~/.ssh/config read by OpenSSH's own parser, where most directives work and those that need to reach outside the browser sandbox do not, OpenSSH host certificates, port forwarding typed as ssh flags, hardware tokens through a built-in agent, and agent forwarding. Conchshell has no built-in agent and forwards none, though it signs in through an ssh-agent you run on macOS, Linux or Windows (the OpenSSH agent, not Pageant); it imports the Host entries of that config and the plain entries of known_hosts, but none of the rest. You also give up free cross-machine sync through Chrome, which is the one thing here that costs money.

Does Conchshell run on a Chromebook?

There is no ChromeOS build, so on a Chromebook the Secure Shell extension stays the right tool and this page is not asking you to change that. Conchshell ships for macOS on Apple silicon and Intel, for Windows, for Linux as .deb, .rpm and .AppImage, for Android as an APK from this site, and for iPhone and iPad as a free app in the App Store. The APK is not in Google Play.

For the DEPRECATED Secure Shell App the answer is short: let it go and install the extension, which is the same program, still maintained. The extension stays the answer for the machine you do not control, and for the day when only upstream OpenSSH will do.

Conchshell is the answer for the day with a file pane, an FTPS server and a Windows host in it. The application is free, and the only money in it is $19, once, for syncing connections between your own machines.

Download Conchshell

• A free SSH client for Windows 10 and 11
• Conchshell for macOS
• Conchshell for Windows: the .exe and .msi installers
• A two-pane SFTP client for Mac
• How credentials and host keys are handled
• Conchshell as a PuTTY alternative