FAQ

FAQ

Short, task-oriented answers. For the full detail behind any of these, follow the link to the relevant guide page.

How do I create a connection?

1. Open the Connections tab.
2. Click the new-connection button in the tree toolbar (or right-click a folder -> New connection to create it inside that folder).
3. Fill in the name and hostname. Everything else - username, port, credential, jump host - is optional: if you leave it blank the connection inherits it from its folder.
4. Pick a credential (or leave it to inherit the folder's default), then double-click the connection to connect.

Put connections in folders and set the shared bits (default username, port, credential, jump host chain) once on the folder - every connection under it inherits them, and you override per-connection only where it differs. See Connections & credentials.

What can I do with a SOCKS5 proxy?

A Dynamic (D) port forward opens a SOCKS5 proxy on localhost:<local_port>, tunnelled through the SSH session. Anything that speaks SOCKS5 - a browser, a CLI tool with --proxy, the app's own HTTP tool - can then reach whatever the remote host can reach.

Common uses:

• Reach an internal network through a bastion without a VPN.
• The isolated-browser launcher (below) - one click opens a browser routed through the proxy.
• The HTTP / SOAP tool auto-detects a running SOCKS5 and offers it in its "Route via" dropdown, so you can hit internal endpoints in-app.

The forward only runs while a session for that connection is connected; each row has a Start / Stop toggle and live byte counters. See Port forwards.

What are bookmarks and the instant browser launch?

Each Dynamic (SOCKS5) forward has an Open URL... button that launches a browser routed through that proxy. The browser uses a temporary profile, so cookies and history don't touch your normal browsing.

URLs you've opened through a forward are remembered as bookmarks - per-forward quick-launch buttons. Clicking a bookmark is the "instant" path: if the parent connection isn't connected yet, one click

1. opens the SSH session (and registers a terminal tab),
2. starts the SOCKS5 tunnel if it's down,
3. launches the isolated browser at the bookmark URL.

You can trigger the same flow from the cable button in any terminal pane's toolbar, or from the Ctrl+K palette (which matches bookmarks by name / URL). Pick the browser binary (Chrome, Chromium, Firefox, Edge) in Settings -> Browser launcher. See SOCKS5 + isolated browser.

How do I connect through a jump host (bastion)?

Set a jump host chain on the connection or, better, on its folder so every host under it inherits the same bastion. The chain is a recursive editor - each hop has its own hostname, port, and credential, so you can chain several bastions.

• On a saved connection: open the editor -> Jump host chain -> add a hop ([user@]host[:port]) and pick the hop's credential.
• On a folder: same chain in the folder settings - all connections under it route through it unless they override it.
• On a dynamic-inventory folder: there's a single jump host field ([user@]host[:port]) plus a jump-host credential that applies to every discovered host. Note that a jump host chain needs an SSH-capable credential on the hop - registration/reachability alone won't authenticate.

Imported configs are honoured too: ProxyJump, -J, and ProxyCommand=ssh -W from ~/.ssh/config, Ansible, RDM etc. are all recognised on import. See Connections & credentials.

What's the difference between the three port-forward types?

Type	Listens on	Forwards to	Use it for
Local (L)	localhost:<local_port>	<remote_host>:<remote_port> via the session	Reach one remote service (a DB, a web UI) on a local port
Remote (R)	<remote_host>:<remote_port> on the server	localhost:<local_port> on your machine	Expose a local service to the remote side
Dynamic (D)	localhost:<local_port> (SOCKS5)	anything the remote can reach	A general proxy - browser, internal network, in-app HTTP

All three are defined per-connection and run only while a session is connected. The status bar shows a green cable + a count of every listening forward across the app. See Port forwards.

How do I reach hosts on a private network without a system VPN?

Use a network profile (WireGuard, NetBird, Tailscale, or a corporate SSL VPN such as Cisco AnyConnect, Fortinet or F5) - a userspace tunnel with no TUN adapter and no admin rights. Assign the profile to a folder and every host under it dials its first SSH hop through the tunnel. Auto-mode dials direct when you're on-site and falls back to the tunnel when you're remote. See Network profiles.

Can an LLM help me debug a session?

Yes. Turn on Settings → LLM (MCP) access, register ssh-tool with your LLM client (Claude Code, LM Studio, any MCP client), then click the robot button on a connected session to share it - read-only or read+run. The LLM can then read the terminal, run commands, and open your saved connections, but it's gated: read-only commands auto-run and anything that changes state asks you to approve first. It's off by default, local-only, and everything the LLM does is logged. See LLM integration (MCP) - it also has a paste-in system prompt for your client.

How do I find something fast?

Ctrl+K opens the quick palette. It matches connections, dynamic-inventory hosts, port forwards, and SOCKS5 bookmarks by name, hostname, folder path, description, or bookmark URL - and lets you connect, start/stop a tunnel, or open a bookmark straight from the results. See Quick access & shortcuts.

Where does ssh-tool store its data? Is it encrypted?

Credentials live in an encrypted vault (vault.enc), sealed with your master passphrase (Argon2id + XChaCha20-Poly1305). Connections and folders are in a local SQLite store. Optional encrypted sync and backups use the same primitives. Nothing sensitive leaves your machine unless you configure sync. See Import / export & settings.

Which VPN needs a plugin, and why?

WireGuard is built in and works everywhere, including Android. NetBird, Tailscale and OpenConnect (AnyConnect, Fortinet, F5, GlobalProtect, Pulse) run as optional sidecar plugins - a separate helper process, downloaded from ssh-tool-plugins and checksum-verified in one click from Settings -> Network profiles -> Plugins. They're kept out of the main app to keep it small (and the OpenConnect engine is GPL-licensed), and because the helper process can't run on Android, plugin profiles are desktop-only. See Network profiles.

Can a verification code be filled in automatically?

Yes, from a TOTP kept in a Bitwarden / Vaultwarden item or a KeePass entry. Set One-time code from on a folder or connection and the SSH server's code question is answered from it, next to the stored password or key; an OpenConnect VPN profile can take its second password the same way. ssh-tool does not store TOTP secrets itself - both factors in one vault would be a single factor. Hardware and app tokens (MobilePASS and the like) are typed into the login prompt. See One-time codes.