Security & Zero-Knowledge Key Storage
Your infrastructure credentials belong strictly on your machine. Learn how SSH Desktop uses OS-native keychains, modern cryptography, and direct SSH2 protocols to guarantee total privacy.
The Four Pillars of SSH Desktop Security
1. Zero Cloud Telemetry
SSH Desktop contains zero telemetry, zero analytics scripts, and zero cloud relays. Connections travel directly from your client machine to your server via standard port 22 with end-to-end encryption.
2. OS-Native Credential Enclaves
Private keys and passphrases are never stored in plaintext JSON. On Windows, credentials are encrypted via DPAPI and Windows Credential Manager; on macOS, via the Apple Keychain Secure Enclave; on Linux, via libsecret.
3. Modern Cryptographic Ciphers
Strict cipher suites supporting Curve25519 / Ed25519, ChaCha20-Poly1305, and AES-256-GCM. Deprecated and broken legacy ciphers (such as DSA, DES, and SHA-1) are blocked by default.
4. FIDO2 / YubiKey Hardware Keys
Native support for hardware-bound security keys (sk-ssh-ed25519@openssh.com). Protect critical production servers with physical biometric or touch confirmation prompts.
SSH Desktop vs Cloud-Based SSH Clients
Why enterprise security compliance teams forbid cloud-synced SSH managers.
| Security Dimension | SSH Desktop | Proprietary Cloud SSH Apps |
|---|---|---|
| Private Key Storage | 100% Local (OS Keychain) | Synced to Third-Party Cloud |
| Telemetry & Usage Tracking | Zero Trackers / Zero Pings | Analytics & User Fingerprinting |
| Connection Routing | Direct Peer-to-Peer SSH2 | Routed through Cloud Relays |
| Source Code Availability | Auditable Open Source | Closed Proprietary Source |
| Subpoena / Data Leak Risk | Zero (No Cloud Data Exists) | Vulnerable to Cloud Breaches |
Security Audits & Bug Bounty
We welcome independent security audits and practice transparent, responsible disclosure. If you identify a potential security vulnerability, review our RFC 9116 compliant security policy at security.txt.