OmniSSH Logo
OmniSSHv1.7.0
v1.7.0Dataset Sync Clarity

The Modern, Privacy-First Desktop Workspace for SSH & Cloud.

Supercharge your infrastructure operations with pure Rust performance. Features GPU-accelerated terminal multiplexing, real-time OSC 7 linked directory tracking, self-hosted encrypted dataset sync, docked host monitoring plugins, dual-pane SFTP/SCP transfers, and universal session import — all sealed inside your native OS keychain.

Download for FreemacOS • Windows • LinuxTry Live SimulatorGitHub
$git clone https://github.com/lefos13/omniSSH.git
Tauri v2 + Rust
<50MB RAM & WebGL
OSC 7 CWD Sync
Auto-follows remote `cd`
Host Plugins Dock
Docker, PM2 & Metrics
Encrypted Sync
Zero Cloud · Self-Hosted
OmniSSH Unified Workspace with Terminal, OSC 7 Linked Explorer, and Host Plugins Dock
Unified Workspace
Interactive Live Simulation

Try OmniSSH in Your Browser

Experience how the WebGL Terminal, OSC 7 Linked Explorer, and live Host Plugins Dock work in unison. Click folders, preview files, or execute commands.

OSC 7 Linked CWD: /home/deploy
Terminal 1 (xterm.js WebGL)
pty-chan-0 • utf-8
OmniSSH WebGL Terminal v1.6.0 — Connected to deploy@prod-bastion-01 (SSHv2 / Ed25519)
⚡ OSC 7 Hook detected & linked: Terminal shell working directory synchronized with Docked Explorer
Type 'help' or click directory folders / preset buttons below to test live features.
bastion:deploy$
Linked Explorer
OSC 7 Active
//
.. (parent directory)
apps
4.0 KB
.ssh
4.0 KB
docker-compose.yml
1.4 KB
deploy.sh
840 B
.bashrc
3.7 KB
README.md
2.1 KB
6 itemsClick to open/cat
Host Plugins Dock
Polling (5s)
CPU Load24%
Memory (RAM)62%
Docker Containers3 Healthy
nginx:alpine
80:80, 443:443
healthy
postgres:16
5432:5432
healthy
redis:7.2
6379:6379
healthy
systemd servicesssh, nginx (active)
State-changing actions enforce OmniSSH verified execution confirmation.
Comprehensive Workspace Features

Engineered for Modern DevOps & Sysadmins

Every tool you need to manage remote servers, containers, filesystems, and cloud storage in a single, beautifully crafted native desktop app.

New in v1.6.0

Self-Hosted Encrypted Dataset Synchronization

End-to-end encrypted sync over your own SSH servers with zero cloud dependency.

Keep hosts, groups, snippets, tunnels, S3 connections, host plugins, and app preferences perfectly synchronized across multiple machines. Unlike cloud-dependent terminal clients, OmniSSH publishes datasets as sealed AES-256-GCM containers directly to an SSH server you own. Key material never leaves your devices.

Key Capabilities
100% Self-Hosted & Zero-Cloud: directory on any SSH server you own
Two-level encryption: Argon2id key derivation + AES-256-GCM sealed record documents
Owner / Member roles: ed25519 digital signatures with pinned SHA-256 fingerprints
Generation history & non-destructive rollback: undo bad publishes safely
Three-way merge with conflict log: preserves local edits without silent data loss
Granular content scoping: sync all hosts or explicit groups; optional credential inclusion
Managed hosts UI: visual status badges, editor field locks, and detach opt-out
Engineering Invariant
• Zero telemetry, no accounts, no cloud keys — pure client-side cryptography
• Atomic rename locking with 60s timeout prevents half-written remote bundles
• Factory reset clears local keys without publishing wipes or tombstones
Settings ▸ Dataset Sync
infra-core-datasetOwner (Signed ed25519)Generation 4
deploy@bastion.internal:22/var/sync/datasets/infra-core
Sync StatusClean · No local conflicts
Owner Pine3b0c44298fc1c149afb...
ScopeAll Hosts (14 resolved)
Synchronized Content KindsClick to toggle mock payload
Three-way record merge: Changes made on this computer merge cleanly with server updates. If both edit the exact same host, the newest timestamp wins and the older copy is logged in your local conflict log rather than silently lost.
Local Sync Client ID: client-macbook-pro-m3
Atomic Rename Locking·Zero Cloud Dependency
Transparent Benchmark

How OmniSSH Compares

See how OmniSSH stacks up against legacy terminal emulators and cloud-locked clients. Built with modern architecture, no proprietary paywalls, and total privacy.

Swipe horizontally to compare all 6 desktop tools
Feature / Capability
OmniSSH
TermiusWinSCPMobaXtermPuTTYCyberduck
SSH Terminal Engine
WebGL provides 60fps rendering without UI thread blocking.
Yes (WebGL GPU)YesYes (X11)Yes
Linked Terminal File Explorer
Follows your shell 'cd' automatically in real time.
Yes (OSC 7 CWD Sync)Yes
Host Monitoring Plugins Dock
Docked alongside terminal with safe confirmation modals.
Yes (Docker, PM2, Health)
Dual-Pane Host File Manager
Side-by-side tree browsing and keyboard shortcuts.
Yes (Local & Remote)YesYes
Direct Server-to-Server Streaming
Relays bytes directly between two servers without saving locally.
Yes (Zero Local Disk)
SFTP & SCP Multi-Tab Browser
S3 Cloud Storage Browser
Built-in presigned download URL generation.
Yes (AWS, MinIO, R2, B2)Yes (AWS S3 only)
Split Panes (Across Different Hosts)
OmniSSH allows splitting against separate hosts with broadcast input sync.
Yes (Multi-Host + Sync)Yes (Single Host)Yes
Universal Connection Importer
Decrypts local Termius LevelDB database 100% offline, with bulk password file imports.
Yes (OpenSSH, MobaXterm, Termius)
SSH Port Forwarding Rules
Yes (Presets)
Command Snippets & Variables
Yes ({{variable}} prompts)YesYes
Cross-Platform Support
macOS, Windows, LinuxmacOS, Windows, LinuxWindows onlyWindows onlyWindows onlymacOS & Windows
Zero Cloud, 100% Offline
No account required, no remote servers, works air-gapped.
No (Cloud Sync)
Open Source License
Yes (MIT)No (Proprietary)Yes (GPL)No (Freemium)Yes (MIT)Yes (GPL)
Credential Storage Vault
Native OS KeychainCloud AccountRegistry / PlainINI / RegistryWindows RegistryOS Keychain
Self-Hosted Encrypted Dataset Sync
Zero-cloud E2E encrypted sync published to your own SSH/SFTP server.
Yes (Argon2id + AES-GCM)Cloud Account Only
Dataset Rollback & Generation History
Revert accidental changes safely by publishing a new rolled-back generation.
Yes (10 Generations)
Dataset-Managed Scoping & Field Locks
Scope by all, groups, or specific hosts with read-only member protection.
Yes (Lock & Detach)
Native Performance

Unlike Electron apps that consume gigabytes of memory, OmniSSH's Tauri v2 + Rust architecture uses ~45MB RAM with sub-second launch times.

No Cloud Accounts

Your server keys and configurations are never stored in third-party clouds or synced to external servers. Zero telemetry, zero tracking.

100% Free & Open Source

Licensed under MIT. No premium subscriptions, no artificial connection limits, and no crippled trial tiers.

Engineered For Performance

Pure Rust & Tauri v2 Architecture

A strict separation between a fast, memory-safe Rust backend and a reactive TypeScript / React user interface with typed IPC events.

React 19 & TypeScript Frontend

Client Runtime
xterm.js + WebGL
GPU terminal renderer
Zustand Stores
Reactive app state
Tailwind CSS v4
Fluid layouts & themes
HTML5 Drag & Drop
Dual-pane transfers
Tauri v2 IPC (Typed Channels)

Rust Backend (Tauri v2 Core)

Native Rust
SSH & Shell Multiplexing
Powered by pure-Rust russh with asynchronous PTY allocation and multi-channel multiplexing.
SFTP / SCP Transport
Worker pools using russh-sftp with stream relay for direct server-to-server transfers.
S3 Cloud Driver
High throughput asynchronous object store driver via rust-s3 on Tokio runtime.
Universal Importers
OpenSSH config, MobaXterm .ini parser, offline Termius LevelDB XSalsa20-Poly1305 decryption, and bulk password file import.
SQLite Persistence
Local embedded rusqlite with atomic transactions and rollback safety.
Encrypted Sync Engine
Argon2id key derivation, AES-256-GCM container sealing, ed25519 digital signatures, and optimistic concurrency locks.
Native OS Keychain Vault
macOS Keychain, Windows Credential Manager, Linux Kernel Session Keyring (keyutils) with memory zeroization.
~45 MB
Idle RAM Footprint
vs 350MB+ on Electron apps
< 180 ms
Application Startup
Instant native desktop launch
~15 MB
Binary Package Size
No bundled Chromium runtime
Privacy By Design

Your Infrastructure. Zero Cloud Leaks.

Most modern terminal apps want you to create an account and sync your SSH keys to their proprietary servers. OmniSSH takes the opposite approach: zero accounts, zero cloud intermediaries, and self-hosted end-to-end encrypted dataset sync on servers you control.

Native OS Keychain Storage

Credentials, private keys, and passphrases are stored strictly in your operating system's native secure vault: Apple Keychain (macOS), Windows Credential Manager (Win32), and Linux Kernel Session Keyring (keyutils).

Self-Hosted Encrypted Sync

Publish datasets to an SSH server you control. Sealed client-side with AES-256-GCM encryption, keyed via Argon2id from a per-dataset passphrase, and signed by an ed25519 owner key. Remote server operators cannot inspect your hosts.

Encrypted App Vault (AES-256-GCM)

Prefer an isolated password store? Enable the App Vault with master-password protection using AES-256-GCM encryption and Argon2id key derivation. Passwords can be temporarily revealed with an eye toggle only after master verification.

Absolute Zero Telemetry

No analytics. No crash report telemetry pings. No usage counters. No remote user accounts. OmniSSH does not contain a single outbound analytics script or third-party tracking pixel.

RAM Zeroization & Memory Safety

Sensitive plaintext keys and secrets are explicitly zeroized in memory immediately following the SSH authentication handshake, preventing memory inspection attacks and core dump leaks.

Verified Action Invariant

State-changing actions initiated from the Host Plugins Dock (Docker stop, PM2 restart, pod deletion) prompt a strict verification modal showing the exact interpolated command string before execution.

Open Source Auditability (MIT)
Every line of Rust and TypeScript code is publicly auditable on GitHub.
Review Source Code
Release Evolution

What's New in OmniSSH

Actively developed with rapid enhancements, rock-solid stability, and community-driven features.

v1.7.0Latest Stable Release
October 6, 2026

Dataset Sync Clarity

•Clearer Connection Test: Testing a sync server now shows the full path the dataset will live at, and — when the path does not exist yet — which existing folder the write check ran in, so a "cannot write" answer is never a mystery
•Home Folder Hint: A path starting with "/" begins at the server's root, not your home folder. When such a path is not writable and lies outside your home, OmniSSH now suggests the home-relative path you most likely meant
•No Stale Warnings: The "no dataset is published yet" notice disappears once the dataset has been pushed or pulled
Cross-Platform Distribution

Download OmniSSH

Free, open-source, and natively compiled for macOS, Windows, and Linux. No account or signup required.

macOS 11.0+

macOS

Native universal binaries for Apple Silicon (M1/M2/M3/M4) and Intel processors.

Apple Silicon (.dmg)Intel x64 (.dmg)
macOS Gatekeeper Hint

If macOS blocks first launch, run:

xattr -cr /Applications/OmniSSH.app
Windows 10 / 11

Windows

Fast, self-contained Windows installers with native Credential Manager integration.

Windows Installer (.msi)Standalone Executable (.exe)
Secure Credential Storage

Integrates with Windows DPAPI and Credential Manager for encrypted local storage.

Linux x64

Linux

Universal AppImage or Debian/Ubuntu deb packages with Linux Kernel Session Keyring (keyutils).

Universal (.AppImage)Debian / Ubuntu (.deb)
Kernel Session Keyring

Backed by the Linux Kernel Session Keyring (keyutils) for direct kernel credential storage without desktop daemon dependencies.

Frequently Asked Questions

Got Questions? We Have Answers.

Technical details on protocols, privacy guarantees, and open-source foundations.

OSC 7 (Operating System Command 7) is an open ANSI terminal escape standard supported by modern shells (Bash, Zsh, Fish). When you change directories (using 'cd' or scripts), the shell emits a lightweight escape sequence with the current working directory URI. OmniSSH's terminal captures this notification and immediately commands the side-docked remote file explorer to navigate to that directory — completely eliminating the need to manually browse or refresh.