SFTP with two panes
Drag files to upload and resume transfers after a disconnect. Transfer between servers through your computer, archive directories and extract files remotely.
Our goal is to build
A better SSH client.
A fully open-source client, for peace of mind.
Terminal, SFTP, server monitoring and AI — ALL IN ONE.
Free desktop client. Connect to any AI model.
Windows x64
macOS: not released yet
Linux: no build yet
8hops
ProxyJump chains, host key checked at every hop210krounds
PBKDF2 key derivation, on your device256bit
AES-GCM, encrypted before upload0reports
No telemetry, analytics or crash reportsProduct tour
See it in action
Every screenshot and recording below comes from the desktop client, running against demo servers.
Analyze problems and review actions
AI analyzes problems using terminal output. Commands that require approval are shown with their risks and wait for your confirmation.
Demo data · addresses from documentation ranges
Features
Your tools, alongside your connection
Open a host to use the terminal, manage files, check server status or ask AI for help with troubleshooting.
Jump hosts, several hops deep
Connect through up to eight ProxyJump hosts, with separate authentication and host-key checks at each hop.
tmux and screen sessions
Use tmux or screen on your server to keep sessions running. Previous terminal output remains available to read and copy during reconnection.
Ask AI about an error
Analyze problems using terminal output and get suggestions and commands. Use your own API key or a local model. High-risk actions require your approval.
Local, remote and SOCKS5 forwarding
Local, remote and SOCKS5 forwarding are supported. Save forwarding settings with each host and reuse them on your next connection.
Telnet, serial and a local shell too
Open SSH, Telnet, serial connections and local terminals in the same window.
Security
Sync data to the cloud. Keep keys on your devices.
Sync data is encrypted on your device before upload. The cloud stores ciphertext; decryption happens on your devices, and the cloud service does not hold the decryption keys.
On your device
Master passwordonly you know it
Key derivationPBKDF2-SHA256
Sync keynever uploaded
Encrypt vaultAES-256-GCM
Hosts, passwords and private keys are encrypted here, before anything is uploaded.
Orbit CloudPro · Team
Stores encrypted backups and version numbers without holding the decryption keys.
Host keys checked on every hop
Records host fingerprints on first connection. If a known host key changes, the connection stops and identifies the affected hop.
Second password and decoy vault
Set a second password to open a separate decoy vault. You can also configure it to delete real data at the same time; enable this option with care.
Read-only teammates can't see passwords
Keys are wrapped separately for each team member. Read-only members do not receive credential keys and cannot decrypt passwords.
Local app lock
Local data is encrypted with an Argon2id-derived key. The master key is stored in the system credential manager.
Your connections don't go through us
SSH connections go directly from your computer to your server, without passing through Orbit Cloud.
Signed updates
Update signatures are verified before installation. Read the release notes and confirm when you want to install.
Vault and sync encryptionAES-256-GCM
Sync and sign-in key derivationPBKDF2-SHA256 · 210k
App lockArgon2id
Team key envelopesX25519 · HKDF
SSH implementationrussh (Rust)
Host keysTOFU · known_hosts
Account sign-inTOTP · YubiKey OTP
Update signaturesOffline key · minisign
Why OrbitSSH
Why choose OrbitSSH
Free to use, open source, with support for your own AI.
Free to use
The desktop client is free forever. Use SSH, file transfers and server monitoring without creating an account.
Open source
The client is open source under GPL-3.0. Read the code to see how credentials are stored and connections are established.
AI on your terms
Use your own API key or connect a local model. Choose the model and endpoint yourself.
Start without an account
Local features work without an account. Use Pro for cross-device sync, or Team to share host configurations.
FAQ
Frequently asked questions
Which features need a paid plan?
Cloud sync and the second password need Pro or Team, and team sharing needs Team. Everything else works without an account: the terminal, SFTP, jump hosts, port forwarding, the AI assistant with your own key and the app lock.
What if I forget my master password?
If you generated a recovery code, use it to reset your password and recover your data. Without one, we cannot decrypt your cloud backup either. Keep the code in a separate safe place.
Does the AI agent run commands on its own?
Read-only checks run directly. Confirm mode asks before making changes; read-only mode makes none; automatic mode can perform low- and medium-risk actions. High-risk actions require approval in every mode.
Can I use my own sync server?
Not currently. The sync server address is built into the client and cannot be changed. Sync data is encrypted on your device before upload.
Which platforms are supported?
Windows x64 for now. macOS builds exist but haven't been released, there's no Linux build, and there are no mobile apps.
Is everything open source?
The desktop client is open source under GPL-3.0 at github.com/orbitssh/orbitssh. The cloud service code is not included in that repository.
Download OrbitSSH
Available for Windows x64. Download the client to connect to your servers.
Checking for the latest release…
Windows x64
macOS: not released yet
Linux: no build yet