Terminal with tabs and splits
SwiftTerm engine, xterm-compatible: unlimited tabs, horizontal and vertical panes, scrollback search, your font, color palettes, renameable tabs and per-host colors so production looks like production.
Native SSH client for Mac · Free core, then yearly or one-time
Every server you run,in one native SSH console.
Tabbed and split terminal, saved hosts with keys and 2FA, multi-hop bastions, port forwarding and SFTP on the very same connection. Written in Swift and SwiftNIO — no Electron, no account, no telemetry.
Version 1.0 · see what’s new
- Terminal, tunnels and SFTP over one connection
- Keys, 2FA and host key checks free forever
- Native for macOS 15 — App Sandbox and Keychain
A complete SSH workstation
SSHSFTPSOCKS5Swift & SwiftNIOKeychainApp Sandbox
∞saved hosts, sessions and tabs
0accounts, trackers, telemetry
3tunnel types: local, remote, SOCKS5
8bastion hops in a single chain
Connectivity
Everything an SSH session needs, in one window
Hosts, terminal, tunnels and files in a single app — with the authentication your servers actually ask for, from private keys to one-time codes.
Tunnels and bastions
Local (-L), remote (-R) and dynamic SOCKS5 (-D) forwarding with a live rules panel, plus ProxyJump chains up to 8 hops — each hop authenticated and host-key-verified on its own.
SFTP on the same session
Browse, upload, download, rename and set permissions with a visual chmod grid, preview remote files with Quick Look, and follow a transfer queue you can pause and resume — all on the SSH connection you already opened.
Passwords and passphrases live in the macOS Keychain. Private keys never leave your Mac. Every host key is pinned on first use (TOFU) and a change stops the connection.
Built for remote ops
A full remote-ops console, without the ceremony
Multi-tab terminal with splits, host and key manager, tunnel panel, bastion chains, saved snippets and a visual file browser.
Tabs & Splits
Organize your screens with tabs and splits
Open as many terminal tabs as you need and split them horizontally or vertically. The geometry is yours: split fractions stay exactly where you drag them, even when a session connects, and a colored bar under each tab tells you which environment you are on.
- Horizontal and vertical splits in any view
- Environment colors under the tabs (red for production)
- Pane proportions that never jump on connect
- Rename tabs on the fly, close others or those to the right
Bastion Routing FULL
ProxyJump through multiple bastions
Reach internal hosts through multiple SSH jump servers. Up to 8 hops supported natively, resolving inline usernames and ports. Credentials for each hop authenticate separately, and host key fingerprints are verified end-to-end for every single hop.
- Imports ProxyJump configurations from ssh config
- Authenticates each hop in the chain separately
- Host key verification (TOFU) per endpoint
Agent forwarding FULL
Secure in-process SSH Agent
Enabling agent forwarding should not be a security risk. Upshell runs a private, in-process agent that only signs inside the app. Your private keys never leave your Mac, the agent is gated per host — never globally — and only the last hop of a jump chain can ever ask for a signature.
- Private keys stay safe in the Keychain
- Agent is gated per host, never enabled globally
- Read-only: listing and signing, nothing else
Files · free
Co-session SFTP & file management
Open a visual file browser next to your terminal session. Drag files in to upload, download with progress, preview with Quick Look, and change permissions with a visual chmod grid — all on the same connection, with zero secondary logins.
- Zero secondary logins — the same SSH connection as the shell
- Transfer queue with progress, pause, resume and cancel
- Octal chmod editor and remote Quick Look with the spacebar
Command palette · free
Jump to anything with the ⌘K palette
Press ⌘K, type a few letters, and fuzzy search finds your saved hosts, snippets, active forwards or settings. Arrow keys and Escape are captured before the shell sees them, so you can run any action without touching the mouse.
- Fuzzy matching for hosts, snippets and actions
- Saved snippets, on the focused session or many hosts at once
- Free in the base version, like the whole security layer
More inside
Packed with thoughtful details
Dozens of small decisions that add up to a client you actually enjoy using.
Keychain security
Passwords and passphrases live in the macOS Keychain, never in plain text on disk.
Quick Look
Preview a remote file with the spacebar — no download, no detour.
2FA and one-time codes
Full keyboard-interactive support, multi-round challenges included.
Server dashboard
Hosts, tags, open sessions, last connection and recent activity — real numbers only, no invented metrics.
Automatic reconnection
A dropped network comes back on its own — and never retries after a rejected password or a changed host key.
Instant search
Filter hosts, files and scrollback as you type, and reach any of them from ⌘K.
Errors you can act on
Refused, DNS, timeout, unreachable: Upshell names the cause and what to check, keeping the technical text one click away.
Menu bar access
Your hosts sit in the menu bar. One click connects and brings the window forward.
Built-in key manager
Generate ed25519 keys, import ECDSA and encrypted keys, and keep every passphrase in the Keychain.
Import from ssh config FULL
Hosts, ports, users, ProxyJump and tunnels come across — with a preview of the plan before anything is written.
Port forwarding FULL
Local, remote and dynamic SOCKS5 tunnels, with a panel showing every active rule.
Split panes FULL
Two or more terminals side by side in one tab, with proportions that stay exactly where you drag them.
Saved snippets FULL
Store the commands you retype and run them in the focused session — globally or only on the hosts you choose.
Session history FULL
Every session recorded with duration, bytes and outcome — and never a line of terminal output inside it.
iCloud sync FULL
Hosts and snippets follow you across your Macs via CloudKit, credentials via iCloud Keychain.
Per-host colors FULL
Give production its own palette and tab color, so you see where you are before you press Enter.
Jump host (bastion) FULL
Reach machines that only answer through a bastion, up to 8 hops, each one verified separately.
Trust by design
Security is not for sale
Connecting, authenticating and verifying host keys are free and will stay free. Upshell runs inside Apple's App Sandbox and treats your servers and credentials the way a native Mac app should.
App Sandbox & Keychain
The app is fully sandboxed per Apple's guidelines, and every password lives in the system Keychain — never in plain text.
Identity verification
Host keys are pinned on first use in a known-hosts store. If a fingerprint changes, Upshell stops and blocks the connection to protect you from MITM — and never retries it automatically.
No accounts, no tracking
There's no Upshell login, no telemetry, and no analytics harvesting your activity. Your hosts, keys and files are yours.
Private keys stay put
ed25519 and ECDSA keys — encrypted ones included — are read locally and used only to sign an authentication. They are never uploaded, copied or shared, and the built-in agent signs inside the app.
Who it's for
One console, every workflow
From managing production clusters to homelab tinkering, Upshell fits the way you work.
Sysadmins & DevOps
Manage fleets of servers, ProxyJump through bastions, run snippets on many hosts, and keep port forwards under control.
Web developers
Open tabs and splits, tail logs and deploy, and browse or upload remote files over SFTP on the same connection.
Homelab & Raspberry Pi
Save credentials securely in the Keychain, import your ssh config, and connect with a single click.
Agencies & freelancers
Organize saved hosts with tags and environment colors, and sync them across all your Macs through iCloud.
Switching over?
Bring every server with you in seconds
Coming from another client or from the raw terminal? Upshell imports your whole server list so you don't retype a single host, port or username.
1
Point Upshell at your ~/.ssh/config.
2
Review the import plan line by line — created, updated, duplicate or skipped, with the reason. Nothing is written before you confirm.
3
Add passwords to the Keychain or pick your SSH private key, and you're connected.
Free vs FULL
Powerful for free. Unstoppable with FULL.
Connecting, authenticating and verifying host keys are always free. FULL adds the productivity layer on top — yearly subscription or a one-time purchase.
| Feature | Free | FULL |
|---|---|---|
| Unlimited hosts, sessions and tabs | ✓ | ✓ |
| Full authentication: password, ed25519 and ECDSA keys, 2FA, host key verification (TOFU) | ✓ | ✓ |
| Co-session SFTP, ⌘K palette, automatic reconnection, Keychain and App Sandbox | ✓ | ✓ |
| Split panes (terminals side by side) | — | ✓ |
| Port forwarding: local, remote, SOCKS5 | — | ✓ |
| ProxyJump bastion chains (up to 8 hops) | — | ✓ |
| Agent forwarding, per host | — | ✓ |
| Saved snippets, on one host or many at once | — | ✓ |
| Session history | — | ✓ |
| ssh config import | — | ✓ |
| iCloud sync (CloudKit and Keychain) | — | ✓ |
| Per-host terminal colors | — | ✓ |
See it in action
A closer look
Pricing
Choose your plan. Own it forever.
No forced subscriptions. Flexible plans. A free core that stays free.
Upshell Free
Free
Connect as much as you want, as securely as you want.
- Unlimited hosts, sessions and tabs
- SFTP browser, transfers and permissions
- Keys, 2FA, host key verification, Keychain and Sandbox
- ⌘K palette, terminal palettes and 5 languages
Best Value
FULL Annual
$9.99/ year
*US price. Every other App Store shows the equivalent local tier, VAT included where it applies.
Every FULL feature, billed once a year.
- Split panes with locked proportions
- Bastion chains (ProxyJump) and agent forwarding
- Port forwarding: local, remote and SOCKS5
- Snippets on many hosts, session history, ssh config import, iCloud, per-host colors
FULL Lifetime
$39.99once
*US price. Every other App Store shows the equivalent local tier, VAT included where it applies.
One-time purchase, own it forever.
- Split panes with locked proportions
- Bastion chains (ProxyJump) and agent forwarding
- Port forwarding: local, remote and SOCKS5
- Snippets on many hosts, session history, ssh config import, iCloud, per-host colors
All paid plans support Family Sharing. You can restore purchases on any of your Macs.
Guides
Answers to the SSH details
Practical write-ups on the problems remote servers and bastions throw at you — useful whichever client you use.
The ~/.ssh/config file
What goes in ~/.ssh/config on macOS, the first-match-wins rule that trips everybody up, and the handful of options worth setting — keepalives, Keychain passphrases, connection reuse and Include.
Read guide →SFTP vs SCP vs rsync
Why scp is no longer recommended and what changed in OpenSSH 9, what SFTP does that scp cannot, when rsync is the only sensible answer, and how they all relate to plain SSH.
Read guide →SSH Keys & Keychain
How to generate an ed25519 key, install it on your server, and use it for SSH and SFTP from a Mac client — including what App Sandbox means for reading ~/.ssh and how passphrases are handled.
Read guide →SSH Port Forwarding & Tunnels
How to configure local (-L), remote (-R), and dynamic (-D) SOCKS5 port forwarding on macOS, and manage tunnels through a visual client instead of the terminal.
Read guide →FAQ
Good questions, clear answers
What is Upshell, in one line?
A native SSH client for Mac: manage your saved hosts, open sessions in tabs and split panes, jump through bastions, open tunnels and browse remote files over SFTP — all on the same connection and inside Apple's App Sandbox.
What can I do without paying?
Connect as much as you like: unlimited hosts, sessions and tabs, password, key (ed25519 and ECDSA) and two-factor authentication, host key verification (TOFU), SFTP with transfers and permissions, the ⌘K palette and automatic reconnection. Security never ends up behind the paywall — it's an invariant checked by a test on every build.
What does Upshell FULL add?
The productivity layer on top of the connection: split panes, local/remote/SOCKS5 port forwarding, ProxyJump chains through bastions, per-host agent forwarding, saved snippets you can run on many machines at once, session history, ~/.ssh/config import, iCloud sync and per-host colors.
How does the pricing work?
Two ways to unlock FULL: an annual subscription at $9.99/year, or a one-time lifetime purchase at $39.99 (US prices; every other App Store shows the equivalent local tier). Both support Apple Family Sharing and can be restored on any of your Macs.
Does it support RSA keys?
Not yet: key authentication currently uses ed25519 and ECDSA (P-256, P-384, P-521), encrypted keys included. If all you have is an id_rsa, you can generate an ed25519 key from the built-in key manager and add it to your server.
Can I use it as my local terminal instead of iTerm2?
No. Upshell opens remote sessions; your local shell stays where it is (Terminal.app, iTerm2, Ghostty). Upshell is where your hosts, keys, tunnels and remote files live.
Where are my keys and passwords stored?
In the macOS Keychain. Private keys never leave your Mac: the built-in agent signs inside the app, read-only, and grants a remote server nothing but a signature. No Upshell account, no telemetry, no backend of ours.