Encrypted SSH vault & profiles
One local file. Argon2id + AES-256-GCM. Switch between isolated Work, Personal, and Client vault profiles.
Local SSH manager
iLead, local SSH manager & encrypted vault
Your hosts stay home. Nothing in the cloud. Everything on your machine.
iLead is a native SSH client and SSH manager for macOS, Windows, and Linux. Hosts, keys, SFTP, S3 storage, Database Studio, tunnels, notes, fleet SSH, and a local MCP bridge for AI agents live in one encrypted vault on your machine, not ours. No cloud account. No telemetry. A yearly seat only unlocks the app on the devices you paid for.
SSH features
What this SSH manager actually ships
Database Studio
Postgres, MySQL, MariaDB, SQL Server, Oracle, SQLite, CockroachDB, MongoDB, Cassandra, and Redis, query, browse schemas, edit rows, and dump data without a second app.
Visual multi-hop bastion chaining
Chain multiple jumps (Local → Bastion → Target) with interactive topology flow and auto-synthesized ProxyJump.
Dynamic smart groups & drag order
Tag-based smart groups (#prod, #db) with multi-tag filtering, plus native drag-and-drop server arrangement.
S3 object storage alongside SFTP
Direct AWS S3, Wasabi, MinIO, and Cloudflare R2 browser with multipart uploads right next to remote Linux SFTP.
Cloud auto-discovery & fleet sync
Auto-sync virtual machines from AWS EC2, Hetzner Cloud, and DigitalOcean using read-only tokens with live status.
Live tunnel traffic telemetry
Real-time upload and download throughput (▲/▼), cumulative byte counters, and open sockets on every tunnel.
Embedded RDP & VNC viewer
Connect to Windows RDP and Linux/macOS VNC inside terminal tabs with keyboard/mouse capture and latency metrics.
NeoServer, Termius, Ansible import
Import NeoServer (iCloud/backup), Termius, Tabby, MobaXterm, PuTTY, WinSCP, CSV spreadsheets, and Ansible inventories.
In-terminal Ctrl+R & regex triggers
Fuzzy-search executed command history and audit logs. Match stream patterns to trigger desktop notifications and chimes.
Masked private keys & master password
Private keys render masked on first paint; 👁 Reveal requires vault master password verification with auto-remask.
Fleet SSH, playbooks & containers
Run commands or playbooks on many hosts. Pull log snapshots. Start, stop, and inspect Docker/K8s containers.
Server INFO on connect
Fresh SSH sessions show OS, IP, uptime, CPU, memory, and disk in a short banner, no script clutter in your history.
MCP for Cursor, Claude & Copilot
A loopback-only Model Context Protocol bridge lets local AI clients list allowed hosts and run commands you approve, SSH credentials never leave the vault. MCP setup guide
Apple silicon SSH, Windows, Linux
Native client on Apple silicon, Intel Mac, Windows, and Linux. No Rosetta tax. Offline after you cancel.
Why iLead wins
The SSH client that beats the usual pile
Better than PuTTY or Terminal.app alone
Those open a session. iLead is the vault around the session: inventory, encrypted notes, SSH keys, and a backup you can take to another machine.
Better than a cloud SSH suite
Termius-style clouds want an account and a copy of your hosts. iLead is a local SSH manager. You pay for a seat. The data stays on disk you control.
Better than a folder of scripts
Health dots, fleet SSH, playbooks, and log snapshots are already in the app. You do not glue five tools every Monday.
Full comparison · PuTTY alternative · Termius alternative · MobaXterm alternative · SSH client for Windows · SFTP client
Guides
From the iLead blog
- SSH MCP for Cursor and ClaudeHow a local SSH MCP bridge lets Cursor or Claude Code run approved commands while credentials stay in an encrypted vault, loopback only, no cloud relay.
- Best PuTTY alternative 2026: local vaultWhat to look for in a PuTTY alternative in 2026: encrypted local vault, imports, SFTP, fleet Ops, and optional AI MCP, without uploading your host list.
- What is a local-first SSH manager?A local-first SSH manager keeps hosts and keys in an encrypted vault on your disk. Learn how that differs from cloud SSH suites and plain session files.
- Import PuTTY and MobaXterm into a local vaultStep-by-step guidance for migrating PuTTY, MobaXterm, WinSCP, and ~/.ssh/config into one encrypted local vault without a cloud account.
Quick answers
Questions people ask before they switch
What is the best PuTTY alternative in 2026?
If you need only one disposable Windows session, PuTTY is fine. If you want a cross-platform encrypted inventory, SFTP, fleet Ops, and optional SSH MCP without a cloud host list, use a local-first manager such as iLead. See https://ileadapp.org/alternatives. Read more
What is a local-first SSH manager?
A local-first SSH manager keeps hosts, keys, notes, and tunnels in an encrypted vault file on your disk. A seat unlocks features; it does not require uploading your fleet to a vendor cloud. See https://ileadapp.org/blog/what-is-a-local-first-ssh-manager. Read more
How can Cursor or Claude Code use SSH safely?
Use a loopback SSH MCP bridge over an encrypted vault with a human Approve dialog on every command. iLead ships this under Settings → Agent Access. Credentials never leave the vault. See https://ileadapp.org/mcp. Read more
Can I import PuTTY and MobaXterm sessions without a cloud account?
Yes. Import PuTTY, MobaXterm, WinSCP, and ~/.ssh/config into one local encrypted vault, then verify host keys on first connect. Guide: https://ileadapp.org/blog/import-putty-mobaxterm-to-encrypted-vault. Read more
Does iLead sync hosts through a vendor cloud?
No. Sync merges vault snapshots through a folder you already use (iCloud Drive, Dropbox, OneDrive, NAS). There is no iLead cloud copy of your host list. Read more
Is there a Termius alternative without cloud sync?
Yes. iLead keeps hosts in a local encrypted vault and syncs through a folder you control. See https://ileadapp.org/alternatives/termius. Read more
What is a good SSH client for Windows 11?
PuTTY is fine for one session. For a vault, SFTP, and fleet tools on Windows 10/11, use a local SSH manager such as iLead. See https://ileadapp.org/ssh-client-windows. Read more
Solo
$14.99/year
1 device
- Full SSH manager + Studio + Arcana
- Encrypted vault + backup
- 7-day trial, then this seat
Most used
Duo
$25.99/year
2 devices
- Home + work SSH client
- Same vault file, two seats
- Move a seat when you retire a machine
Squad
$49.99/year
Up to 5 devices
- Small desk, not a fleet portal
- Strict device bind
- Code emailed after pay
1. Pay
Card on Paddle. No iLead account. This is a yearly SSH license, not a cloud login.
2. Mail
We send a one-line activation code to that email.
3. Bind
iLead → License. Email + code. That machine takes one seat of the SSH manager.
Behind the wand
Arcana community
A thinner room, behind the ordinary SSH desk. Language is older than commands here. Find the wand in iLead. Speak only what is already true. Then share the word on the community board.
The official site does not dump a list. Casters post their own findings. Email and Cloudflare Turnstile required.
Enter the room
Casters post findings on the board. Bring a seat.