A local-first SSH manager is a desktop SSH client that treats your host inventory as a private file on your machine, not a workspace in someone else's cloud. Sessions still speak ordinary OpenSSH-compatible SSH (RFC 4251). What changes is where labels, keys, notes, and tunnels live when you are offline.
What is a local-first SSH manager?
It is an SSH client plus an inventory: hosts, credentials, SFTP bookmarks, tunnels, snippets, and notes sealed in one encrypted vault file. You unlock with a master password. There is no product account that must hold a copy of your fleet for the app to work. A yearly seat may unlock features; it does not upload hosts.
Where should SSH credentials be stored?
Prefer a sealed local store over a plaintext session list or a shared SaaS directory. iLead derives a key with Argon2id (RFC 9106) and seals data with AES-256-GCM in ~/.ilead/vault.bin (or %USERPROFILE%\.ilead\vault.bin on Windows). A locked vault cannot list hosts. NIST SP 800-63B still applies to how you choose the master password, iLead is not NIST-certified; the link is for threat-model comparison.
How does sync work without a vendor cloud?
Point two devices at a folder you already use, iCloud Drive, Dropbox, OneDrive, or a NAS, and merge the vault snapshots there. Sync rides on infrastructure you already trust. There is no separate iLead sync account and no relay that sees your host list. Contrast that with suites that require a login before two laptops share sessions.
Is a cloud SSH manager safer than a local vault?
Cloud sync can be convenient and well engineered, but it expands the trust boundary: the vendor, their staff access model, and their breach surface sit between you and your inventory. A local vault shrinks that surface to your disk encryption, your master password, and your backup habits. Neither model removes the need for good host-key verification and least-privilege SSH keys, those are protocol and ops concerns, not UI chrome.
Concrete numbers that define the local-first shape
- 1 vault file per profile on disk
- 0 required cloud copies of the host list
- 4 native platforms (macOS Apple silicon, macOS Intel, Windows, Linux)
- 10 database engines available in Database Studio beside SSH
Your hosts stay home. Nothing in the cloud. Everything on your machine.
Prefer a product walkthrough? See the feature list, the client comparison, or download iLead.