Encrypted SSH vault
One local file, Argon2id + AES-256-GCM. Hosts, keys, tunnels, snippets, and notes never sit in plaintext.
Documentation
Everything iLead does, out of the box
A full tour of every feature in the app, grouped by what it's for. Items markedNew shipped most recently. Every feature below runs locally against your encrypted vault - nothing here calls out to a cloud service.
Connections
Connections & sessions
Everything about opening a trustworthy terminal and keeping it that way.
Masked private keys with password-gated revealNew
Private keys and passphrases render masked (e.g. Ed25519 private key · 464 bytes). Gated by vault master password with 30s auto-remask, blur/lock re-mask, and replace without revealing.
Multi-tab terminals
Password, key, or agent auth, with jump-host support for hopping through a bastion.
Embedded RDP & VNC remote desktopNew
Graphical remote desktop viewer rendered directly in terminal tabs for Windows (RDP) and Linux/macOS (VNC) with keyboard/mouse capture, live latency metrics, and scaling.
Visual Multi-Hop Bastion ChainingNew
Chain multiple bastion hops (Local -> Bastion-A -> Bastion-B -> Target) with interactive topology flow and auto-synthesized OpenSSH ProxyJump previews.
Auto-reconnect on sleep wake / Wi-Fi switchNew
Seamlessly auto-heals dropped SSH sessions when your machine wakes from sleep or shifts networks, preserving active buffer history.
Server INFO banner on connectNew
Injects a short OS / IP / uptime / CPU / memory / disk summary into the terminal via a side channel so the probe script never lands in shell history.
Smart non-destructive Escape key hierarchyNew
Escape never collapses fullscreen and passes ASCII 0x1b directly to Vim and shells, while a prioritized stack closes modals cleanly.
Host-key verification
Trust-on-first-use fingerprint prompts, backed by a known_hosts manager.
Command palette
⌘K (Ctrl+K on Windows/Linux) jumps straight to any host or its SFTP view.
Per-host SSH overrides
ProxyCommand, custom ciphers, KEX algorithms, and keepalive interval, set per host.
SSH agent forwarding
Opt in per host to forward your local agent so you can hop onward without copying keys.
Certificate-based auth
Pair a short-lived OpenSSH certificate with your key instead of relying on the key alone.
Terminal layout
Split panes, history search & notifications
Work across more than one session at a time without losing track of any of them.
In-terminal reverse history search (Ctrl+R)New
Interactive fuzzy search overlay inside terminal tabs to quickly find and reuse past commands from shell history and encrypted audit logs.
Terminal triggers & bell notificationsNew
Configure custom regex patterns to trigger desktop notifications, audio chimes, glowing toast alerts, and tab alert badges.
Terminal keyboard shortcuts panelNew
A dedicated ⌨ Shortcuts toolbar button and first-run hint pill opening a categorized reference panel of all terminal hotkeys.
Split-pane / grid layout
View 2 or 4 sessions side by side. Sessions stay alive when you switch layouts, no reconnect.
Broadcast typing
Type once in the focused session and mirror those keystrokes live into other chosen sessions.
Themes & zoom
Terminal color themes, cursor style, font size, and a focus/fullscreen mode.
Files & Storage
SFTP & S3 Object Storage
Moving and editing files without leaving the SSH manager.
S3 & Object Storage browserNew
Connect directly to AWS S3, Wasabi, MinIO, and Cloudflare R2 alongside SFTP. Browse folders, upload, download, and delete files with ease.
SFTP client
Upload and download files, folders, or batches, with checksum verification and a cancelable queue.
Inline remote editor
Edit a remote text file directly, no download round-trip.
Directory sync
Preview and run a one-way sync between a local folder and a remote path.
Local file servers
An embedded HTTP or SFTP server to share files. Localhost only by default; a separate checkbox with a confirmation prompt opts into listening on your LAN.
Fleet ops
Server ops & monitoring
Keep an eye on many machines from one SSH manager window.
Live metrics
CPU, memory, disk, uptime, and load, plus a process list you can kill from.
Container management
List, start, stop, restart, and tail logs for Docker, Podman, and Kubernetes.
Ops playbooks
One-click checks: disk, memory, uptime, logged-in users, listening ports, failed units, journal errors.
Custom playbooks
Save your own commands as playbooks, right alongside the built-in ones, editable per vault.
Batch execution
Run one command across many hosts at once and see every result together.
Health checks & Wake-on-LAN
Ping a fleet for reachability, or wake a sleeping machine with a magic packet.
Command audit log
A record of every ops command, log pull, kill, and container action, not interactive typing.
Database Studio
Query, edit, and dump without leaving iLead
A multi-engine database workspace that sits next to your SSH sessions and tunnels.
Ten engines in one StudioNew
PostgreSQL, CockroachDB, MySQL, MariaDB, SQL Server, Oracle, SQLite, MongoDB, Cassandra, and Redis, often over the SSH tunnels you already run.
Query editor & schema browseNew
Run SQL or document queries, inspect schemas/collections/keys, and preview results in a dense result grid.
Direct table & document editingNew
Insert, update, and delete rows on supported SQL engines and MongoDB when primary keys or _id are available.
Native dumps + safe logical dumpsNew
Call pg_dump, mysqldump, mongodump, and similar tools when present, or use a capped safe logical dump for a quick portable snapshot.
Studio keeps state across navigationNew
Switch to Files, Ops, or the terminal without tearing down open Studio engines and query tabs.
Networking
SSH tunnels, telemetry & SOCKS
Reach services that aren't directly exposed.
Live tunnel traffic & bandwidth monitorNew
Real-time telemetry showing live upload/download throughput (▲/▼), cumulative bytes transferred, and active open socket counters.
Port-forwarding tunnels
Local and remote SSH tunnels, saved in the vault, with auto-start on launch.
SOCKS5 proxy
Route arbitrary traffic through a host over SSH.
Quick-launch tunnel presets
One click starts a tunnel to Postgres, MySQL, Redis, MongoDB, an admin UI, or SOCKS - no manual port entry.
Web/browser companion terminalNew
Open one live session in a browser with a link that expires after a duration you choose, from 15 minutes to 24 hours, or never.
Allow other devices on my networkNew
A checkbox in the share popover. Off by default: the link only opens from this device. On: any device on the same Wi-Fi/LAN can open it too, with a confirmation prompt first.
Recording
Session recording & playback
Keep a record of what happened in a session, opt in per session.
Session recording
Capture a session's terminal output to a file. Nothing is recorded unless you press record.
PlaybackNew
Replay a recorded session in an embedded terminal with pause and 0.5×–4× speed control, or download it as a plain-text transcript.
Record presentation modeNew
Video walkthrough recorder compositing the terminal side-by-side with your webcam and mic narration, saved as .webm.
Migration & Discovery
Fleet import & Cloud auto-discovery
Move off another SSH client or discover cloud instances automatically.
Cloud host auto-discoveryNew
Synchronize virtual machine instances from AWS EC2, Hetzner Cloud, and DigitalOcean using read-only API tokens with live status tracking.
Batch host importer & exporterNew
Batch import and export server fleets via standard CSV spreadsheets, JSON schemas, or Ansible Inventory YAML/INI.
NeoServer auto-discovery & backup importNew
Auto-detect local NeoServer iCloud and macOS Group Container backups, plus direct JSON backup file imports.
Modern & classic SSH client importersNew
Import Termius, Tabby, Remmina, Bitvise, Royal TS, WindTerm, PuTTY, MobaXterm, WinSCP, SecureCRT, FileZilla, Cyberduck, and SuperPuTTY.
SSH config import
Pull hosts straight from ~/.ssh/config.
Host transfer packs
Export selected hosts, or import a pack from another vault or machine, as a password-protected file - importing shows every host in the pack first, so you pick which ones to bring in.
Vault & Backup
Multi-vault profiles & automated snapshots
Isolate environments and protect the vault across machines.
Multi-vault profiles switcherNew
Create and switch between separate isolated encrypted vault files (Default, Work, Client-XYZ) with distinct Argon2id master keys.
Scheduled automated encrypted snapshotsNew
Autonomous background backup engine exporting timestamped encrypted vault snapshots with rolling retention cleanup.
Scheduled backups
Hourly, daily, weekly, or manual encrypted backups of the whole vault.
Auto-detected destinations
Google Drive, iCloud Drive, Dropbox, OneDrive folders, USB drives, or a plain local folder - folder detections, not account sign-ins; the provider's own sync client does the uploading.
iCloud sign-in verificationNew
macOS only: the iCloud Drive destination gets a real check via Apple's sign-in API, not just folder-existence guessing. Shows signed-in status and refuses a stale folder if you're signed out.
Restore
Merge a full encrypted vault backup file back in. Existing hosts, keys, snippets, notes, and tunnels are left alone.
Two-way syncNew
Turn on Sync for a destination and any other device pointed at that same folder merges automatically, no server required.
MCP
Agent access via Model Context Protocol
Let local AI clients use selected vault hosts, with your approval on every command.
Local MCP bridgeNew
Loopback-only HTTP MCP server on this device. Compatible with Cursor, Claude Code, VS Code, GitHub Copilot, freebuff, and any HTTP MCP client. Credentials never leave the vault.
Host allowlist & access keyNew
Only checked hosts appear to agents. Jump hosts are used internally and are not listed. Bearer access key is shown once on enable or rotate.
Approve-once run_commandNew
Every proposed shell command shows the exact host and text in a native dialog. Deny is the default. Results are audited with source mcp.
Ready-made client configsNew
Copy or download mcp.json snippets from Settings → Agent Access. See also the public setup guide at /mcp.
Productivity
Dynamic Smart Groups & server ordering
The small things that add up over a work week.
Dynamic tag-based smart groupsNew
Virtual smart groups organized around tags (#production, #database) with multi-tag intersection filtering.
Server display ordering & drag reorderingNew
Custom manual ordering, Name A-Z, Name Z-A, Recently used, or Host address. Drag and drop rows to arrange them, saved in the vault.
Snippet placeholders & form promptsNew
Snippets with <param> and {{param}} variables prompt an interactive dialog with live command preview, input history, and sudo prefixing.
App update available noticeNew
Discrete notification pill near Settings comparing semantic versions against official releases with one-click download.
Encrypted notes
Searchable notes tied to hosts or workflows, stored in the vault.
Snippets & macros
Reusable command snippets and macros, insertable straight into the terminal.
SSH key manager
Add keys by path or paste a PEM, with an optional passphrase.
Arcana
1,000 Sarcastic Arcana spells
Because a terminal app doesn't have to be sterile.
1,000 sarcastic tech spellsNew
Hidden terminal spellbook across DevOps, Cloud, Databases, Pentest, Networking, AI Hype, Hardware, and Retro computing.
Procedural multi-particle animationsNew
FNV-1a hash-derived motion kinds, dynamic gradient backdrops, sound effects, and over 100 punchlines.
Get started
Try it on your own hosts
Download iLead and import your existing sessions in a couple of minutes.