Frequently asked questions

SSHive is on the App Store. On a Mac, open the Mac App Store and search for SSHive, or use the download page. On iPhone and iPad, open the App Store. It is a Universal Purchase: buying Pro once covers all three platforms. SSHive is distributed through the App Store only, there is no separate DMG to download. Learn more: Install SSHive.

macOS 12 Monterey or later on an Apple Silicon Mac (M1 or later). The iPhone and iPad app needs iOS 17 or later on iPhone and iPadOS 17 or later on iPad. Learn more: Install SSHive.

No. SSHive has no account, no sign-up and no login. Nothing about your servers is sent to us. The app works fully offline apart from the connections you open yourself. Learn more: Welcome to SSHive.

The MCP server for AI assistants, broadcast mode, SOCKS5 (-D) tunnels, the built-in OTP authenticator, FTP and FTPS, the serial console, the Telnet client and the in-terminal AI assistant are macOS features. SSH, SFTP, RDP, VNC, local (-L) and remote (-R) tunnels, jump hosts, shared accounts, session logging, snippets and the network tools run on all three platforms. Remote tunnels, jump hosts, shared accounts and session logging need Pro, but that is a tier and not a platform: Universal Purchase unlocks them on iPhone and iPad too. The VPN client (IKEv2, IPSec, OpenVPN) is on iPhone and iPad only: the Mac App Store build has no VPN at all. Learn more: Free and Pro.

The SSH terminal, the SFTP file manager with uploads up to 10 MB per file, 2 simultaneous sessions, 5 saved profiles, 1 local SSH tunnel (-L), the built-in snippet library plus 3 custom snippets, 3 OTP tokens and the dark theme. There is no trial period and no expiry: the free tier stays free. Learn more: Free and Pro.

Unlimited sessions and profiles, unlimited SFTP transfer size, RDP and VNC, remote (-R) and SOCKS5 (-D) tunnels, broadcast mode, the MCP server, jump hosts, shared accounts, encrypted profile export and import, session logging, opt-in iCloud sync, unlimited custom snippets and OTP tokens, every theme, and the VPN client on iPhone and iPad. Learn more: Free and Pro.

Pro is a one-time purchase on the App Store, with no subscription. The price is shown on the pricing page and on the App Store, in each country's currency. It is a Universal Purchase, so buying it once unlocks Pro on Mac, iPhone and iPad with the same Apple Account. Learn more: Free and Pro.

On the Mac, open Settings > License and click Restore purchases; on iPhone and iPad it is in the Purchases section of the settings. This re-confirms your existing purchase with Apple and costs nothing. It happens when the StoreKit receipt has not refreshed yet on the first launch after an update. If restoring does not work, email contact@netmesafe.com with your App Store country. Learn more: Free and Pro.

On the Mac, import ~/.ssh/config in one click from the sidebar: SSHive parses Host, HostName, User, Port, IdentityFile and ProxyJump entries and creates one profile per host. It asks you to pick your .ssh folder once, and it also reads the IdentityAgent, ForwardAgent and tunnel lines. Sessions exported from PuTTY (a .reg registry file), MobaXterm (a cleartext MobaXterm.ini) and Royal TSX (a .rtsx file) come in through Settings > Import / Export > Import from another tool. There is no direct import from Termius, SecureCRT, iTerm2 or Tabby: if your hosts are in ~/.ssh/config, importing that file brings them in. The free tier imports up to 5 profiles. The import guide walks through each step. Learn more: Import ~/.ssh/config.

Yes, two ways. Pro users can turn on opt-in iCloud sync, which keeps profiles in step across Mac, iPhone and iPad through your own private iCloud database. Alternatively, export an encrypted .sshive file protected by a passphrase (scrypt key derivation and AES-256-GCM) and import it on the other device. Learn more: Export and import your profiles.

Tunnels are configured per profile in the Advanced section of the profile dialog and start automatically when the connection is established. Local forwards (-L) map a port on your machine to a host reachable from the server. Remote forwards (-R) and the SOCKS5 dynamic proxy (-D) are Pro features, and SOCKS5 is Mac-only. The free tier includes one local tunnel. The SSH tunnels page lists the per-profile limits on the Mac. Learn more: SSH tunnels.

Connection profiles live in the application support directory. Passwords and private key passphrases are never kept in a database of ours. On the Mac they are encrypted with Electron's safeStorage, whose key is kept in the macOS Keychain, then saved encrypted on the Mac; you can also require Touch ID before they are decrypted (off by default). On iPhone and iPad they go into the iOS Keychain as a device-only item excluded from iCloud backups, unlocked by Face ID or Touch ID when biometric protection is on. With iCloud sync (a Pro feature) turned on, an already-saved password can be mirrored to your iCloud Keychain. Host fingerprints are kept in a known-hosts store you can review. Learn more: Your data.

Yes, on macOS. SSHive runs a local MCP server (Model Context Protocol) on 127.0.0.1 port 49422, protected by a Bearer token, and exposes 20 tools covering SSH command execution and full SFTP file management. Three of them (ssh_list_profiles, ssh_connect and ssh_disconnect) stay hidden unless you turn on "let the assistant open sessions". Turn the server on in Settings > MCP. SSHive does not write any client configuration for you: copy the claude mcp add command for Claude Code, paste the JSON block into Cursor, and install the one-click extension in Claude Desktop. MCP is a Pro feature. Learn more: Connect an AI assistant.

No. The MCP server exposes sessions, not credentials. The passwords, private keys and passphrases SSHive stores stay encrypted, and no tool returns them; the assistant sees the host, port and user of the sessions it may use. An assistant can run a command on a session you have already opened, and unless you let it open sessions, it can only reach servers you are currently connected to. Learn more: What the assistant can do.

Yes, on macOS. Select some output and ask SSHive to explain an error, or ask a free-form question. It uses your own API key for Anthropic Claude, OpenAI, Google Gemini or Mistral, or any OpenAI-compatible endpoint such as LM Studio or Ollama; the key is stored encrypted in the Keychain and requests go straight from your Mac to the provider you picked. Nothing passes through our servers. Learn more: The terminal's AI assistant.

Credentials are encrypted through the operating system Keychain, the app validates every internal call, and the display side is isolated from the rest of the application. There is no telemetry and no analytics inside the app, and no network traffic beyond the SSH, SFTP, RDP and VNC connections you open. You can also lock the app itself behind a master password. Learn more: Locking SSHive.

Not unless you ask for it. The only optional network feature is iCloud sync, which is off by default, is a Pro feature, and uses your own private iCloud database rather than any server of ours; credentials travel through a separate end-to-end encrypted channel. Learn more: iCloud sync.

Yes. SSHive keeps a known-hosts store and prompts you the first time it sees a server, then warns you if a fingerprint ever changes, which is what protects you from a man-in-the-middle. You can review and remove stored fingerprints from the settings. Learn more: Server fingerprints.

Yes. In Settings > Connection > SSH Agent, pick the vault: the keys stay inside it, and the vault signs for you, so SSHive never holds a private key. Learn more: SSH agents.

2 SSH sessions at a time in the free version, as many as you like with Pro. RDP and VNC are Pro from the first session. Learn more: Free and Pro.

Hold the Option key while you select: the mouse comes back to you instead of going to vim or tmux. Learn more: Using the terminal.

A recent Pi under Wayland uses wayvnc, which wants a username as well: fill in the user and the password of the Pi account, not a VNC password. Learn more: VNC.

With Broadcast, a Pro feature: what you type goes to every SSH session at once, or to the sessions you pick. Learn more: Send one command to several servers.

Encrypted on the Mac, with a key held in the macOS Keychain, in a file only your user account can read. They leave the Mac only if you turn on iCloud sync or make an encrypted export. Learn more: Your data.