FAQ & contact

Free, and closed source. Every feature is available at no charge — there is no paid edition, no subscription, no trial period, no account to buy and nothing locked behind an upgrade. We do not sell your data either; the app has no telemetry and contacts our servers only if you switch on email account recovery. The source code is not public, and the terms of use do not permit redistributing or reverse engineering the software. If the pricing ever changes we will say so here rather than quietly switching it on, and we will not turn a version you already installed into one that stops working.

The installer is not code-signed yet, so this warning is expected. Download the ZIP from this website and verify its SHA-256, then extract it and run the MSI installer inside.

In PowerShell, run Get-FileHash <path-to-zip> -Algorithm SHA256 and compare the output with the checksum on the download page, character by character. If they match, the download is intact.

Windows 10 version 1803 (April 2018 update) or later, or Windows 11, both 64-bit. Download the ZIP, extract it, and run the MSI installer inside. WebView2 Runtime is required — it is built into Windows 11; on Windows 10 the installer attempts to download and install it automatically (internet required). If that fails, install the WebView2 Evergreen runtime from Microsoft manually.

Everything is stored in a local SQLite database on your computer (%APPDATA%), encrypted with AES-256-GCM. The encryption key is derived from your login password and normally exists only in memory — the app never uploads any server information. If you use “Remember me” or a passwordless account, the key is additionally held by your operating system's credential store (Windows Credential Manager); see the dedicated question below for exactly what that changes.

Both hand the data key to the Windows Credential Manager (macOS: Keychain), so the trust boundary becomes your operating system login instead of an app password. Anyone signed in to that Windows account can open the app account; a copied database file alone still decrypts nothing, and the key cannot be used on another computer or under another Windows account. Tick “Remember me” only on a computer whose Windows account isn't shared with people who shouldn't see your servers. Passwordless accounts are designed for shared duty machines: whoever can unlock the machine can use the account, so use them only on physically controlled computers. Note that a passwordless account's key exists only in that machine's credential store — reinstalling Windows or deleting the Windows account destroys it permanently, so generate an offline recovery code (Settings → Recovery) right after creating one. Logging out explicitly clears a remembered key (passwordless accounts excepted — theirs is the only copy).

No — by default uninstalling keeps your data, so reinstalling restores every saved account. Your database lives in %APPDATA%\com.complexmission.sshpanel, which the installer never touches. For a clean removal, erase it from inside the app before uninstalling: avatar menu → Backup & Restore → Delete data → “Erase everything on this device”, which also removes the keys the app placed in the Windows Credential Manager. Since deletion is irreversible, export a backup first if you might need the data again. See the technical details page for exactly what each option removes and what is deliberately kept.

It comes with 40 built-in admin command templates for tasks like compression, permissions, MySQL / PostgreSQL import/export, system services, logs, Docker, security audits, disk investigation, networking and process management. Each template has a colored risk label (query / change / dangerous / extreme). Dangerous commands show a visible warning; extreme commands require a second confirmation. You fill in parameters, preview the command, and insert it at the terminal cursor — you always see what will run before it runs. You can also save up to 200 custom commands per account; their name, command text and description are encrypted with the same AES-256-GCM key as your credentials.

CPU usage, load average, memory and swap usage, network interface rates, disk usage per mount point, and a process CPU ranking — all collected by reading /proc over a pure read-only SSH connection (no root required, compatible with busybox / Alpine). Data refreshes every 5 seconds and pauses automatically when you switch to another view.

You can drag files or entire folders from Windows Explorer into the SFTP file list to upload them (folder structure is recreated automatically). You can also drag items within the remote list to move them between directories. For downloads, right-click and choose “Download to…” — the app remembers your last-used local folder so you only pick the destination once per batch.

Six built-in color themes are available: GitHub Dark, One Dark, Dracula, Monokai, Solarized Dark and Nord. You can switch themes with one click from the terminal toolbar, and the setting persists per session.

The interactive shell and SFTP / quick commands each use a separate SSH session to the same server. This means a long file transfer never blocks your terminal typing, and vice versa. Both sessions are independently verified against the same host fingerprint.

All previously saved credentials (server passwords, private keys, custom commands) are automatically re-encrypted with a key derived from your new password via Argon2id. There is no manual migration step — it happens transparently when you change the password.

FTPS is the default and the only mode that is on without asking. After the connection is established and before your username and password are sent, an explicit TLS upgrade must complete. TLS 1.2 is the minimum, and the certificate chain and hostname are validated against the public CAs your system trusts. There is no “ignore certificate” option: a server using a self-signed or private-CA certificate stops the connection and shows you its SHA-256 fingerprint to check against the server. Confirm it once and that exact certificate becomes the only one accepted for that host — if it later changes, you are warned and the connection is refused until you confirm again. Credentials are never sent over a connection whose certificate you have not accepted. For legacy servers that offer no TLS at all, each connection has an explicit “Allow unencrypted FTP” switch: TLS is still tried first and the fallback only happens when the server refuses AUTH TLS, the credentials and files then travel as cleartext, and the connection is tagged as insecure in the list. A host that has ever completed TLS has its certificate pinned and can never be silently downgraded.

You choose the data mode explicitly when creating a connection. Passive mode has your machine connect out to the server and works in most networks. Active mode requires the server to connect back to your machine, and is normally only needed when the server cannot open a passive port range. When in doubt, choose passive.

Yes, if you set up recovery beforehand (avatar menu → Account Recovery): either the offline recovery code you saved when enabling it, or email recovery via this website's Recover page. Without either set up in advance, there is no way to recover a forgotten password — the encryption key that protects your saved credentials only exists as long as one of those secrets can unwrap it. It takes about a minute to set one up — do it before you actually need it.

Binding email recovery only uploads a randomly generated helper key, encrypted, to our server — never your password, private keys or any server credentials. That helper key alone cannot decrypt anything: unlocking your local database also requires a separate wrapped piece that only ever exists on your own device. Even in the worst case of a server-side breach, an attacker would still need access to your device's local database file to make any use of it.

Avatar menu → Backup & Restore → Export saves every account on this device to a single file, still encrypted the same way it always is — never plaintext. To move it, copy that file to the new computer, install the app there, and use Import from the same menu, then restart when prompted. The target device's existing data is kept as a dated .bak file, not overwritten, in case something goes wrong.

Yes. Click the export icon on a connection's card for just that one, or “Export all” at the top of the connections list for a batch. You'll be asked to set a one-time password to protect the file — separate from your login password — and whoever imports it enters that same password to unlock it. Nothing in the file is readable without it.

Yes. In FileZilla choose File → Export to save your Site Manager entries as an XML file, then click the import icon at the top of the connections list and pick that file — no password needed, since FileZilla stores site passwords merely base64-encoded rather than encrypted. Explicit-FTPS sites import as strict FTPS connections; FileZilla's plain-FTP site types import as FTPS with the “Allow unencrypted FTP” fallback already enabled, mirroring how FileZilla would treat them — those cards carry an insecure tag so the difference stays visible. SFTP sites become SSH connections, and FileZilla folders become groups — or you can point the whole import at one group, existing or created on the spot. Entries identical to a connection you already have are skipped, so re-importing after adding a few sites in FileZilla only picks up the new ones. Everything lands in the same encrypted local database as connections you add by hand.