Free while we’re in preview

Get SSHDesk

Shows what ssh will actually do with your config, and why.

The Mac button is for Apple Silicon. On an older Intel Mac, get this one instead.

One file, both ways. Double-click it for the window. Run the same file from a command prompt with arguments and it behaves as the command-line tool, because the engine is inside it. Nothing else to download and nothing to keep beside it.

Early preview. The window has been built and run, but not yet on a real Windows PC or Mac, so expect rough edges. The engine underneath it is fully tested.

One file — no installer
Runs on your machine, offline
Source code published below

Free while in preview. It isn’t signed yet, so Windows or macOS will ask you to confirm the first time you open it. At launch, SSHDesk is included in every plan along with the rest of the range.

The rule almost everyone has backwards

OpenSSH keeps the first value it obtains for a keyword. Not the most specific one. So a Host * block at the top of your file carrying User deploy and Port 2222 quietly beats the Host web1 block below it, and web1 connects as deploy on 2222. sshdesk explain web1 Port prints every declaration that could have applied, marks the winner, and says which line beat each loser.

Checked against the real thing

The parser was run against OpenSSH 9.6 on this machine and agreed with ssh -G on 24 out of 24 resolutions. That covers argv_split tokenising, Host a#b against Host a #b, ssh’s own glob rather than the shell’s, negated patterns, case-sensitive Host patterns, and the nasty one: an included file that ends inside an open Host block leaks that block back into its parent and silently kills every line after it.

It reads, and that’s all

check finds shadowed wildcard blocks, ProxyJump chains that loop, keys that don’t exist or that group can read, uppercase Host patterns that can never match, weak ciphers, and unknown keywords with the nearest spelling.

There’s no network code in the binary. Match exec is reported, never executed. There’s no --fix either, because reordering a six-year-old config is a decision, not a transformation.

Reading on the job itself

How to watch a handful of servers without setting up a monitoring stack A list of host and port, checked on an interval, that stays silent until something changes state. Almost al...

The rest of Remote Ops Workspace

Machines you cannot walk over to. Watch whether they answer, record and replay a session, read your SSH config, and share one agreed hop.

RemoteDeck

Simple Ready

A watchlist of hosts that stays quiet until something actually changes state.

SessionForge

Vertical Ready

Records a command's output with exact timings and replays it at real speed.

OpsTunnel

Team Ready

One agreed TCP hop for the team, with a record of who used it and for how long.

Advanced & technical details Command-line builds, source code, checksums and a recorded session — for developers and IT teams

A working command-line build of the config analyser: a faithful ssh_config parser with Include, Match blocks and OpenSSH's own pattern rules, resolving each keyword by first-obtained-value-wins and showing the file and line the winner came from. It finds the broad Host * block that quietly steals settings from the specific hosts below it, ProxyJump chains that loop, keys with permissions that would be refused, and typos with a suggestion. Checked here against real OpenSSH 9.6: 24 out of 24 resolutions agree with ssh -G. It never opens a connection and never writes to your config.

Recorded session

Recorded terminal session showing SSHDesk running — A real recorded session — SSHDesk’s actual output, captured by running the shipped binary.

Naming status

Working name only — brand verdict **AVOID** (Very High). Collision: SSHDesk. Rename completely.

What it draws on

Existing paid software whose best ideas shaped this program: MobaXterm Professional, SecureCRT, WinSCP Microsoft Store Edition, Remote Desktop Manager.

Command line

There is nothing extra to install. The program you download is the command-line tool as well: give it arguments instead of double-clicking it and it runs as one, with its output on your terminal. The standalone builds below are the same engine on its own, for machines where you would rather not ship a window at all.

sshdesk - your ssh config, finally legible (Techlosoft Connectivity Desk)

USAGE
  sshdesk resolve <host>            [--config <file>] [--user <name>] [--json]
  sshdesk explain <host> <keyword>  [--config <file>] [--user <name>] [--json]
  sshdesk hosts                     [--config <file>] [--json]
  sshdesk check                     [--config <file>] [--json]
  sshdesk graph                     [--config <file>] [--out ssh.svg] [--json]
  sshdesk help | -h | --help

COMMANDS
  resolve    Print the effective setting for every keyword that applies to
             <host>, exactly as ssh would resolve it, with the file:line each
             value came from and the connection target it adds up to.
  explain    Print every declaration of <keyword> that could have applied to
             <host>, in file order, marking the winner and saying why each
             loser lost.
  hosts      List every concrete host declared in the config with its resolved
             user@hostname:port.
  check      Analyse the config: blocks shadowed by an earlier wildcard,
             duplicate patterns, missing or world-readable identity files,
             broken or looping ProxyJump chains, settings that weaken
             security, and unknown keywords with a suggested spelling.
  graph      Draw the ProxyJump topology. Without --out it prints a text
             topology; --out writes a standalone SVG.

FLAGS
  --config <file>   ssh_config to read. Default: ~/.ssh/config
  --system <file>   System config read AFTER the user one, so the user file
                    still wins. Default: /etc/ssh/ssh_config when it exists.
  --no-system       Do not read the system config at all.
  --user <name>     Resolve as if "ssh -l <name>" had been given. Affects
                    Match user and the reported target.
  --out <file>      Write the SVG here (graph only). The ONLY path sshdesk ever
                    writes to.
  --json            Machine-readable JSON output.

EXAMPLES
  sshdesk resolve web1.example.com
  sshdesk explain web1.example.com Port
...

Recorded from the shipped binary, not written by hand.

Windows (amd64) macOS (Apple Silicon) macOS (Intel) Linux (amd64)

Source

Every file the program is built from:

check.go · console.go · console_test.go · graph.go · guided.go · keywords.go · main.go · main_test.go · match.go · parse.go · resolve.go

SHA-256 checksums · build instructions & scope notes · full build plan

SSHDesk

Preview