SSH client for Linux, macOS, Windows and Android
Every host behind its own gate.
MorphGate connects over SSH and SFTP, gives each host its own VPN tunnel, and syncs your hosts and keys end-to-end encrypted, through our server or one you run yourself.
Free on your own machine. Hosted sync starts with a 7-day trial. iOS is next.
Per-host VPN
A VPN per host, inside the app.
Attach a WireGuard, OpenVPN or openconnect profile to a host. MorphGate brings the tunnel up when you connect and takes it down when you’re done.
Each tunnel runs in the app with its own TCP/IP stack. There is no TUN device, no route table to edit and nothing that needs root, so two clients that both use 10.0.0.0/24 can be connected at the same time.
| Host | Tunnel | Kind | Reaches |
|---|---|---|---|
prod-db-01 | wg-office | WireGuard | 10.20.0.0/16 |
acme-web-01 | acme-vpn | OpenVPN | 10.0.0.0/24 |
uni-gpu-03 | uni-anyconnect | openconnect | 10.0.0.0/24 |
lab-pi | none | direct | 192.168.1.0/24 |
Same subnet twice. acme-web-01 and uni-gpu-03 both sit on 10.0.0.0/24. Both connect. Changed on your system: no routes, no TUN devices, nothing as root.
End-to-end encrypted sync
Sync that never sees your keys.
Your hosts, keys, tunnels and snippets are encrypted on your device before they leave it. The server keeps ciphertext and the revisions it needs to sync, nothing else.
Your master password goes through Argon2id and HKDF into a key hierarchy that only your devices hold. Vault keys are sealed to each device, and every record is signed and padded.
| What | On the server |
|---|---|
| Hosts, keys, tunnels, snippets | Ciphertext only |
| Your public keys | Stored |
| Slow hashes of secrets your app derives | Stored |
| Your master password | Never sent |
| Any key that decrypts your vault | Never sent |
Hosted
morphgate.com
Create an account from the app. Two-step verification, an email when a new device signs in, and an account page for your plan and devices.
Self-hosted
Your own server
The reference server is one binary and a SQLite file, under AGPL-3.0. Point the app at it under Sync.
$ cargo run -p vault-sync-server # listens on 127.0.0.1:8443
Open protocol
vault-sync/v1
The OpenAPI contract is public domain (CC0). The conformance tests run against any server URL, so you can check a server before you trust it with your vault.
The rest of the toolkit
Everything else you open a terminal for.
Jump hosts
Chain ProxyJump hops. Each hop is checked against its own pinned host key before the next one opens.
Port forwarding
Local, remote and dynamic SOCKS5 forwards, saved in the vault and started or stopped from the sidebar.
SFTP tabs
Local and remote panes side by side. Drag files in from your desktop, transfer folders recursively, cancel or replace as you go.
Snippets
Keep the commands you retype in the vault. Paste one into the last terminal you used, or run it, with bracketed paste.
Host keys and SSH keys
Generate or import keys into the vault. Host keys are pinned on first connect, and a changed key blocks the connection until you look at it.
Unlock and auto-lock
A master password with a recovery code, or the OS keychain behind Touch ID, Windows Hello or polkit. The vault locks itself when you step away.
Teams
Share vaults, not passwords.
An organization owns shared vaults. Each member gets read, write or manage access and their own sealed copy of the vault key.
Admins confirm new members from the app, so the server never holds a vault key. When someone leaves, the app asks you to rotate the key, and changes under the old key are refused.
| When | What happened |
|---|---|
16 Oct 14:03 | Ana gave Marko write access to Production |
16 Oct 14:02 | Ana confirmed Marko as a member |
15 Oct 09:58 | Ana rotated the Production key (generation 4) |
15 Oct 09:41 | SCIM removed jelena@acme.example Rotation due |
12 Oct 17:20 | Policy changed: two-step verification required |
12 Oct 17:12 | Single sign-on required for all members |
11 Oct 10:05 | Ana invited 4 people from acme.example |
Download MorphGate
The app updates itself. It checks at launch and twice a day, and installs only updates signed with the project’s key.
On Android, get it from Google Play.
Linux
x86_64 and arm64 This computer- .AppImage Any distribution arm64 morphgate_0.2.1_aarch64.AppImage x86_64 morphgate_0.2.1_amd64.AppImage
- .deb Debian, Ubuntu x86_64 morphgate_0.2.1_amd64.deb arm64 morphgate_0.2.1_arm64.deb
- .rpm Fedora, openSUSE arm64 morphgate-0.2.1-1.aarch64.rpm x86_64 morphgate-0.2.1-1.x86_64.rpm
macOS
Apple silicon and Intel This computer- .dmg One universal disk image Download MorphGate_0.2.1_universal.dmg
Windows
Installer or MSI package This computer- -setup.exe Installer for you Download MorphGate_0.2.1_x64-setup.exe
- .msi For managed installs Download MorphGate_0.2.1_x64_en-US.msi