Docs

How to use MorphGate: the SSH client, its encrypted vault, sync, and teams. New here? Start with Getting started, or see everything at a glance in the feature list. The app and the sync protocol are open source at github.com/valicm/MorphGate, where you can also report a problem.

Getting started

Feature list Everything MorphGate does, grouped by area, with links to each page.
Getting started From a fresh install to your first SSH session: create your vault, save your recovery key, add a host.
Install and update Packages for Linux, macOS and Windows, first-run notes, signed automatic updates, and where your data lives.
Get help and report a problem Where to report bugs, what to include, and what never to share.

Hosts, groups and identities Save hosts, use quick connect, share defaults with groups and credentials with identities, and attach files.
SSH keys and host keys Generate or import SSH keys, use the SSH agent, and how MorphGate pins and checks host keys.
Keys in 1Password, Bitwarden and other SSH agents Sign in with keys kept in 1Password, Bitwarden, KeePassXC or Secretive, through their SSH agent.
Jump hosts Reach a host through one or more other hosts, each checked against its own pinned key.
A VPN per host WireGuard, OpenVPN and OpenConnect VPNs that run inside the app, only for the hosts that use them.
Port forwarding Local, remote and SOCKS tunnels, saved in the vault and started from the sidebar.
SFTP file browser Move files between this computer and a server, with drag and drop and recursive transfers.

Terminal sessions and snippets Tabs, the route bar, snippets, automatic reconnect, and keeping sessions on the server with tmux.
Themes and terminal appearance App themes, seven terminal schemes, imported schemes, a scheme per host, fonts, cursor and contrast.
Session logs Record what a host's sessions print, encrypted in the vault, and play it back or save it as a .cast file.

How your vault is encrypted The key hierarchy behind your vault, what protects each item, and the checks against a dishonest server.
Master password and recovery key Change your master password, make a new recovery key, and get back in when you forget the password.
Unlocking and auto-lock Lock when idle, unlock with the system keychain, and ask for Touch ID, Windows Hello or your fingerprint first.
Two-step verification Protect your sync account with codes from an authenticator app.

How sync works Turn sync on, add devices, what syncs and when, conflicts, limits, and what happens when a plan ends.
Devices, signing in and signing out Sign in on a new device, see your devices, sign them out, and sign back in after a password change.
What the server can and cannot see What a sync server stores, what it never receives, and what it could and couldn't do if it turned hostile.

Teams and roles Create a team, the owner, admin and member roles, seats, ownership and where a team is managed.
Inviting and confirming members Invite people, accept an invite, and confirm members by comparing fingerprints.
Shared vaults and access Create shared vaults, give view, edit or manage access, and put items where the team can use them.
Removing members and rotating keys Remove someone, rotate vault keys, remove their SSH keys from your servers and replace shared keys.
Team policies Require two-step verification, limit invite domains, control who creates vaults, and more.
Activity log What the team's activity log records and doesn't, how to read and download it, and how long it's kept.

The Business plan What Business adds to Team, how to try it, upgrade or switch, and what stays when a team leaves it.
Single sign-on Put a team's vaults behind your identity provider with OpenID Connect or SAML 2.0.
SCIM provisioning Let your identity provider invite and remove team members over SCIM 2.0.
Device approval Make new devices wait for approval before they open the team's vaults.
Audit stream Send the team's activity to your SIEM as signed JSON posts, as it happens.

Plans and billing Free, Personal, Team and Business, trials, prices, paying through Stripe, invoices and seats.
Your account page What the account page and the team page at morphgate.com show, and how to sign in to them.
Export your data Export your vault from the app, and download what the server keeps about your account.
Cancel or delete your account Cancel a subscription, stop syncing a device, and what deleting a hosted account does.

Run your own sync server Run the free reference server, connect the app to it, and move between servers.
The open protocol vault-sync/v1: what is published, how it works, and how to test any server against it.