MorphGate is an SSH client for Linux, macOS and Windows. Everything under Connections, Terminal, and Vault and security works without an account. Sync and teams need a sync server: morphgate.com, or one you run yourself.
Connections
- SSH terminals with saved hosts, tabs, and sign-in by password, SSH key or SSH agent. See Hosts, groups and identities.
- Quick connect for a one-off connection, with the option to save the host.
- Host groups and identities: shared defaults for many hosts, and one user and sign-in method used by several hosts.
- SSH keys: generate Ed25519 keys or import existing ones into the vault. See SSH keys and host keys.
- Keys in a password manager: sign in with keys kept in 1Password, Bitwarden, KeePassXC or Secretive, through their SSH agent (Linux and macOS). See Keys in 1Password, Bitwarden and other SSH agents.
- Host key pinning: a host's key is pinned on first connect, and a changed key blocks the connection.
- Jump hosts: reach a host through a chain of other hosts, each checked against its own pinned key. See Jump hosts.
- A VPN per host: WireGuard and OpenVPN built in, and AnyConnect, GlobalProtect, Fortinet and others through the openconnect program. Nothing on your system changes. See A VPN per host.
- Port forwarding: local, remote and SOCKS tunnels, saved in the vault and started from the sidebar. See Port forwarding.
- SFTP: a two-pane file browser with drag and drop. See SFTP file browser.
- Attachments: keep files such as runbooks or certificates with a host, encrypted in its vault.
Terminal
- The route bar above each session: the VPN, the jump hosts, the host and its pinned key. See Terminal sessions.
- Snippets: saved commands you paste or run in a session.
- Reconnect: a lost connection tries again by itself.
- Keep the session on the server: attach each tab to a tmux session, so a dropped connection or another device picks up where you were.
- Themes: seven terminal schemes, imported schemes from Ghostty, Alacritty, iTerm2 or Windows Terminal, a scheme per host, and a red Production scheme with a PROD tab label. See Themes and terminal appearance.
- Session logs: record what a host's sessions print, encrypted, and play it back. See Session logs.
Vault and security
- An encrypted vault on your device, opened with your master password. See How your vault is encrypted.
- A recovery key for a forgotten master password. See Master password and recovery key.
- Unlock with the system keychain, optionally after Touch ID, Windows Hello or system authentication, and lock when idle. See Unlocking and auto-lock.
- Vault export to a readable JSON file. See Export your data.
- Signed updates: MorphGate checks for new versions and installs only updates signed with the project's key. See Install and update.
Sync
- End-to-end encrypted sync of your vault across devices. See How sync works.
- A device list where you can sign devices out. See Devices, signing in and signing out.
- Two-step verification with an authenticator app. See Two-step verification.
- Your choice of server: morphgate.com or your own. See Run your own sync server.
Teams
- Organizations with owners, admins and members. See Teams and roles.
- Shared vaults with view, edit or manage access, end-to-end encrypted like your own. See Shared vaults and access.
- Fingerprint checks when people join and are confirmed. See Inviting and confirming members.
- Key rotation and offboarding: remove someone, give their vaults new keys, and remove their SSH keys from your servers. See Removing members and rotating keys.
- Policies and an activity log. See Team policies and Activity log.
- Chat notifications to Slack, Microsoft Teams or any webhook: devices waiting for approval, people waiting to be confirmed or leaving, security changes and plan problems. Set up on the team page, under Integrations.
Business
- Single sign-on with OpenID Connect or SAML 2.0. See Single sign-on.
- SCIM provisioning from your identity provider. See SCIM provisioning.
- Device approval for new devices. See Device approval.
- Team session logs kept on morphgate.com, and three years of activity log.
- An audit stream to your own endpoint. See Audit stream.
What each plan includes is on Plans and billing and the pricing page.