Features
Every way you reach a server, in one app.
SSH and SFTP with jump hosts, proxy commands and certificates. A VPN per host. Your cloud machines as hosts, and your old client’s hosts imported in a minute.
Everything on this page is free and works on your own machine, without an account.
A VPN per host
The tunnel comes up with the host, and goes down with it.
Attach a WireGuard, OpenVPN or openconnect profile to a host, to a group, or to the jump host in front of it. MorphGate brings the tunnel up when you connect and takes it down when you’re done.
Each tunnel runs inside the app with its own TCP/IP stack: no TUN device, no routes, nothing as root. Two clients that both use 10.0.0.0/24 connect side by side.
| VPN | How it runs |
|---|---|
| WireGuard | In the app, from a wg-quick config, with several peers |
| OpenVPN | In the app, written in Rust: tls-auth, tls-crypt and tls-crypt-v2, certificates and PKCS#12, challenges and web (SAML) sign-in. Tested against OpenVPN 2.6 |
| openconnect | Cisco AnyConnect, Palo Alto GlobalProtect, Fortinet, Pulse / Ivanti, F5 BIG-IP, Juniper and Array Networks, through the openconnect program. Not on Windows yet |
Connecting
However the host is reached.
Passwords, keys generated or imported into the vault (OpenSSH, PEM and PuTTY’s .ppk), certificates and agents, set per host or shared through identities.
Jump hosts
Chain hops like ProxyJump, each checked against its own pinned host key. A jump host can also run a command, such as nc %h %p, and the connection rides on it.
Proxy commands
Reach a host through a command on this computer, as OpenSSH’s ProxyCommand does. A command that arrives through sync waits until you allow it on that device.
OpenSSH certificates
Sign in with a key’s certificate, from the vault or an agent. MorphGate warns before it expires, and can renew it with your own command before connecting: Vault, step-ca or ssh-keygen -s.
Host CAs
Trust every host your certificate authority signed, with no first-connect prompt. Paste the CA key and host patterns; @cert-authority lines in ~/.ssh/known_hosts count too.
Pinned host keys
A host’s key is pinned the first time you connect. If it changes, the connection stops and shows both fingerprints and what to check first.
Keys in your password manager
Sign in with keys kept in 1Password, Bitwarden, KeePassXC, Secretive or Pageant, through their SSH agent, and pick the one key to offer. Security keys work the same way.
Clouds
Your cloud machines, kept as hosts.
Add AWS, Google Cloud, Azure, Hetzner Cloud or DigitalOcean, and MorphGate lists their machines through the provider’s own CLI, signed in the way it already is: AWS SSO or an MFA profile, gcloud auth login, az login. MorphGate keeps no cloud credentials.
Refresh and the hosts follow. New machines appear, addresses change, and a machine that’s gone turns red instead of vanishing. Your labels, keys, schemes and notes stay. Vallic Cloud signs in with a code you approve in the browser, and its environments become hosts that sign in the way vallic ssh does.
Clouds are set up on the desktop. The hosts they make sync to your other devices.
| Cloud | Listed through | Machines without a public address |
|---|---|---|
| AWS | aws | Session Manager, an EC2 Instance Connect Endpoint, or a jump host |
| Google Cloud | gcloud | IAP, or a jump host |
| Azure | az | A jump host |
| Hetzner Cloud | hcloud | A jump host |
| DigitalOcean | doctl | A jump host |
| Vallic Cloud | Its console, after you sign in | Its own jump, as vallic ssh |
Imports
Bring your hosts from the client you use now.
Hosts → Import reads your OpenSSH config, PuTTY’s saved sessions, Royal TS documents, and CSV exports such as Termius’ template. Each import shows a preview first and never changes the original.
Keys come along into the vault, jump hosts and proxy commands carry over, and groups, tags and notes stay as they were.
| From | What comes along |
|---|---|
| OpenSSH | ~/.ssh/config and what it includes: hosts, IdentityFile keys, ProxyJump, ProxyCommand, agents, certificates and ForwardAgent |
| PuTTY | Saved sessions from the registry, ~/.putty/sessions or a .reg export, their .ppk keys, and SSH proxies as jump hosts |
| Royal TS | .rtsz and .rtsx documents: folders as groups, users and keys. Passwords stay behind, because Royal TS encrypts them |
| CSV | Termius’ import template, or another manager’s export, matched by column header |
Terminal
A terminal that knows which host it’s on.
Split panes and broadcast
Split a tab beside or below, open the same host or another, and send your typing to every pane at once when you need to.
A scheme per host
Seven built-in terminal schemes, or your own from Ghostty, Alacritty, iTerm2 or Windows Terminal. Production hosts get a red PROD tab.
Snippets
Keep the commands you retype in the vault. Paste or run one in the active terminal, or in every pane at once.
Session logs
Record what a host’s sessions print, encrypted in the vault. Play it back at up to 8× speed, or save it as an asciinema .cast file.
Sessions that survive
Tabs reconnect by themselves once the network is back. Keep a tab’s session on the server in tmux, and a dropped connection loses nothing.
The route bar
Every tab shows how it got there: VPN, jump hosts, host, and the key or CA that vouched for it. Files, snippets and logs are one click away.
Files and tunnels
Next to the terminal, not in another app.
SFTP side by side
Local and remote panes. Drag files in from your desktop, move folders recursively with progress, cancel or replace, rename and change permissions.
Port forwarding
Local, remote and SOCKS5 forwards, saved in the vault and started from the sidebar. MorphGate warns when one would listen beyond this computer.
Attachments
Keep files with a host, up to 20 MB each, encrypted in the vault and synced with it.
Hundreds of hosts, still easy to find
Groups give their hosts defaults: an identity, a jump host, a VPN, a scheme. Identities keep a user and how it signs in in one place for many hosts. Search by name, address, user or tag.
Select several hosts, keys or snippets at once to delete them, move them to a group, or move them into a team’s vault. A jump host travels with the hosts behind it.
Locked when you step away
Everything lives in an encrypted vault on your device, behind your master password and a recovery key. Unlock with the system keychain, after Touch ID, Windows Hello or your fingerprint on Linux.
The vault locks itself after 5 minutes to 4 hours idle, and locking closes every terminal, file browser, tunnel and VPN.
Platforms
On the computers you use today.
iOS and Android are next.
Linux, macOS and Windows
AppImage, deb and rpm. One universal dmg for Apple silicon and Intel. An installer, or an MSI for managed installs.
Signed updates
The app checks at launch and twice a day, and installs only updates signed with the project’s key.
morphgate:// links
A link opens an invite, a team or a filled-in connection form. It never connects or joins by itself, and waits while the vault is locked.
Sync
Your vault on every device
End-to-end encrypted sync through morphgate.com or a server you run. The server only ever stores ciphertext.
Teams
Shared vaults for your team
Hosts, keys and VPNs shared with view, edit or manage access, members checked by fingerprint, and offboarding that rotates keys.