Credentials and vault

Secret	Purpose	Scope
Master password	Opens this device's vault	May differ per device
Account password	SSH password authentication	Bound to a connection target
Key passphrase	Decrypts a private key	Bound to a key
One-time password (TOTP)	Answers a keyboard-interactive verification challenge	Bound to a connection target

Sync uses a separate encryption key.

Create labelled account passwords under Menu → Vault → Account passwords and assign them to connections. Editing decrypts the saved value back into the form. An account password starts masked and can be checked and edited after revealing it. Leaving the page, locking the vault, or saving discards plaintext UI state.

The assigned password is reused when the same connection is opened from the terminal, SFTP, a ProxyJump route, or the CLI. It does not need to be configured separately for each feature.

Choosing Enter when connecting as the authentication method of a new connection stores nothing in the Vault, and the terminal asks for the password when connecting. When a password typed in the terminal connects, sshc asks once whether to save it to the Vault for this connection. After Don't save it no longer asks for this connection; to save one later, set it under Basic in Connections.

Key passphrases can be saved, edited, and removed per private key. A ProxyJump route resolves credentials independently for every hop and the final host.

Choose vault protection

During setup or in Settings → Vault, choose password protection or use without a password. Passwords require at least four characters; digits alone are accepted. Short passwords offer limited protection if local files are copied.

Without a password, sshc opens the vault automatically on startup and relies on your OS account and device security for local protection. Automatic and manual locking do not apply; the vault stays unlocked. Sync keeps using its independent encryption key. Switching protection modes preserves saved credentials.

Automatic TOTP entry

First, store a Base32 setup key or an otpauth://totp/... URI with Add under Menu → Vault → OTP. The page lists one token per row: its name and assigned hosts, the current six-digit code, and the time it has left. Select a code to copy it. The previous and next codes, and the assigned hosts (with a way to remove each assignment), open from the row's … menu. Then open the target under Connections and select the saved token from Basic → Authentication → One-time password (TOTP). You no longer need to type a host alias to create the assignment.

The Vault is split into Account passwords, Key passphrases, and OTP pages so each list and registration form stays focused. The same TOTP entries can be managed from the CLI with sshc otp list|show|add|edit|remove.

sshc generates a current code only for a keyboard-interactive question that explicitly says OTP, TOTP, Verification code, or an equivalent phrase. For example, Verification code: is recognised. Some servers mark this input as visible; sshc supports that flag without printing the automatically supplied code in the Terminal. It does not send the seed or a code to an ambiguous Code prompt or an ordinary password prompt.

The assignment applies to Terminal, SFTP, sshc ssh (interactive or --non-interactive), and each ProxyJump hop. The next section describes what happens when the destination or the route changes.

Factor separation

Keeping an account password and a TOTP seed in the same device vault is convenient, but a compromised device may expose both factors. Use this only when your organisation's security policy allows it.

When the destination changes

An account password or TOTP assignment is bound to the destination and the route it resolved to when it was assigned. If any of the following changes, sshc stops using the assignment so that the secret does not reach an unintended peer:

• HostName, User, Port
• ProxyJump hops and ProxyCommand
• StrictHostKeyChecking, HostKeyAlias, HostKeyAlgorithms, the authentication methods, ForwardAgent
• The VPN profile attached to the connection: attaching one, detaching it, replacing it with another profile, or deleting the attached profile

The VPN profile is included because the same HostName can be a different machine on the network of another VPN. Attaching a profile recreated under the name of a deleted one does not bring the assignment back, even when the profile was detached from the connection before it was deleted. Renaming or editing a VPN profile keeps its assignments working. To move a connection to a VPN on another network, create a new profile and attach it instead (Per-connection VPN).

An account password that stopped is shown in the authentication part of the connection's Basic tab. Pressing Save Basic settings under Basic asks for confirmation, and Save and confirm makes the assigned password and one-time password work with the changed destination.

Lock and change the master password

sshc vault status
sshc vault lock
sshc vault change-password

Locking the Vault does not close existing SSH sessions, but blocks new secret operations. A password-protected Vault locks after 12 hours of inactivity by default; Settings → Vault can change the duration for each preset or disable automatic locking. A passwordless Vault is never auto-locked.