00m · surface

The calm SSH workspace
that never phones home.

Cove is a local-first SSH & SFTP workspace for macOS, Windows, iOS, and Android. Hosts, private keys, and notes live in an encrypted vault on your device — a real terminal, a real file browser, and no account required.

Download for macOS Download for Windows

macOS 11+ · Apple Silicon · Intel build · Windows 10+ · Android & iOS coming soon

No account
No telemetry
No cloud sync

Cove workspace with the encrypted host rail and quick-connect suggestions — The Cove workspace — encrypted host rail, quick-connect, live session tabs.

−40m · the reef

The whole toolkit, already aboard.

Everything in v1 is finished, local, and working — not a roadmap. Eight years of SSH muscle memory, packed into one calm app.

Encrypted local vault

Hosts, keys, and notes sealed in an on-device SQLite vault — Argon2id key derivation, XChaCha20-Poly1305 item encryption, one master password.

Host management

Groups, tags, favorites, recents, and search. Duplicate hosts, quick-connect from the rail, or jump anywhere with the ⌘K palette.

SSH keys

Generate Ed25519 keys or import OpenSSH/PEM with optional passphrases. Copy public keys straight into authorized_keys.

Real terminal

russh PTY sessions rendered in xterm.js with WebGL — multiple tabs, scrollback, ⌘F search, copy/paste, and one-click reconnect.

SFTP built in

Browse, upload, download, rename, and preview files over the same connection. Drag-and-drop uploads with a cancellable transfer queue.

Every screen size

A desktop rail with split terminal/files, or full-screen sessions on phones with a Ctrl/Alt/Esc/Tab/arrow accessory bar.

Safety rails

Inactivity auto-lock, clipboard-only secret entry when a password isn't stored, and a first-run security briefing.

Backup & reset

Export an encrypted .covebak snapshot and restore it anywhere. A typed-ERASE reset starts fresh. No plaintext export, ever.

−160m · the shelf

Two panes, one connection.

The terminal and the file browser share a single SSH session. Start a shell, dock SFTP beside it, and drag a file up while a deploy script runs — no second connection, no extra handshake.

Two SSH terminal tabs connected to demo hosts — **Multiple SSH sessions.**Keep several hosts connected at once, each in its own tab — with search, scrollback, and reconnect.

SFTP file browser docked beside a live terminal — **Files beside the shell.**Browse, upload, download, rename, delete, and preview — all over the same connection.

−480m · the grotto

Every screen, real UI only.

Ten more windows from the app — the same build you download, captured with a demo vault. No live credentials, no hostnames, no staging. Tap any screen to view it full-size.

Command palette searching hosts for prod — ⌘KKeyboard-first navigation.⌘K searches hosts and runs workspace actions without reaching for the mouse.

Remote README.md opened in the text preview dialog — previewRemote previews.Read a text file over SFTP before downloading it, then copy the contents or save a copy.

hostsHost profiles.Groups, tags, colors, notes, and password or key authentication — all sealed in the vault.

SSH key manager listing Ed25519 and RSA keys — keysSSH keys.Generate Ed25519 keys or import OpenSSH/PEM, with optional passphrases and one-copy public keys.

Known hosts dialog listing pinned fingerprints — tofuPinned host keys.Trust-on-first-use fingerprints stay visible, with the last time each host was seen.

First-connection prompt asking to trust an unknown host key — trustExplicit trust.An unknown host key stops the connection until the fingerprint is confirmed.

Settings dialog showing auto-lock and master password controls — settingsSettings.Inactivity auto-lock, keychain remember on desktop, master-password rotation, and the deliberate no-sync state.

First-run security briefing explaining the vault model — briefingSecurity briefing.A first-run confirmation explains what is encrypted — and what Cove cannot recover.

Create vault screen with the master password strength meter — vaultCreate the vault.A master password wraps the vault key locally; a strength meter tracks progress.

Unlock vault screen with an optional remember-this-device toggle — unlockUnlock on launch.Enter the master password, or let the OS keychain remember the vault key on desktop.

−1,200m · midnight zone

Cryptography first, recovery never.

Losing the database file does not expose credentials — and no one, including us, can recover a lost master password. That is the deal the vault makes with you, stated on first run.

The master password is stretched with Argon2id — 64 MiB, 3 iterations, 1 lane.
A random 32-byte vault key, wrapped with XChaCha20-Poly1305 under that key.
Every item gets a fresh 24-byte nonce; its record id is bound in as AAD.
SQLite stores only ciphertext, ids, kinds, nonces, and timestamps.
Private keys are generated and held in Rust — never sent back to the webview.
Host keys pin on first use; a changed key is rejected until you replace it.
Locking clears the vault key and tears down every SSH and SFTP connection.

cove — vault inspect

$ cove vault inspect

key derivationArgon2id · 64 MiB · 3 iters

vault key32 random bytes · wrapped XChaCha20-Poly1305

per itemfresh 24-byte nonce · record id as AAD

sqlite seesciphertext + ids + timestamps

private keysgenerated in Rust · never cross IPC

host keysTOFU · changed keys rejected

lockclears vault key · drops all connections

recoverynone · keep an offline backup

No reset link. No recovery email.

Back up the vault with an encrypted .covebak snapshot — it opens only with the master password that created it, and a pre-import copy of the current vault is always kept on disk. If the password is ever lost, a typed-ERASE reset clears the vault and keychain and starts over. There is no plaintext export — the sea keeps its secrets.

−6,100m · the hadal zone

The whole cove, in your pocket.

The whole cove is headed to phones — Android and iOS are coming soon. The same webview UI and the same Rust core will run there, with the vault staying local: the master password is simply asked at every cold start, since there is no secure-storage plugin on mobile yet.

Cove host list on a phone — **Hosts**Grouped, searchable, and favorited.

Full-screen terminal with the mobile accessory bar — **Terminal**Full screen, with Ctrl/Alt/Esc/Tab/arrow keys.

SFTP browser taking over the phone screen — **Files**The SFTP browser takes over when opened.

−8,210m · the trench

Free to explore, licensed to work.

At home, Cove costs nothing. At work, a one-time license covers commercial use — no subscription, no seat games, no cloud to phone.

founder price · one-time

Cove for work.

$3.9one-time

Locked forever. The price rises as Cove leaves beta — early licenses keep their price.

Commercial usage rights
All current features
1 user, up to 3 devices
Free updates
7-day refund

Buy license

Cove is free for personal, educational, and non-profit use — every feature. Working with it? A license keeps development going.

Can I use Cove at work? Yes — that is exactly what the license covers. One license per user, on up to 3 devices.

Is it a subscription? No. It is a one-time payment, and the license stays valid forever — free updates included.

Refunds? Within 7 days of purchase, no questions asked — email sipamungkas.dev@gmail.com. The full flow is on the refund policy page.

The full terms live in the Cove License Agreement· changed your mind? Refund policy

−10,911m · challenger deep

Ready to descend?

Direct downloads, straight from the CrabNebula CDN — no account, no store, no waiting. Android and iOS are on their way.

macOSApple Silicon DMG macOSIntel DMG WindowsInstaller

AndroidComing soon

iOSComing soon

macOS isn't notarized yet, so Gatekeeper stops the very first launch — it's a one-time 30-second allowance. Seethe first-launch guide. Every download always serves the latest published version.

built withTauri 2React 19TypeScriptTailwind CSS 4RustArgon2idXChaCha20-Poly1305

Delivered by the CrabNebula CDN · always the latest version · Android & iOS coming soon

+10,911m · the ascent

macOS asks once, then remembers you.

Cove isn't notarized with an Apple Developer signature yet, so Gatekeeper stops the very first launch. That is a generic gate for unsigned apps — not a malware finding. Here is the 30-second way through.

01
Install the app
Open the downloaded DMG and drag Cove into Applications. The first double-click is stopped by Gatekeeper — dismiss the dialog it shows; there is nothing to confirm in it yet.
02
Open Anyway in System Settings
Go to System Settings → Privacy & Security and scroll to the Security section. Under “Allow applications from”, macOS notes that “Cove” was blocked — click Open Anyway.
03
Confirm — not Move to Trash
Authenticate with Touch ID or your login password, then click Open Anyway in the Open “Cove”? sheet. Cove starts, and macOS remembers the decision: the warning never appears again.

System Settings → Privacy & Security showing “Cove” was blocked to protect your Mac, with the Open Anyway button — Step 2 — the Open Anyway button in Privacy & Security

The Open “Cove” confirmation sheet with Move to Trash and Open Anyway buttons — Step 3 — confirm Open Anyway, not Move to Trash

Terminal alternative

On macOS 15+ the old right-click → Open shortcut no longer bypasses Gatekeeper. Terminal users can skip the dialogs by clearing the download quarantine flag instead — only for apps from a source you trust:

xattr -dr com.apple.quarantine /Applications/Cove.app

Updating later? Drag the new DMG over the old app — the vault and its data live separately and survive every update untouched.

More detail — picking your build, updating, uninstalling — lives in thefull macOS install guide.