Get started

dssh wraps your system ssh binary with a TUI, a tiny CLI, and a SQLite store at ~/.dssh/dssh.db. Zero daemons, one static binary, nothing to edit by hand unless you want to.

Requirements

• ssh client in PATH (OpenSSH on Linux/macOS/BSD, OpenSSH for Windows on Win10+)
• A terminal that handles TrueColor + Unicode for the TUI — most modern terminals qualify
• Only if building from source: Go 1.26+

Install

Universal

# Unix (Linux, macOS, FreeBSD)
curl -fsSL https://raw.githubusercontent.com/madLinux7/dssh/main/install.sh | sh

# Windows PowerShell
irm https://raw.githubusercontent.com/madLinux7/dssh/main/install.ps1 | iex

Unix installs to ~/.local/bin (override with INSTALL_DIR=/custom/path). Windows installs to %LOCALAPPDATA%\dssh and patches PATH.

AUR

yay -S dssh
# or
paru -S dssh

Homebrew

brew install madLinux7/tap/dssh

winget

winget install madLinux.dssh

scoop

scoop bucket add madLinux7_scoop-bucket https://github.com/madLinux7/scoop-bucket
scoop install madLinux7_scoop-bucket/dssh

From source

go install github.com/madLinux7/dssh/cmd/dssh@latest

Or clone and build:

git clone https://github.com/madLinux7/dssh.git
cd dssh
make build     # static, CGO-free binary
make release   # + UPX compression (needs upx)

Verify the install:

dssh --version

First run — pick a storage mode

The first time you launch dssh, a one-time dialog asks where to keep connections. Pick whichever fits — you can change it later with dssh config.

Mode	Stores connections in	When to pick it
SQLite	~/.dssh/dssh.db (encrypted passwords supported)	Clean slate, you want passwords + portability in one file
ssh_config	~/.ssh/config or a path you choose	You already live in ssh_config and want to keep it the source of truth
Both	SQLite and ssh_config, toggle with Ctrl+L	Mixed: keep team-shared hosts in ssh_config, personal/password hosts in SQLite

Note

Password auth is SQLite-only. ssh_config entries always use key auth — that’s an ssh_config limitation, not ours.

When picking ssh_config or Both, you’ll also choose a destination file: the main ~/.ssh/config, a directive file like ~/.ssh/config.d/dssh, or any custom path. If the file doesn’t exist, dssh offers to create it.

Your first connection

1. Add a host via CLI — quickest path, uses your default pubkey:

   dssh add myserver root@192.168.1.10

   Or go interactive with the wizard:

   dssh create

2. Connect — name alone, nothing else:

   dssh myserver

   You’re in. On Unix, dssh syscall.Execs into ssh — zero wrapper overhead, full terminal control.

3. List what you have:

   dssh ls

   NAME        USER  HOST           PORT  AUTH  DIR  JUMP
   myserver    root  192.168.1.10   22    key   -    -

Password-authenticated hosts

For hosts without key auth, save the password encrypted:

dssh add prod-box deploy@10.0.0.5 'hunter2'

First time you save a password, dssh prompts you to create a master passphrase. That passphrase drives Argon2id key derivation; the resulting AES-256-GCM key encrypts every stored password. Your passphrase itself is never written to disk — a verification token proves correctness on later unlocks.

Caution

Forget the master passphrase and the encrypted passwords are unrecoverable. dssh reset wipes the DB and lets you start over; key-based connections and ssh_config entries are not touched.

Prefer key auth whenever you can — it’s faster to launch (process replacement, not a child) and leaves no secret at rest.

Run the full TUI

No arguments, no sub-command — just:

dssh

Four tabs: Connect, Create, Edit, Delete. Switch tabs with Tab / Shift+Tab or ← / →, pick with Enter, quit with Esc or Ctrl+C. See the TUI keys reference for the full map.

Where to next

Command reference Every flag, alias, and example for the CLI.

TUI keys Keybindings for each tab and modal.

Configuration Parse modes, session flags, file locations.

Security model How encryption, passphrases, and key derivation work.

Troubleshooting Permission denied, lost passphrase, WSL quirks.

Migration From ssh_config, across machines, between modes.