Features

Vault and credentials

Encrypted vault

Connections, keys, passwords and known hosts live in one file, vault.age, encrypted with age and scrypt under a master password. The password is held in memory only while the vault is being unlocked. Attempts are rate-limited.

Recovery key

A 32-character key is shown once at vault creation, behind a dialog that cannot be dismissed early. It opens the vault in place of the password and is replaced after use. It has its own, stricter attempt counter. Nobody else can recover the vault.

Key manager

• Generate Ed25519, RSA and ECDSA keys; import, export and rename them.
• Publish a public key to a server's authorized_keys from the application.
• Per key: unlocked by the vault alone, or by a passphrase of its own, and how long that passphrase is remembered. The cache is cleared on lock and shutdown.

Agent forwarding

Off for every key until allowed in the key manager and then chosen per connection. Each signature is confirmed with the server, key, user and destination named. Only logins are signed. Jump hosts and plugin connections never receive the agent; every request is audit-logged by fingerprint.

Connections

Connection tree

Nested folders, drag and drop, favorites, tags and search. Every host shows a TCP reachability dot. A connection can be duplicated in one click and hold several users, one marked default.

Jump chains

Any number of bastion hops, each verified against known hosts. Works with IPv4, IPv6 and host names.

Import

• ~/.ssh/config, with ProxyJump converted to a jump chain.
• PuTTY sessions and .ppk keys.

Port forwarding

Rules belong to a connection, bind to 127.0.0.1 by default and can be disabled without deletion. Plugins may add tunnel providers after explicit consent.

Sessions and terminal

Tabs and tiles

Each tab has its own lifecycle. Drag a tab to split the workspace and see several sessions at once. A tile with two tabs renders only the visible one.

Reconnect

A dropped connection reconnects on its own and keeps the tab, its tile and the terminal output.

Search across terminals

Ctrl+Shift+F searches the whole scrollback of every terminal, with match case, whole word and regular expressions. Wrapped lines match, new output is followed, and the shortcut avoids Ctrl+F, which belongs to the shell.

Typing into several terminals

Alt+M numbers every open terminal; choose the targets and press Enter. Chosen terminals stay outlined in green, so it is always visible what a keystroke reaches. Each command is recorded in the audit log of every server it reached.

Scripts and commands

Presets for disk space, memory, listening ports, service status, containers and logs, plus your own. Each can carry its own hotkey. The editor flags an unclosed quote or heredoc before sending.

Local terminal

Ctrl+Shift+T opens a shell on your own machine, chosen from the shells actually installed. It is not reachable by plugins, its keystrokes are not recorded, and it survives a vault lock.

Shortcuts

All shortcuts are rebindable; a conflict is reported before saving.

Files

SFTP manager

• Upload, download, rename, delete, create files and folders.
• Change permissions and ownership, recursively, for files or folders only.
• Sort by name, size, date or owner; show hidden files.
• Drag files in from the system file manager.

Transfers

Parallel, with a configurable limit, a speed cap and a rule for files that already exist. Long deletes and recursive permission changes report progress in the same panel. Cancelling is clean.

External editor

A remote file opens in the editor set in Settings and uploads back when saved. Local files open from the same menu.

Trust and audit

Known hosts

Strict verification with no automatic accept. A changed key stops the connection and asks. Several keys per host, one per type, as OpenSSH keeps them; hashed known_hosts entries are understood.

Trusted peers

The same trust-on-first-use check for protocols other than SSH. Every recorded identity is listed with its date and can be revoked. Kept apart from known hosts in every layer.

Audit log

• Command history: every command submitted in an SSH session; copy it or re-run it.
• Program audit: what the application did, including trust decisions and refused plugin calls.
• Full-text search, filters by connection and session, masking of password-like input.
• Retention by age or count; privacy options for host and user names. Off by default.

Lockout

The vault locks from the lock button, and on idle or minimize if enabled. Open sessions stay connected; the passphrase cache is cleared.

Portability and interface

Data layout

Everything the application writes stays inside data/ next to the executable. Copy the folder and the whole setup moves with it.

xQuakShell.exe
data/
  vault.age            # encrypted vault
  audit.db             # audit log, if enabled
  plugins/<id>/        # each plugin and its own data
  sync/state.db        # only once sync is on
  locales/             # optional interface translations

Only one copy runs per folder, so two instances cannot overwrite each other's vault. Copies in different folders are independent installations.

Interface

• English and Russian, switchable at runtime. Add a language by dropping a JSON file into data/locales.
• Terminal font and colors, and an interface scale that reflows instead of zooming.
• Update check against GitHub releases, on startup or on demand.
• Windows build with a bundled WebView2 runtime for clean and offline machines.