WebSSH

Self-hosted SSH + SFTP

Your servers.
Your browser.
Your control.

WebSSH brings terminal sessions, file transfers, saved connections, and team access into one secure workspace you run yourself.

Start with Docker See the workspace
  • No telemetry
  • Local browser assets
  • MIT licensed
webssh / deployready
One containerPersistent dataLocal assets
SSH + SFTPTerminal and file workflows
Multi-userSeparate accounts and data
EncryptedStored private keys
Offline-readyNo runtime CDN dependency

Current capabilities

The daily server workspace, in one tab.

Connect, move files, organize repeat work, and give each user their own secure environment.

01

Saved Connections

Keep hosts, usernames, authentication choices, jump hosts, and optional post-connect commands ready for the next session.

  • Jump hosts
  • Recent connections
  • Command sets
02

Terminal workspace

Work across tabs and split panes, or focus one Linux server with its terminal, live resource status, files, and notes together.

03

SFTP file manager

Open SFTP beside the active terminal or use the full dual-pane manager for previews, editing, and server-to-server transfers.

04

Identity options

Use local accounts with bcrypt passwords, optional passkeys, recovery codes, or optional OpenID Connect with PKCE.

05

Operations built in

Manage users, review structured audit events, control registration, and create or restore verified backups.

One workspace

Your active server stays in context.

Keep one Linux terminal, its SFTP files, live resource status, and notes visible together. Switch to two or four SSH panes when the task needs more hosts.

Active server workspaceSSH + SFTP + live Linux status
WebSSH active server workspace with SSH terminal, SFTP files, Linux resource status, and notes
SFTPDual-pane file manager
WebSSH dual-pane SFTP file manager
Transfer between connected servers, inspect files, and track operations in one view.
Key managementPer-user storage
WebSSH SSH key management screen
Import and organize SSH keys that WebSSH encrypts at rest for the owning user.

Security by ownership

Keep access close to the infrastructure it manages.

WebSSH runs inside your environment. Accounts, connection data, keys, audit events, and backups remain on the storage you control.

Read the security documentation

Encrypted key storage

Stored SSH private keys use per-user key derivation and authenticated encryption.

Host trust and isolation

Persistent host-key checks, session ownership guards, CSRF protection, rate limits, and security headers protect key boundaries.

Local delivery

Browser libraries are pinned and shipped with WebSSH. The product interface does not load a runtime CDN or send telemetry.

Architecture, honestly

A focused gateway, not another control plane.

WebSSH terminates browser sessions and opens SSH or SFTP connections to your targets. Live session and quota state is process-local, so the application must run with one worker.

  1. 01BrowserVendored UI assets
  2. 02WebSSHAuthentication and session boundary
  3. 03Your hostsSSH and SFTP targets

Scale boundary: run exactly one application worker. Horizontal scaling requires externalizing live session and quota state first.

Quick start

From image to first login in one command.

Run the published container with a persistent data volume, then create the first administrator at http://localhost:5000.

Do not expose a fresh, unclaimed instance to an untrusted network. Complete the first-account bootstrap before publishing it.

Docker
docker run -d \
  --name webssh \
  -p 5000:5000 \
  -e CORS_ORIGINS=http://localhost:5000 \
  -v webssh_data:/app/data \
  --restart unless-stopped \
  ghcr.io/bifrost0x/webssh:latest

Run it your way

A practical SSH workspace, under your control.

Get the container Browse the source