Connections

Connections are saved SSH host profiles. Each profile has an identity, authentication method, optional folder, and optional advanced routing. Zync keeps this information on your desktop unless you choose an optional sync workflow.

Add a host

From the welcome screen, choose New > New Host. In the connection form, enter:

• Name: an optional display label such as Production; an empty name uses the host.
• Host: a hostname or IP address.
• Port: the SSH port, which defaults to 22.
• Username: the remote account name.

Choose Save to keep the profile, or Save & Connect to save it and open a session. Back returns to the initial new-host/import chooser while retaining the draft. Optional appearance and advanced settings can stay collapsed until you need them.

Authentication

The form offers Password and SSH key authentication. Saved credential appears when a local Vault is available. Certificate authentication and per-host network-interface selection are available in Zync 2.37.0 and later.

Password

Enter the remote account password. If a Vault is available, choose one of these storage options:

• On this host saves the password with the host record. You can move it to the Vault later.
• Save to Vault creates an SSH password item and links the host to it. The password is not kept as plaintext on the host record.

For a host that already has a Vault credential, choose Saved credential > Existing and select it instead. Read Vault for encrypted credential storage details.

Private key

Use SSH key > File to browse to an existing key file. Zync stores the path and reads the file when connecting. Use SSH key > Paste to paste PEM or OpenSSH key text. On save, Zync writes pasted local key content to a managed file under its data directory and stores the path on the host.

Zync inspects the selected or pasted key locally. For an encrypted key, enter its key passphrase when prompted. You may leave it blank while saving and provide it when you connect. The retention choice controls where that passphrase goes:

• Ask every time keeps it for the active connection only.
• Remember this key on this device stores it in the operating system credential store.
• Save to Vault stores the key and passphrase in the encrypted Vault when you save the host.

The key passphrase is different from the Vault passphrase. An encrypted private key needs its valid key passphrase before Test connection can verify it. You can explicitly forget a remembered key passphrase from the connection form.

Vault

When Vault is available, choose Saved credential and then one of:

• Existing to attach an existing password or private key credential.
• Paste to add private key text and an optional key passphrase.
• Import file to read a private key file into Vault.

Vault must be unlocked to save a pasted or imported key. Zync encrypts the credential in the on-device Vault and links the host to it. Testing a pasted or imported key does not write it to Vault until you save.

Vault is optional

You can create and use connections without Vault. Configure it later when you want encrypted local storage or want credentials available for an optional sync workflow.

OpenSSH user certificate

For key authentication, choose Add certificate file and browse to the matching OpenSSH user certificate, usually named id_ed25519-cert.pub. This is the certificate for your user key, not a TLS certificate or the CA’s private key. Password authentication does not use a certificate.

The host stores the certificate’s file path and reads it when connecting. Zync checks that it matches the selected private key, has a valid CA signature and is within its validity period. The SSH server still decides whether to trust that CA, principal and certificate options. Server host-key verification remains separate.

If the selected Vault SSH key already has a certificate, the form identifies it. A certificate file chosen for this host overrides that attachment. Invalid or expired configured certificates fail rather than silently falling back to bare-key login.

Renew an externally managed certificate at its file path, or explicitly replace a Vault attachment, then reconnect. Existing SSH sessions are not reauthenticated automatically. See Vault certificates for attachment and renewal behavior.

Test a connection

Select Test connection in the connection form to verify the host and selected authentication before saving. Zync checks private key material locally and requires a usable passphrase for encrypted keys. A local pasted-key test uses a temporary file that is removed after the test. Vault paste and import tests do not write a Vault item until you save. Editing connection inputs clears old test feedback so an earlier success cannot validate the changed settings.

Testing is useful for catching a wrong host, port, username, key path, or passphrase before creating a saved profile. It does not replace the server’s host-key verification step during the real connection.

Network interface

Under Advanced > Network interface, choose how this device opens the SSH connection on Windows, Linux or macOS:

Choice	Behavior
System default	Use the operating system’s normal route.
A listed adapter	Bind the SSH socket to that adapter. Names, descriptions and addresses help distinguish Wi-Fi, Ethernet and virtual interfaces.
Ask every time	Choose an adapter for each explicit connection attempt. Automatic transport recovery retains the selection used for that connection.

This preference stays on this device. Adapter availability can change after moving networks or reconnecting a VPN. A missing adapter or denied binding permission produces an error instead of silently using another interface. Adapter labels come from the OS: a VPN can have a name such as Ethernet 3.

OS routing and VPN policy still apply, and DNS uses system settings. Selecting an interface does not start a VPN or provide a VPN kill switch. With jump hosts, the selection applies to the first local TCP hop; subsequent hops originate from the remote hosts.

Jump hosts

To reach a private host through a bastion, expand Advanced and choose a saved connection under Jump Server (Bastion). Zync connects through that saved SSH host before opening the target session. The jump host can use credentials different from the target host because each hop resolves its own saved authentication.

Zync warns when a jump selection would create a loop. Save the jump host first if it does not exist yet, then return to the target host and select it.

SSH agent forwarding

Agent forwarding is separate from jump-host authentication. Under Advanced, enable it explicitly and choose one saved private-key connection whose key may be offered to the remote session.

Every signature request requires a decision: Allow once, Allow for connection, or Deny. Requests time out after 30 seconds. Zync shows the immediate saved connection account, but it cannot authenticate the ultimate downstream destination that may request a signature. Review every request and use SSH Agent Forwarding for the complete trust model.

Host-key verification

The first connection to a server asks you to verify its SSH host key. Compare the fingerprint with a trusted source before accepting it.

If a known host later presents a different key, Zync blocks the connection and shows the changed-key warning. Update and connect only after confirming that the server was intentionally rebuilt or its key was rotated. An unexpected change can indicate that the endpoint is wrong or the connection is being intercepted.

Import connections

For a complete move from an existing setup, follow Move to Zync. It covers SSH config limitations, credentials, tunnels, and checks before switching clients.

The New Connection chooser includes Import Config for SSH configuration files and Import File for exported connection data.

SSH config

SSH config import can read the default ~/.ssh/config, a custom SSH config file, or pasted SSH config text. It recognizes common fields including Host, HostName, User, Port, IdentityFile, CertificateFile, and ProxyJump. Select the entries to import and choose how to resolve conflicts:

• Import as New creates another saved host.
• Update Existing updates the matching host.
• Skip leaves the existing host unchanged.

ProxyJump entries are resolved into Zync jump-host relationships when possible. CertificateFile is imported alongside IdentityFile; when multiple certificate files are declared for one host, Zync keeps the first and warns that the single-certificate model cannot represent all candidates. Quoted paths are supported. Import does not import a key passphrase. If an imported identity file is encrypted, Zync asks for the passphrase when you connect and can then use it once, remember it on this device, or move it into Vault.

Connection files

Import a previously exported Zync, JSON, or CSV file. The import can include folders and connection metadata. Imported hosts with plaintext credentials are called out so you can move those credentials into Vault.

Check imported credentials

Only import files from a source you trust. Review hostnames, usernames, key paths, and any included secrets before connecting.

Export connections

Use the connection export action to select hosts, choose a file name, and choose one of these formats:

• Zync Format for a Zync connection exchange.
• JSON or CSV for general data exchange.
• SSH Config for standard SSH configuration output.

Exports never include Vault contents. The optional Include secrets checkbox can include host passwords and private key paths in the exported connection data. Leave it unchecked unless you have a specific secure transfer need, and protect any exported file that contains credentials.

Folders

Choose New > New Folder from the welcome screen to create a folder. Folders can have tags. You can also assign a host in the connection form under Appearance (Optional) > Folder (Optional). Drag saved hosts into folders in the sidebar, and use the folder controls to expand, rename, move, or delete folders.

Folder structure is part of the saved connection data and can be included when exporting connection data.

All Hosts and remote records

When optional Sync & Backup is connected and unlocked, All Hosts can show three locations for the same logical catalog:

Location	Meaning
Local	The host is available on this device.
Remote	An encrypted provider record exists, but the host is not materialized locally.
Local and remote	Both locations refer to the same logical host.

Use Keep to bring a remote host onto this device. Use Keep and open to materialize it and open the workspace. Referenced credentials and jump-host relationships must also be available locally or restored intentionally. Read Sync & Backup before applying a broader restore.

Secure an existing credential

Older or imported host records can still contain an on-host password or a local key path. Use the connection credential controls to move supported secret material into the optional Local Vault. The host then keeps a stable credential reference instead of owning the raw secret.

Connection privacy

Zync uses display names in list surfaces by default. Enable the host-address privacy setting in Zync settings when you want raw hostnames or IP addresses shown in the sidebar and connection pickers. Connection details still contain the complete endpoint needed to connect.

Common problems

• Connection refused: check the server’s SSH service, host, port, and firewall.
• Key authentication failed: confirm that the selected private key matches the public key authorized on the server and that Zync can read the path.
• Encrypted key prompt: enter the key passphrase, or choose a retention option after it is verified.
• Jump host unavailable: test the bastion connection separately and confirm that it can reach the target host and port.
• Imported host has no usable credential: assign a local key, password, or Vault credential before connecting.