Skip to content

Credentials

Jump to bottom
Mehdi edited this page Sep 2, 2026 · 6 revisions

Credentials

SSH Pilot can remember your passwords and SSH key passphrases so you don't have to type them every time. It integrates with several popular credential managers.

How It Works

When you connect to a server:

  1. OpenSSH asks for a password or passphrase
  2. SSH Pilot checks your chosen credential manager
  3. If the password is saved, it is provided automatically
  4. If not, a dialog appears asking for the password
  5. If you check "Save password", it is stored in your credential manager for next time

Why this is safe: Secrets stay in real vaults and reach OpenSSH through askpass — not plaintext config or terminal typing. See Security.

Choosing a Credential Backend

Open Settings > Security to choose where SSH Pilot stores credentials.

Available Backends

Backend Best for Notes
System Keyring (libsecret) Linux desktop users Default on Linux. Uses GNOME Keyring or KDE Wallet. Unlocks automatically when you log in.
System Keyring Alternative keyring Uses Python's keyring module
KeePass Offline users Stores credentials in a .kdbx database file. You provide the master password.
Bitwarden / Vaultwarden Multi-device users Cloud or self-hosted. Syncs across machines.
Bitwarden via rbw rbw users Uses the rbw agent for Bitwarden
pass Unix traditionalists Uses the standard Unix pass password store with GPG
SSH Agent Only Minimalists No persistent storage. Keys stay in the SSH agent only.

Bitwarden / Vaultwarden users: See the dedicated Bitwarden & Vaultwarden page for detailed setup, the rbw backend, backup storage, and performance notes.

Automatic Mode (Default)

In Automatic mode, SSH Pilot probes for available backends and picks the best one. On most Linux desktops, this will be libsecret (GNOME Keyring).

Setting Up KeePass

  1. Open Settings > Security
  2. Select KeePass as the backend
  3. Click Browse to select your .kdbx database file
  4. If your database uses a key file, browse for that too
  5. Enter your master password when prompted
  6. Click Connect to test

Your credentials will now be stored in your KeePass database.

Setting Up Bitwarden / Vaultwarden

  1. Open Settings > Security
  2. Select Bitwarden / Vaultwarden or Bitwarden via rbw
  3. Follow the setup wizard to sign in (email and master password, plus 2FA if enabled)
  4. Unlock the vault

For Vaultwarden, configure your server URL during setup. API key login is also available if you prefer it over interactive sign-in.

Full guide: See Bitwarden & Vaultwarden for rbw, backup secure notes, caching, and troubleshooting.

Warning: The Bitwarden backend is inherently slower than local backends like libsecret or KeePass. Every cold lookup may need a vault unlock or network sync. If you notice connections taking longer to authenticate, this is expected behavior. For the fastest experience, consider using libsecret (system keyring) or KeePass as your primary backend.

Setting Up pass

  1. Open Settings > Security
  2. Select pass
  3. Ensure the pass command is installed and initialized on your system
  4. SSH Pilot will use your default GPG key for encryption

Vault Lock Timeout

To automatically lock credentials after a period of inactivity:

  1. Open Settings > Security
  2. Set the Vault lock timeout (in minutes)
  3. After this many minutes of inactivity, credentials will be locked and you will need to re-enter your master password

Forgetting Saved Passwords

If you want to clear all saved credentials:

  1. Open Settings > Security
  2. Click Forget Saved Master Password
  3. Confirm the action

This removes cached credentials from SSH Pilot's memory. It does not delete entries from your credential manager.

Tips

Tip: Use libsecret (GNOME Keyring) on Linux for the smoothest experience. Credentials unlock automatically when you log in and are never exposed in plain text.

Tip: If you use multiple machines, Bitwarden sync lets you share credentials across all of them without manual export/import.

Tip: For maximum security, choose SSH Agent Only and use a hardware security key. No passwords are ever stored on disk.

Next Steps

Clone this wiki locally