Shellium 2.1.0 · Windows · macOS · Linux

The SSH workspace for people who run production.

Hundreds of hosts one keystroke away. Routine checks on color-coded buttons. File transfers that never write over a target in place. And every credential in a vault that is encrypted before it touches the disk.

Download Shellium Take the tour
  • AES-256-GCM vault
  • Verified host keys
  • xterm.js · ssh2
Shellium with four production sessions open: SQL*Plus output in the active Oracle tab, a production banner and a row of Oracle script buttons below the terminal.
0secrets stored in plain text
256-bitAES-GCM, bound to your OS account
1keystroke to any host: Alt+S (⌘S on a Mac)
3platforms from one codebase

Features

Everything an operations day needs, in one window.

Built for DBAs and on-call engineers who keep dozens of sessions open, switch between production and test all day, and cannot afford a mistyped paste.

A host directory that scales to hundreds

Folders, tags and environments such as PROD TEST DEV. Search by name, IP, user, tag or folder from Home or with Alt+S, keep favorites, and see your recent connections with one-click switch.

Home tab with environment filters, favorite hosts and a table of recent connections.

Tabs that tell you what matters

Tabs on top, left or right. Unread output turns a tab blue, a dropped session turns it red, and every production session carries a banner so you always know where you are typing.

Script buttons

Color-coded, grouped buttons for your routine checks, with send strings and escape tokens (\r, \p, \t). Run the first nine with Alt+1…9.

SFTP that respects production

  • Never writes a target in place: uploads go to a hidden .part file, then replace the original
  • Keeps the old file as name.bak-YYYYMMDD-HHMMSS (on by default)
  • Asks per file or for all: overwrite, keep both or skip
  • Pause, resume and cancel; a dropped connection pauses the queue, and a resumed file is checked against its source before continuing
  • Edit a remote file in your local editor; uploading refuses if the server copy changed meanwhile
  • Drag and drop between panes and from Explorer or Finder

Paste review

Anything with a line break opens an editable review first, exactly as copied, blank lines kept. Nothing reaches the server until you confirm, so a stray clipboard never runs on production.

Anti-idle, per host

Protocol NO-OPs and an optional keep-alive string, set per host or as a default, plus how many unanswered NO-OPs close a dead link. No silent auto-reconnect: you decide when to reconnect.

X11 forwarding

Run graphical installers and tools such as the Oracle Universal Installer through your local X server, enabled per host.

Session recording

Record a terminal session to a file you choose, for change records and post-incident notes.

Trusted host keys, in one place

Options › Security lists every key this device trusts, lets you remove one, and imports a standard known_hosts file so your existing trust carries over.

Colors that say where you are

Fourteen terminal color schemes, from Dracula and Nord to Solarized, plus your own. Give Production its own red-tinted scheme so a prod session never looks like test. Light and dark app themes, find-in-terminal.

Security

Your production credentials deserve better than a config file.

Shellium has no "no password" mode. Until you unlock it, it reads nothing: no hosts, no scripts, no keys.

  • Encrypted at rest, always. The connection database is written with AES-256-GCM. A modified file fails to open instead of being read.
  • Two keys, one of them never leaves your account. The vault key combines your app password with a key protected by the operating system: DPAPI on Windows, the Keychain on macOS, GNOME Keyring or KWallet on Linux. A copied file does not open on another computer or user account, even with the right password.
  • Host keys always verified. First connections show the SHA256 fingerprint with Cancel focused. A changed key is refused unless you confirm and replace it, for terminal and SFTP alike.
  • Modern algorithms by default. Current SSH client defaults. SHA-1 key exchange, ssh-rsa, CBC ciphers and hmac-md5 only for a host you mark as legacy, or after you answer a clear prompt. Never silently.
vault.spec
app password   required · at least 8 characters
database       AES-256-GCM · authenticated
local key      DPAPI | Keychain | libsecret
per value      passwords and scripts encrypted again
host keys      trust on first use · SHA256
export         .shellium · scrypt N=2^17 · AES-256-GCM
readable       none · no JSON, no header, no strings
linux          refuses to run without a keyring
recordings     plain text, only where you save them
Verify the server's identity: the first connection to a host shows its key type and SHA256 fingerprint, with Cancel, Connect once and Trust and connect.

Tour

See it before you install it.

Real screenshots of Shellium 2.1.0, taken with made-up hosts against a local test server.

Four production sessions side by side. The active one runs SQL*Plus from the Oracle script buttons; tablespaces above 80 % stand out.

Migrate

Bring your hosts with you.

File › Import reads other tools' exports. You map their fields once, review every conflict, and can undo the whole import until you close the wizard.

Known XML formatsRecognized and mapped for you · non-SSH entries left out
Any XMLMap Hostname, Port, Username… yourself
CSVSpreadsheets and exported host lists
.shelliumEncrypted export from another Shellium
  1. Pick the file. Known formats are recognized and the fields are filled in for you.
  2. Check the mapping. Choose a default username for entries without one; non-SSH entries are listed, not dropped silently.
  3. Review conflicts. Same host, port and user already here? Keep yours or update from the file. Only the fields the file carries change.
  4. Import, or undo. One transaction. Passwords from other tools are never read; Shellium asks when you connect.
Import wizard, Fields step: a known XML export recognized, with Hostname, Username, Port, Name, Description and Protocol mapped to Shellium fields.

Install

Up and running in a few minutes.

  1. Download Shellium-Windows-2.1.0-Setup.exe (64-bit, Windows 10 or 11).
  2. Run the installer. It installs for your user only, no administrator rights needed, and lets you choose the folder. If SmartScreen says Windows protected your PC, choose More info › Run anyway.
  3. Set the app password on first start (at least 8 characters). It unlocks the vault; there is no way to recover it, so keep it in your password manager.
  4. Add hosts: press Alt+S and New connection, or File › Import to bring them from another tool's XML export or a CSV.

Download

Shellium 2.1.0

One installer per platform. Your hosts, passwords and scripts stay on your own machines.

Windows

Windows 10 / 11 · x64 · installer

Download .exe Shellium-Windows-2.1.0-Setup.exe

macOS

macOS 10.15 or newer · disk image

Download .dmg Shellium-Mac-2.1.0-Installer.dmg

Linux

AppImage · x64 · needs GNOME Keyring or KWallet

Download .AppImage Shellium-Linux-2.1.0.AppImage

Questions

Good to know

What happens if I forget the app password?

The vault cannot be opened without it; that is the point. Keep the password in your password manager, and keep a .shellium export (protected by its own file password) as a backup.

How do I move to a new computer?

Use File › Export to create a .shellium file: choose folders, script categories, environments, options and trusted host keys, and decide whether saved passwords go in. Import it on the new machine. The database file itself only opens on the account that created it.

Does Shellium reconnect automatically when a session drops?

No, by design. A dropped session turns its tab red and tells you why; you reconnect when you decide to. Anti-idle settings help keep idle sessions alive through firewalls.

Which servers can I connect to?

Any SSH-2 server: Linux and Unix hosts, appliances and network devices. Older devices that only offer legacy algorithms work after you allow them for that host.

Is anything sent to the internet?

Shellium connects only to the hosts you open. Hosts, passwords, scripts and settings stay in your data folder on your machine.