An SSH password manager for the Mac

ssh-add --apple-use-keychain ~/.ssh/id_ed25519

Host *
  AddKeysToAgent yes
  UseKeychain yes
  IdentityFile ~/.ssh/id_ed25519

Where it stops. The Keychain entry is consumed by ssh-agent, and the agent only knows how to unlock keys. It cannot answer a server's password prompt, it cannot answer sudo, and it has nowhere to put a token or a note that your terminal will ever look at. Those three are the gap this page is about.

Why a general password manager still leaves a gap

The obvious fix is the password manager you already run — 1Password, Bitwarden, KeePassXC. It stores the secret properly, and for websites the browser extension delivers it without you ever seeing it. For a terminal there is no extension, so delivery falls back to you:

• The clipboard is shared. Anything running in your user session can read it, and clipboard-history utilities — the productivity kind, not malware — keep a copy after you paste. A secret that goes through the clipboard has been handed to every app on the Mac for as long as it sits there.
• Shell history is forever. A password passed as part of a command rather than typed at a prompt lands in ~/.zsh_history in plain text. The echo 'pw' | sudo -S … habit is the classic version, and it survives the session, the reboot and usually the laptop.
• The connection still has its own copy. The password manager holds the canonical secret, your SSH client holds a second copy in its saved connection. Rotating the first does nothing to the second — which is how a saved connection ends up authenticating with a password that was retired months ago.

The gap is not storage. It is the last two inches between the vault and the prompt.

What changes when the vault is inside the client

Noden 1.3 puts the vault next to the connections: the sidebar has two tabs, Connections and Vault. What that buys is not better encryption than 1Password — it is that the client can deliver the secret itself.

• Typed at the prompt, not pasted. Right-click in the terminal → Type Password from Vault, and the password plus Return goes straight into the waiting prompt — after sudo su, for example. It is sent as session input, so it never touches the clipboard and is never recorded in shell history.
• The connection references the secret. In the connection editor, Password source and Key source can point at a vault entry instead of storing a copy. The reference is resolved when you connect — terminal, SFTP, jump host (bastion) and RDP alike — so changing the password once in the vault updates every connection that uses it. That is credential rotation without touching a single connection.
• Touch ID on every read, with a grace window. Opening, revealing or copying a secret asks for Touch ID, falling back to your Mac password. After one successful check the vault stays open the way sudo does — Every time, After 5 minutes (default) or After 30 minutes, set in Settings → General → Security. The window lives in memory only, so quitting Noden closes the vault.
• Keychain only, and only this Mac. Secrets are written to the macOS Keychain marked device-only: not carried to iCloud, not carried into a Time Machine backup, never written to disk in plain text. The vault's own file holds metadata — name, username, URL, type — and nothing else.
• Clipboard that cleans up after itself. When you do copy a secret, it is cleared 30 seconds later unless you have copied something else in the meantime. On the detail card a stored secret is drawn as ten dots, so not even its length is on screen; Reveal… goes back through the Touch ID gate.
• Four kinds of secret, not just passwords. Passwords, SSH private keys (imported from a file or pasted in), API keys and tokens, and secure notes for the things that fit nowhere else — recovery codes, licence keys, the appliance password you need twice a year.
• A generator that avoids look-alikes. The wand button produces a 20-character password from the system's cryptographic random generator, about 120 bits of entropy, with O/0 and I/l/1 left out of the alphabet — because these get read aloud and retyped off a screen.
• An export that outlives the Mac. The whole vault goes into a password-protected, AES-GCM encrypted file that does not depend on the Keychain. Export a single connection and only the secrets that connection actually uses travel with it, so a colleague gets one server rather than your vault.

How Mac SSH clients store credentials

Every serious client on the Mac has thought about this, and they have landed in genuinely different places. The split that matters is local-and-device-bound versus encrypted-and-synced — neither is wrong, they answer different questions.

Read from each vendor's own site and documentation on 5 August 2026. These are the mechanisms each product describes; a blank where a feature is not listed means we could not source it, not that it is absent. Products ship often — check the source before deciding.

Read that table honestly and two things follow. If you work from a phone, a Windows box and a Mac, an encrypted-sync vault like Termius or Tempest is doing something Noden simply does not do — there is no account and no sync here, by design. And Royal TSX's credential objects already give you the reuse-across-connections benefit; the difference is where the secret rests and what unlocks it — the login Keychain and Touch ID here, an encrypted document and its password there.

Doing it in Noden, start to finish

1. Open the Vault tab in the sidebar and choose New Entry → Password, SSH Key, API Key / Token or Secure Note.
2. Fill in the name, username and server or URL. For a new password, press the wand to generate one; for a key, import the file or paste it.
3. In a connection's editor, set Password source (or Key source) to that entry instead of typing a password into the connection. Already typed one? Tick “Also save this password to the vault” and it becomes an entry the connection points at.
4. Connect as usual. At a sudo prompt, right-click → Type Password from Vault.
5. When the password changes on the server, edit the vault entry once. Every connection referencing it uses the new value on its next connect.
6. Vault tab → New Entry menu → Export Vault… for an encrypted copy that does not depend on this Mac's Keychain.

Full details, including the settings for the grace window, are in the documentation.

What a vault cannot do for you

Worth stating plainly, because a password manager that oversells itself is worse than none:

• Protection ends at the prompt. Once a password is typed into a terminal it belongs to the SSH session and the server at the other end. Anything that happens to it there — logging, a compromised host, a colleague reading over your shoulder — is outside the vault.
• Malware in your own account defeats any vault. Code running as you can wait for the Touch ID prompt you were going to approve anyway. This is true of every password manager on every platform; nobody's design solves it.
• There is no master password, on purpose. The Keychain already sits behind your macOS login password. A second password would give you a new way to lose every secret at once without adding protection above what the Keychain provides.
• It is macOS-only and does not sync. If you need the same secrets on a phone or a Windows machine, this is the wrong tool and a cross-platform encrypted-sync vault is the right one.
• A Mac account with no password cannot use it. Without a login password there is nothing for the Keychain to be tied to; Noden says so and keeps the vault closed rather than pretending.

Noden's vault at a glance

Stores	Passwords · SSH private keys · API keys and tokens · secure notes
Storage	macOS Keychain, device-only accessibility; no plain text on disk
Access	Touch ID or Mac password on every read; grace window of every time / 5 min / 30 min
Into the terminal	Typed into the prompt as session input — no clipboard, no shell history
Rotation	Connections reference a vault entry; one edit updates terminal, SFTP, jump host and RDP
Backup	Password-protected AES-GCM export of the whole vault, or per-connection export
Free tier	20 vault entries and 5 saved connections; Pro removes both limits
Requires	macOS 13 Ventura or later, Apple Silicon and Intel

Frequently asked

Does the macOS Keychain store SSH passwords?

It stores the passphrase that unlocks a private key, not the password of the server. Running ssh-add --apple-use-keychain ~/.ssh/id_ed25519, or setting UseKeychain yes in ~/.ssh/config, saves the key passphrase in your login Keychain so you are not asked for it every session. If a server authenticates with a password rather than a key, or you need a sudo password, an API token or a recovery code, the Keychain has no place for it that the SSH client will use.

Is there an SSH client for Mac with a built-in password manager?

Yes. Noden 1.3 has a password vault beside the connection list that holds passwords, SSH private keys, API keys and tokens, and secure notes. Every secret is written to the macOS Keychain and marked device-only, so it is never carried to iCloud or a Time Machine backup, and each read asks for Touch ID or the Mac account password.

Why is copying a password from a password manager into a terminal risky?

Two reasons. The clipboard is shared: any running app can read it, and clipboard-history tools keep a copy after you paste. And a password given as part of a command — piped to sudo -S, for example — is written to shell history in plain text, where it survives until the history file is cleared. Noden's Type Password from Vault avoids both: the password is typed into the waiting prompt as session input, so it never reaches the clipboard and never enters shell history.

How do I rotate a server password without editing every connection?

Point the connections at a vault entry instead of giving each one its own copy of the password. In Noden the connection editor has Password source and Key source selectors that reference a vault entry, and the reference is resolved at connect time for terminal, SFTP, jump host and RDP sessions. Change the secret once in the vault and every connection using it authenticates with the new value on its next connect.

Does Noden's vault sync to iCloud or to a cloud account?

No. Vault secrets are stored in the macOS Keychain with device-only accessibility, so they are not synchronised to iCloud and are not carried into a Time Machine backup, and there is no Noden account for them to sync to. To move a vault to another Mac you export it deliberately, to a password-protected AES-GCM encrypted file.

Does Noden have a master password for its vault?

No, and that is deliberate. The vault sits in the macOS Keychain, which is already tied to your macOS login password, and access is gated by Touch ID with a fallback to the Mac account password. A second master password would add a way to lose the whole vault without adding real protection on top of the Keychain.

How many secrets does the free version of Noden store?

Twenty vault entries, alongside five saved connections of any type. Noden Pro removes both limits. Editing an entry you already have is always allowed — the limit applies only when you add a new one.

Download Noden for Mac

Free to start, no account required.

brew install --cask useroamteknoloji/tap/noden

See also: SSH, SFTP and RDP in one app · macOS SSH client guide · How to use SSH on a Mac · Best SSH client for Mac · Termius alternative · Royal TSX alternative · Vault documentation