Your servers, your remote desktops, your files.
One application.

Why avash

A connection manager that installs in a minute and asks you to change nothing in your habits.

Everything you need, nothing more

• SSH. Full terminal (xterm.js), tabs, chained ProxyJump, agent, keys generated and deployed from the app.
• RDP. Windows, xrdp and GNOME Remote Desktop desktops built in (IronRDP), native resizing, clipboard shared on request, files copied and pasted both ways, a local folder served as a drive on the remote desktop, remote sound.
• VNC. VNC desktops in the same window, through the same process as RDP; encrypted with VeNCrypt when the server offers it, certificate pinned on first contact.
• SFTP. A file panel on the terminal's own session: whole folders, resume of an interrupted transfer, a queue with speeds, host-to-host copy without touching your disk.
• Serial. The console of a switch, a router or a board in a tab, ports detected on the machine.
• Tunnels. Local, remote and SOCKS, with live status.
• Organisation. Folders, tags, instant search, command palette (Ctrl+K), snippets, host health, session recording.
• Import. PuTTY (files or registry) and MobaXterm, RDP desktops and folders included.
• Two languages. Interface in English and French, fully keyboard-driven.

Security is not an option

• Passwords in the system keyring, never in clear text on disk nor handed to the interface: the native core reads them when connecting, and the RDP password goes to the RDP process through standard input, invisible in the process list.
• Host keys verified (TOFU), connection refused when the key changes, including when only the algorithm differs. Same rule for the RDP server, before CredSSP sends any credential.
• Clipboard shared with a remote desktop only if you want it, revocable at any time.
• Nothing unbounded from the network: resolution, surfaces, images, command output, clipboard, all capped. The parsers run under cargo-fuzz.
• Supply chain: pinned actions, cargo audit, cargo deny, CodeQL, gitleaks, OpenSSF Scorecard, an attested SBOM with every release.

The security model, what it covers and what it does not: SECURITY.md.

Tested on every commit

Unit tests, integration tests against a real sshd, end-to-end tests on the real application with actual SSH, RDP and VNC connections, replay of real RDP recordings, an accessibility audit, a fleet of xrdp servers in containers. One rule stands in for discipline: a new test must have been seen failing. The details, with what each device actually found: docs/qualite.md (in French).

Install

Binaries are signed for the automatic updater and shipped with their checksums, a provenance attestation and an SBOM.

chmod +x Avash_*_amd64.AppImage && ./Avash_*_amd64.AppImage
sudo apt install ./Avash_*_amd64.deb        # Debian, Ubuntu
sudo dnf install ./Avash-*.x86_64.rpm       # Fedora

winget install AdrienCros.Avash

Verify what you downloaded

sha256sum -c SHA256SUMS                                          # integrity
gh attestation verify Avash_*_amd64.AppImage --repo AdrienAvalon/avash   # provenance

The second command proves the file comes from this repository, at this commit, built by our CI (Sigstore attestation).

First launch, in three moves

1. Your hosts from ~/.ssh/config are already in the sidebar; double-click to open a terminal, Ctrl+B for the file panel.
2. Direct connection for an SSH server, an RDP or a VNC desktop that is not there yet; tick "save" and it stays.
3. Ctrl+K for everything else: hosts, tunnels, snippets, language, host health, recordings. The password, once: it goes to the keyring.

Compared with other tools

From each tool's public documentation, September 2026. A wrong cell? Open an issue.