Connections

Connections are saved SSH host profiles. Each profile has an identity, authentication method, optional folder, and optional advanced routing. Zync keeps this information on your desktop unless you choose an optional sync workflow.

Add a host

From the welcome screen, choose New > New Host. In the connection form, enter:

• Name: a display label such as Production.
• Host: a hostname or IP address.
• Port: the SSH port, which defaults to 22.
• Username: the remote account name.

Choose Create to save the host, or Save & Connect to save it and open a session. When editing an existing host, the equivalent actions are Save and Save & Open.

Authentication

The form offers Password and Private Key authentication. The Vault method appears when a local Vault is available.

Password

Enter the remote account password. If a Vault is available, choose one of these storage options:

• On this host saves the password with the host record. You can move it to the Vault later.
• Save to Vault creates an SSH password item and links the host to it. The password is not kept as plaintext on the host record.

For a host that already has a Vault credential, choose Vault > Existing and select it instead. Read Vault for encrypted credential storage details.

Private Key

Use Private Key > File to browse to an existing key file. Zync stores the path and reads the file when connecting. Use Private Key > Paste to paste PEM or OpenSSH key text. On save, Zync writes pasted local key content to a managed file under its data directory and stores the path on the host.

Zync inspects the selected or pasted key locally. For an encrypted key, enter its key passphrase when prompted. You may leave it blank while saving and provide it when you connect. The retention choice controls where that passphrase goes:

• Ask every time keeps it for the active connection only.
• Remember this key on this device stores it in the operating system credential store.
• Save to Vault stores the key and passphrase in the encrypted Vault when you save the host.

The key passphrase is different from the Vault passphrase. A private key must have a valid passphrase before Test can verify it. You can explicitly forget a remembered key passphrase from the connection form.

Vault

When Vault is available, choose Vault and then one of:

• Existing to attach an existing password or private key credential.
• Paste to add private key text and an optional key passphrase.
• Import file to read a private key file into Vault.

Vault must be unlocked to save a pasted or imported key. Zync encrypts the credential in the on-device Vault and links the host to it. Testing a pasted or imported key does not write it to Vault until you save.

Vault is optional

You can create and use connections without Vault. Configure it later when you want encrypted local storage or want credentials available for an optional sync workflow.

Test a connection

Select Test in the connection form to verify the host and selected authentication before saving. Zync checks private key material locally and requires a usable passphrase for encrypted keys. A local pasted-key test uses a temporary file that is removed after the test. Vault paste and import tests do not write a Vault item until you save.

Testing is useful for catching a wrong host, port, username, key path, or passphrase before creating a saved profile. It does not replace the server’s host-key verification step during the real connection.

Jump hosts

To reach a private host through a bastion, expand Advanced and choose a saved connection under Jump Server (Bastion). Zync connects through that saved SSH host before opening the target session. The jump host can use credentials different from the target host because each hop resolves its own saved authentication.

Zync warns when a jump selection would create a loop. Save the jump host first if it does not exist yet, then return to the target host and select it.

SSH agent forwarding

Agent forwarding is separate from jump-host authentication. Under Advanced, enable it explicitly and choose one saved private-key connection whose key may be offered to the remote session.

Every signature request requires a decision: Allow once, Allow for connection, or Deny. Requests time out after 30 seconds. Zync shows the immediate saved connection account, but it cannot authenticate the ultimate downstream destination that may request a signature. Review every request and use SSH Agent Forwarding for the complete trust model.

Host-key verification

The first connection to a server asks you to verify its SSH host key. Compare the fingerprint with a trusted source before accepting it.

If a known host later presents a different key, Zync blocks the connection and shows the changed-key warning. Update and connect only after confirming that the server was intentionally rebuilt or its key was rotated. An unexpected change can indicate that the endpoint is wrong or the connection is being intercepted.

Import connections

The New Connection chooser includes Import Config for SSH configuration files and Import File for exported connection data.

SSH config

SSH config import can read the default ~/.ssh/config, a custom SSH config file, or pasted SSH config text. It recognizes common fields including Host, HostName, User, Port, IdentityFile, and ProxyJump. Select the entries to import and choose how to resolve conflicts:

• Import as New creates another saved host.
• Update Existing updates the matching host.
• Skip leaves the existing host unchanged.

ProxyJump entries are resolved into Zync jump-host relationships when possible. Import does not import a key passphrase. If an imported identity file is encrypted, Zync asks for the passphrase when you connect and can then use it once, remember it on this device, or move it into Vault.

Connection files

Import a previously exported Zync, JSON, or CSV file. The import can include folders and connection metadata. Imported hosts with plaintext credentials are called out so you can move those credentials into Vault.

Check imported credentials

Only import files from a source you trust. Review hostnames, usernames, key paths, and any included secrets before connecting.

Export connections

Use the connection export action to select hosts, choose a file name, and choose one of these formats:

• Zync Format for a Zync connection exchange.
• JSON or CSV for general data exchange.
• SSH Config for standard SSH configuration output.

Exports never include Vault contents. The optional Include secrets checkbox can include host passwords and private key paths in the exported connection data. Leave it unchecked unless you have a specific secure transfer need, and protect any exported file that contains credentials.

Folders

Choose New > New Folder from the welcome screen to create a folder. Folders can have tags. You can also assign a host in the connection form under Appearance (Optional) > Folder (Optional). Drag saved hosts into folders in the sidebar, and use the folder controls to expand, rename, move, or delete folders.

Folder structure is part of the saved connection data and can be included when exporting connection data.

All Hosts and remote records

When optional Sync & Backup is connected and unlocked, All Hosts can show three locations for the same logical catalog:

Location	Meaning
Local	The host is available on this device.
Remote	An encrypted provider record exists, but the host is not materialized locally.
Local and remote	Both locations refer to the same logical host.

Use Keep to bring a remote host onto this device. Use Keep and open to materialize it and open the workspace. Referenced credentials and jump-host relationships must also be available locally or restored intentionally. Read Sync & Backup before applying a broader restore.

Secure an existing credential

Older or imported host records can still contain an on-host password or a local key path. Use the connection credential controls to move supported secret material into the optional Local Vault. The host then keeps a stable credential reference instead of owning the raw secret.

Connection privacy

Zync uses display names in list surfaces by default. Enable the host-address privacy setting in Zync settings when you want raw hostnames or IP addresses shown in the sidebar and connection pickers. Connection details still contain the complete endpoint needed to connect.

Common problems

• Connection refused: check the server’s SSH service, host, port, and firewall.
• Key authentication failed: confirm that the selected private key matches the public key authorized on the server and that Zync can read the path.
• Encrypted key prompt: enter the key passphrase, or choose a retention option after it is verified.
• Jump host unavailable: test the bastion connection separately and confirm that it can reach the target host and port.
• Imported host has no usable credential: assign a local key, password, or Vault credential before connecting.