Security

On your first connection to a server, SFTPro pins its SSH host key and verifies it on every future connection. If that key changes — a server reinstall, a compromise, or someone sitting between you and the host — the connection is refused and you’re alerted, rather than quietly continuing. That is what stops a man-in-the-middle attack on an SFTP session.

• Passwords and key passphrases are stored in the macOS Keychain (kSecAttrAccessibleWhenUnlocked), encrypted by the operating system.
• Private SSH keys go in the Keychain too — never into plaintext files.
• Credentials you type but choose not to save exist only in memory, for the length of that session.

Files downloaded to show you a preview are cleared:

• before each new preview fetch;
• when you disconnect from a server;
• when the app launches — which covers crashes and force-quits;
• when you quit the app.

Remote data doesn’t linger on your disk after you’re done looking at it.

Every release is signed with our Apple Developer ID and notarized by Apple, so macOS verifies the signature and scans the build for malware before it ever launches. Updates are EdDSA-signed and the signature is verified by Sparkle before anything is installed.

SFTPro leans on three auditable open-source libraries, all from established maintainers: Citadel (SSH/SFTP), Highlightr (syntax highlighting), and Sparkle (auto-update). A short list is a list you can actually read.

SFTPro is offline-first. Server credentials, connection history, and file content stay on your machine. There’s no account signup, no analytics, and no phoning home — see the privacy policy for the longer version.