Saved SSH sessions + encrypted credential vault

Retyping ssh user@192.168.1.47 -p 2222 for every Pi is how fleets get messy. This guide covers the pattern: save the session once, put secrets in an encrypted vault, reconnect without plaintext password files.

Step 1 — Create or unlock the vault

On first launch, set a master password. That password unlocks an encrypted store for host credentials. Later launches show a small unlock screen — nothing else in the IDE opens until the vault is unlocked. See Getting started for the first-run flow.

Step 2 — Add a host as a saved session

Capture hostname (or IP), username, port, and auth method (password or private key). Name the session something human (pi-lab, jetson-garage) so the list stays scannable when you have twenty devices.

• One session per host (or per role if you use different users).
• Prefer keys for servers; passwords are fine for lab boxes if they live in the vault.
• Avoid putting the password in a script or a shared notes doc.

Step 3 — Keep secrets out of plaintext configs

~/.ssh/config is great for Host aliases and IdentityFile paths — it is a bad place for passwords. OpenSSH does not store passwords there anyway; people invent workarounds (expect scripts, world-readable env files). The vault exists so you do not have to.

Step 4 — Reconnect and rotate

Pick the saved session → connect. When you rotate a password or replace a key, update the vault entry once. The next connect uses the new secret without hunting through scripts.

Related: manage SSH keys for multiple servers and the SSH toolkit hub.