ssh · winrm · rdp · vnc · applerd · telnet · serial · web · ftp · sftp
All your connections, in one place.
BURSU Connection Manager brings your servers, credentials and team into one workspace. Terminal and SFTP side by side, RDP, VNC and Mac desktops in a tab, Windows servers over WinRM, jump hosts, tunnels and a SOCKS5 proxy — and passwords in an encrypted vault, whose key never leaves your device.
Windows · macOS · Linux · Android · iOS and iPadOS
+
▸ snippet Disk space → prod-web-01
admin@prod-web-01:~$ df -h /var/lib/postgresql
Filesystem Size Used Avail Use% Mounted on
/dev/nvme0n1p2 512G 318G 194G 63% /var/lib/postgresqladmin@prod-web-01:~$
The partition is 63 % full and growing by about 4 GB a day. Show the largest tables? The command only reads data.
5432 → localhost:15432jump: bastion.corpvault unlockedSecret Shield: on
1920×1080 · H.264clipboard sharedvault unlocked
High Performance · H.264 · GPUclipboard sharedvault unlocked
Windows5.2.3Installer x64 / x86 / ARM64, or winget install bursucm
macOS3.2.7.dmg for Apple Silicon and Intel, notarised by Apple
Linux3.2.7.deb · .rpm · .pkg.tar.xz, signed repositories
Android2.0.1Google Play or the APK from this site
iOS / iPadOS2.0.1App Store, one universal app
Everything a connection manager should be
Built for engineers and teams that live in remote sessions — every protocol, every credential and fine-grained access, in one place.
10protocols SSH · WinRM · RDP · VNC · AppleRD · Telnet · Serial · Web · FTP · SFTP
AES-256-GCMencrypted credential vault
3storage modes SQLite · PostgreSQL · Cloud
8app interface languages + light / dark themes
AppleRD · High Performance
Macs with Apple's High Performance screen sharing — no other connection manager has it
An AppleRD connection opens a Mac's screen in a tab. On Apple silicon with macOS 14 or later it takes Apple's own High Performance path — H.264 or HEVC video decoded on your GPU, the Mac's system audio, and a sharp virtual display sized to your window or a mirror of the Mac's own screen — the mode that so far only Apple's Screen Sharing app could use. Intel Macs and older macOS connect over the conventional route.
GPU-decoded video and the Mac's audio on Apple silicon; a plain screen on Intel Macs
Private session (the Mac's screen goes dark, the picture is rendered sharp at your window size) or a mirror of its screen
The Mac's host key is confirmed before your password is sent — like an SSH host key
Clipboard both ways; the macOS account's username and password, from the vault
AI assistant · optional
An assistant beside your session that reads the output and runs the routine — with your approval
Add your own API key (OpenAI, Google Gemini, Anthropic Claude, DeepSeek and others) or a local model through Ollama, LM Studio or llama.cpp, and the assistant explains what the terminal printed, drafts the next command and carries out admin tasks in SSH and WinRM sessions — and in RDP on Windows. Nothing runs without your click, and one checkbox in Settings switches the whole feature off.
Secret Shield redacts passwords, keys and tokens before any text reaches a provider
Commands that could change the system always wait for your approval
The terminal stays yours: keystrokes pass straight through, and a password or yes/no prompt waits for you
Inactive until you add a key; administrators can switch it off per user
WinRM · Windows servers
PowerShell on a Windows server, in a terminal tab
A WinRM connection opens PowerShell over PowerShell Remoting or cmd.exe over WinRS — no RDP session, no SSH server on the Windows side. Output streams while a command runs, Ctrl+C stops the pipeline, and prompts such as Read-Host or -Confirm wait for your answer, as in a local console.
HTTP or HTTPS — the server's certificate is trusted once and pinned like an SSH host key
Errors arrive as errors with the line they happened on; Write-Host keeps its colours
cmd.exe sessions can run in code page 866 for Cyrillic; a multi-line paste runs every line
Split pane, broadcast input and the AI assistant — the same as in an SSH tab
SFTP · files
Files beside the terminal — a panel, a two-pane manager and a queue that finishes the job
Open the SFTP panel next to any SSH session or on its own, browse in two panes, drag and drop, and let the transfer queue carry whole folders with progress. A folder is moved only after every file has arrived, so a dropped link never leaves half a tree on each side. FTP and FTPS get the same manager.
Transfer queue with progress; whole-folder upload, download and move
chmod, rename, new folder, open in the editor — right from the panel
A direct “Open SFTP” in the connection's menu, without opening a terminal first
Windows, Linux, macOS, Android, iPhone and iPad — the same file panel everywhere
SSH · tunnels · tmux
Behind a bastion, through a tunnel, and back on the same screen after a dropped link
Chain jump hosts with ProxyJump, open local (-L), remote (-R) and dynamic (-D, a SOCKS5 proxy) tunnels together with the session, and pick keys from the OpenSSH agent or from an SSH-key credential in the vault. Tick “Keep the session in tmux” and a lost connection brings you back to the same screen with the same programs still running.
The host key of the real target is verified through the jump host
Split view and broadcast input: type once into several servers
Command snippets with {placeholder} values, shared through your database
Session logging and terminal colour schemes per connection
RDP · built-in engine
Our own RDP engine: H.264, audio, multi-monitor — inside a tab or across every screen
BURSUrdp draws a Windows desktop with H.264 graphics, remote audio, clipboard, drive and printer redirection, and spreads a session over several monitors, each in its own movable window. On Windows you can still hand a session to the native Remote Desktop client; Linux and macOS run the same BURSUrdp engine, with IronRDP as an alternative; Android and iOS open the same catalog with IronRDP.
The server certificate is remembered on first use; a strict mode refuses a changed one
Colour depth and connection quality per connection; full screen and “Open with Remote Desktop”
RD Gateway in every app; the gateway's certificate is pinned separately
VNC alongside: TLS/VeNCrypt, scaling, view-only mode and .vnc import
All your sessions in tabs
SSH, WinRM, RDP, VNC, AppleRD, Telnet, Serial, Web, FTP and SFTP all open in tabs — with a full embedded terminal, a side-by-side SFTP file panel, split view for two sessions at once, full-screen mode and an embedded remote desktop.
Jump hosts & tunnels
Reach servers behind a bastion with ProxyJump chains, open local, remote and dynamic (SOCKS5) tunnels together with the session, and authenticate with keys from the OpenSSH agent or from the credential vault.
Computers behind NAT — BURSUlink
A free agent on a computer with no public address — a home PC, a laptop on a mobile connection, a server behind a corporate firewall — and the app opens SSH, SFTP, Telnet, RDP, VNC, WinRM, AppleRD and FTP to it — and its web pages — as if it were next door: no port forwarding, no VPN. A gateway agent reaches the machines around it, limited to the allow-list you write.
PowerShell over PowerShell Remoting or cmd.exe over WinRS, on HTTP or HTTPS with the server's certificate pinned like an SSH host key. Output streams while a command runs, Ctrl+C stops the pipeline, and Read-Host or -Confirm prompts wait for your answer.
Macs over AppleRD
A Mac's screen in a tab over Apple Remote Desktop. On Apple silicon with macOS 14 or later it takes Apple's High Performance path — H.264 or HEVC decoded on your GPU, the Mac's audio, a sharp virtual display or a mirror of its screen — which no other connection manager offers. Intel Macs connect over the conventional route, and the Mac's host key is confirmed before your password is sent.
Sessions that survive: tmux
Tick one checkbox and an SSH connection attaches to a named tmux session on the server — created the first time, rejoined after that. A dropped connection brings you back to the same screen with the same programs still running, on the desktop and from the phone.
Split view & broadcast
Run two sessions side by side in one tab, or type once and broadcast your keystrokes to every open session — with keyboard shortcuts for the whole app.
Command snippets
A shared library of your everyday commands, sent into the terminal in one click — {placeholder} values are asked at send time, and the library syncs through your database and the web portal.
AI assistant — optional
An assistant beside your SSH or WinRM session (and RDP on Windows) that explains output and can run routine commands — with your own API key or a local model, and approval required for anything that changes the system. Not your thing? One checkbox in Settings switches the whole feature off.
Built for flow
A live status dot on every tab, automatic reconnect when a session drops (up to three attempts, each after a 30-second countdown), a confirmation preview before multi-line text is pasted into a terminal — and Help → Report a problem, which shows you the exact report before anything is sent.
Encrypted credentials
Passwords and SSH keys are protected by a portable AES-256-GCM master-password vault — or Windows DPAPI on Windows. Folders inherit credentials.
Folders & permissions
Nested folders with per-folder grants: who can view, edit, or reveal passwords. Clean tree navigation, as in the tour.
BURSUcloud sync
Switch storage to BURSUcloud and your catalog lives in an isolated PostgreSQL database, reached only server-side through our zero-knowledge API.
Home dashboard
A pinnable, closable Home tab that greets you with quick stats, your recent and favorite connections, vault status and one-click actions to get straight to work.
Team & program users
Invite portal teammates or create desktop-only program users, put them in groups, and grant per-folder rights — view, edit or reveal passwords — to a person or a whole group. The database owner always stays administrator.
Themes & languages
System, Light and Dark themes plus English, German, Spanish, Portuguese (Brazil), Portuguese (Portugal), Russian, Ukrainian and Georgian — set it once in Settings.
Session restore & updates
Reopen the connections you had open when you last closed the app — on demand or automatically on startup — and get a quiet heads-up when a new version is ready to download.
Remote desktops: RDP, VNC & AppleRD
Full remote desktops inside a tab. Our own built-in RDP engine draws the screen with H.264 graphics, remote audio, clipboard and multi-monitor support; VNC connects with TLS/VeNCrypt encryption, clipboard sharing, scaling and a view-only mode; and AppleRD opens a Mac over Apple Remote Desktop — GPU video and the Mac's audio on Apple silicon, a plain screen on Intel Macs.
Authenticator codes for your logins
Keep the TOTP secret next to the login it belongs to and copy a live six-digit code in one click — no phone in hand. The seed is protected by the same master-password vault as your passwords.
A terminal that fits you
Pick a colour scheme, font and size for your terminal, generate strong passwords right where you store them, record a session to a log file, and wake a sleeping machine with Wake-on-LAN from its own menu.
BURSUcloud
In the apps, your master password never leaves your device
The app never connects to PostgreSQL directly. The catalog is read and written over HTTPS through the portal, and the portal opens the database on 127.0.0.1 only. Desktop and mobile apps send only ciphertext. Website vault actions process the master password temporarily on the server.
Your device
BURSUcm
Master password is entered here and stays here
The vault PBKDF2 + AES-256-GCM encrypts everything before it is sent
No account requiredOffline, the app works entirely with a local database. An account is only needed for sync and sharing.
Rights per folderWho can view, who can edit, who can reveal passwords. The root covers the whole database and is the only way to reach items outside any folder.
The owner is always administratorOwnership can be handed over, but a database is never left without an administrator.
Two-factor authenticationTurn it on in your bursucm.com profile: after the password, a code from an authenticator app, plus ten one-time recovery codes. The desktop and mobile apps ask for the code in their own window.
BURSU Connection Manager (BURSUcm) is a cross-platform remote connection manager for SSH, WinRM, RDP, VNC, AppleRD, Telnet, Serial, Web, FTP and SFTP, running on Windows, macOS and Linux, with Android, iPhone and iPad apps that open the same catalog. It keeps your servers, credentials and teams in one place, with an embedded terminal, an SFTP file panel and an embedded remote desktop.
Which protocols are supported?
SSH, WinRM, RDP, VNC, AppleRD, Telnet, Serial, Web, FTP and SFTP today, with more on the way. RDP and VNC both run inside a tab through our own built-in engines, and RDP can also go through an RD Gateway. AppleRD brings a Mac's screen into the same tab — with Apple's High Performance video and audio on Apple silicon. On Windows you can hand off to the native Remote Desktop client instead, and WinRM gives you PowerShell or cmd.exe on a Windows server without a remote desktop at all.
Does it support jump hosts and port forwarding?
Yes. An SSH connection can go through one or more jump hosts (ProxyJump), with the host key verified against the real target — the terminal and the SFTP panel both work through the tunnel. Each connection can also open local (-L), remote (-R) and dynamic (-D, a SOCKS5 proxy) tunnels automatically, and keys can come from the OpenSSH agent or from an SSH-key credential in the vault.
Does it work with Windows servers?
Yes. Besides RDP, a WinRM connection opens PowerShell (over PowerShell Remoting) or cmd.exe (over WinRS) on a Windows server as a terminal tab — on HTTP or HTTPS, with the server's certificate trusted once and pinned like an SSH host key. Output streams as it is produced, Ctrl+C stops the pipeline, and prompts such as Read-Host or -Confirm wait for your answer.
Does it work with Macs?
Yes. An AppleRD connection opens a Mac's screen over Apple Remote Desktop — the sharing you switch on in System Settings → General → Sharing. On Apple silicon with macOS 14 or later it uses Apple's High Performance path: H.264 or HEVC video decoded on the GPU, the Mac's system audio, and a sharp virtual display sized to your window or a mirror of the Mac's own screen — no other connection manager offers this mode. Intel Macs and older macOS connect over the conventional route without audio. The Mac's host key is confirmed before your password is sent, like an SSH host key. AppleRD works in every BURSUcm app: Windows, Linux, macOS, Android, iPhone and iPad.
Can a session survive a dropped connection?
Yes. Tick “Keep the session in tmux” in the SSH options and the connection attaches to a named tmux session on the server — created on the first connect, rejoined on every later one. If the network drops, reconnect and you are back on the same screen with the same programs still running. The same option exists in the Android and iOS apps, so a session started on the phone is ready on the desktop.
What are command snippets?
A shared library of saved commands you send into a terminal in one click. Snippets support {placeholder} values that are asked at send time, are stored in your database so they sync to every device, and can be managed in the app or on the web portal.
Can I import my connections from PuTTY, WinSCP or mRemoteNG?
Yes. One import window brings your connections over from WinSCP (saved passwords are decrypted automatically), PuTTY, mRemoteNG, Remote Desktop Manager, Royal TS, OpenSSH config files and .rdp files — with a folder-tree preview where you tick exactly what to import and pick a target folder. Import and export also work on the web portal, using the same portable backup format.
Is it free?
Yes — the desktop app is free to download and use. BURSUcloud adds optional cloud sync and team sharing.
Which platforms does it run on?
Windows 10 and 11 (including Windows Server), macOS on Intel and Apple Silicon, Linux (Debian/Ubuntu .deb, Arch/CachyOS .pkg.tar.xz and Fedora/RHEL .rpm), Android and iOS/iPadOS 17 or newer. The iPhone and iPad app is one universal app on the App Store.
How are my passwords protected?
Credentials are encrypted at rest with a portable AES-256-GCM master-password vault (or Windows DPAPI on Windows). With BURSUcloud, secrets stay encrypted and your database is reached only server-side through our zero-knowledge API — in the apps, your master password never leaves your device.
Can I protect my account with two-factor authentication?
Yes. Turn it on in your bursucm.com profile: after your password, every sign-in also asks for a six-digit code from an authenticator app, and ten one-time recovery codes cover a lost phone. The desktop and mobile apps ask for the code in their own window. Signing in with Google, Microsoft, Apple or GitHub does not ask for it — that provider's own protection applies. This is separate from the TOTP codes you keep for your own logins in the vault.
Does the app include AI features? Can I turn them off?
The desktop apps include an optional AI assistant for SSH and WinRM sessions on Windows, Linux and macOS, and for RDP sessions on Windows. It stays inactive until you add your own API key (OpenAI, Google Gemini, Anthropic Claude, DeepSeek and others) or connect a local model through Ollama, LM Studio or llama.cpp. Commands that could change the system always wait for your approval, and Secret Shield redacts passwords, keys and tokens before any text is sent to a provider. If you would rather not have AI at all, one checkbox in Settings disables the entire feature, and administrators can switch it off per user.
What is BURSUcloud?
BURSUcloud is the optional cloud backend. Your connection catalog lives in an isolated PostgreSQL database reached only through our zero-knowledge API, so teams can share connections with folder-level permissions.
Do I need an account?
No. You can use the app fully offline with local storage. An account is only needed if you want to sync and share through BURSUcloud.
Ready to connect?
Download the desktop app, or create a free BURSUcloud account to sync across your team.
