Features

Connections

SSH, serial, Telnet and a local shell, each in its own tab. Type an address, pick a saved host, or use a form.

MacWindows

Ways in

• Search or user@host at the top of the sidebar, and Quick Connect…: user@host[:port] and Return connects at once, IPv6 as [addr]:port or bare.
• The same box opens other tabs: an http(s):// URL, telnet host [port] or telnet://, ping 10.0.0.1 …, and sftp:// scp:// ftp:// tftp://.
• File and the ＋ button: New Terminal Tab, New SSH Connection…, New Telnet Session…, New Serial Console…, New Web Tab, New Ping Tab.
• ssh:// and telnet:// links open a tab, so a GNS3 or EVE-NG console command can use them.

SSH

• Sign-in on a card inside the tab: connect, host key, username, password, then the shell. Tabs connecting at once do not block each other.
• Sign-in order: public key, then password, then keyboard-interactive. Only the methods the server offers are tried. OTP prompts are asked each time.
• Host key: a new key shows its SHA256: fingerprint with Trust & Connect, Connect Once and Cancel. Return never trusts. A changed key is refused. Known Hosts… lists what you trusted.
• Cipher mode under Advanced: Auto, Modern or Legacy. Auto tries modern first and falls back only when the device really cannot negotiate, so old gear still connects.
• Auto-reconnect dropped sessions, on by default: three tries after 2, 5 and 10 s when a working session drops. exit or a device logout does not reconnect.
• Don't Log per host, and No Paging per host: sends the family's pager-off command once the SSH shell is up. It shows only for a family that has one.
• Forward SSH agent per host. Mac only

Jump host

• Via jump host under Advanced: a saved SSH host, or typed user@host[:port]. One hop.
• A host that cannot be resolved is reported in the tab. It never connects directly behind your back.
• Files and port forwards work through the jump host too.

Port forwarding

• Port forwards under Advanced in New SSH, Add Host and Edit Host: pick Local, Remote or SOCKS, then fill in port, host and port.
• Pasted ssh spelling works: 8443:host:443, 1080 for SOCKS, R9000:host:3000, R1080 for remote SOCKS. SOCKS5, 4 and 4a.
• Up to 16 forwards per host. Local listeners bind 127.0.0.1 only, open after the shell is up and close with the session.
• The ⇄ menu in the bottom bar of a connected tab: Open in Web Tab, Copy Address, Copy Proxy Address, and Stop / Start per forward with its connection count.
• Forwards are never written to a .sheepterm file.

Telnet and local shell

• Telnet: default port 23, no auto-login, local echo when the server declines to echo. Send Break goes out as a Telnet break, for console servers.
• A far end that closes the session is not reconnected.
• Local tabs run your shell. Network Info… in View lists this machine's interfaces and ARP table.
• Real MAC and ARP in local tabs in Settings: macOS 27 hides these from commands, and this shows them. Mac only
• Local shell in Settings: Command Prompt, PowerShell 7, Windows PowerShell, WSL or Automatic. Windows only

Sidebar & Groups

File hosts the way your network is built, with groups inside groups, in one sidebar you can search.

MacWindows

Groups

• Groups inside groups, up to three levels you can create: a site, a building, a floor. Subgroups start shut and open freely.
• A small colour bar marks each level. Group Colors in View ▸ Sidebar and in Settings, on by default.
• Drag hosts and groups to reorder or move them. Reorder Groups… does the same in a list.
• Click a group to fold it. Expand All / Collapse All in the sidebar's ≡ menu, with New Group and Add Hosts….
• Subgroups sync and export like any group. Old sections became subgroups by themselves.

Hosts

• Double-click or Return opens a host. ⌘-click or ⇧-click selects several (Ctrl and Shift on Windows).
• Right-click a host: Connect, Open in Split, Open File, Ping, Edit Host…, Move to Group ▸, Remove Host.
• Right-click a group: Export Group…, Share Link…, Add Hosts…, New Group…, Set Credential for Group…, Rename Group…, Move to ▸, Delete.
• Recent: Connect, Save as Host…, Remove from Recent. Show Recent in Settings, up to 20 entries.
• Each host has a device family, a credential or saved username, and its own Don't Log and No Paging.
• A host named only by its address takes the device's prompt name for the tab and the log file. Nothing is sent to get it.

Sidebar options

• View ▸ Sidebar: Show Sidebar at Launch and Keep Sidebar Open, both off by default.
• Toggle Sidebar from the View menu or the toolbar button. Drag its edge to resize.

Tabs & Split panes

Up to nine panes in one tab, in a tidy grid. Every pane is a full session of its own.

MacWindows

Tabs

• Drag chips to reorder. Move Tab Left and Move Tab Right, Next Tab, Previous Tab, Tab 1 to Tab 9.
• Right-click a chip. SSH: Reconnect, Duplicate, Open File, Ping, Highlight, Copy All Output, Close Tab. Serial and Telnet: Reconnect, Highlight, Copy All Output. Web: Reload, Save as Host…. Ping: Restart All.
• A tab with several panes shows the focused pane's name and the pane count.
• Closing a tab of several panes asks first. Closing one pane does not.

Split panes

• Split Right and Split Down open a second session of the same host. Up to a 3 × 3 grid. New panes start at equal size.
• With two panes or more each pane is a card with a header: status dot, name, address and ×. A lone pane has no header and no gaps.
• Focus Pane ▸ Left / Right / Up / Down, Zoom Pane, Even Out Panes, Close Pane, Unsplit (the pane becomes its own tab).
• Drag a divider to resize. Double-click it to even out.
• Drag a pane header onto a pane edge, a tab chip or the empty tab strip. Drag a tab chip down onto a pane to merge. Drag a host from the sidebar onto a pane, or use Open in Split.
• A serial cable is exclusive and cannot be opened twice. Telnet and web panes can. A Ping pane keeps half its tab.
• Clicking anywhere else drops a terminal's selection.

Terminal

Our own terminal emulator, with highlighting per device family and guards around paste and dangerous commands.

Highlight packs

• One pack per family: Cisco IOS / IOS-XE / NX-OS, Aruba CX, ArubaOS (Controller / MM), Huawei VRP, H3C / HPE Comware, Juniper Junos, Palo Alto PAN-OS, Fortinet FortiOS, Check Point Gaia, Linux / server, plus Auto (all vendors).
• Colours interfaces, VLANs, addresses, masks, MAC addresses, up/down states and non-zero error counters. Timestamps are dimmed.
• The family is detected from the stream, or set per host, in Device Family or from the bottom bar.
• Colours are drawn over the picture: the stream and the log are untouched, and a device's own colours are never overridden.
• Toggle Highlighting per tab. Packs and colours are fixed.

Auto-page

• Auto-page (--More--) in View ▸ Terminal, off by default: answers a pager prompt with a space on SSH, serial and Telnet tabs.
• During Send Line by Line a pager prompt is always answered, after a short pause.

Safe Paste

• Safe Multi-line Paste, on by default: two lines or more show a full preview first, with the line count and size.
• Send Line by Line with a delay of 50, 100, 200, 300, 500 or 1000 ms, default 100 ms. Paste Immediately and Cancel.
• Each line waits until it has left, the device has been quiet for the delay and its prompt is back. With no prompt it waits for 2 s of quiet.
• A device that keeps sending, or stays at a pager prompt, ends the run with a notice instead of a garbled command.
• Hidden characters and escape sequences are removed. Dangerous lines are red. Typing, switching tabs or disconnecting stops the run.
• SSH, serial and Telnet. Limit 5 MB or 10,000 lines. Local tabs keep bracketed paste.

Danger Command Guard

• Danger Command Guard in Edit, on by default: a typed Return on reload, write erase, erase, format, FortiOS execute factoryreset, Junos request system reboot and similar is held.
• A card in the tab shows the command with Cancel and Send. Return and Esc both cancel.
• Also checks pastes, snippets and Broadcast. The list is fixed. Interface shutdown and clear are deliberately not on it.

Search and output

• Find…, Find Next, Find Previous, Use Selection for Find in the scrollback.
• Select a word and its other appearances are tinted. Mac only
• Scrollback of 10,000 lines. Clear Scrollback leaves the screen and the session alone.
• Copy All Output: the tab's scrollback and screen as plain text.

Session logs

• Log Sessions to File, on by default: plain text, one file per session. Open Logs Folder in File.
• Search Logs…: every log, newest first, literal or regex, with Match case.
• Don't Log for one host. The log file takes the device's prompt name too.

Look

MacWindows

• Six themes: SheepTerm, Dracula, Nord, One Dark, Solarized Dark, Gruvbox Dark.
• Font: family, size from 9 to 24 pt (default 13), Regular, Medium, Semibold or Bold, and Font Smoothing. DejaVu Sans Mono, Liberation Mono and Fira Mono are bundled.
• View ▸ Bottom Bar: Connection Status (Wool, Packet, Sheep or Off), Session Info, Shortcut Hints, This Mac IP, Clock, File Server, Transfer Progress.
• Allow remote programs to set the clipboard (OSC 52), off by default.

Ping tab

Watch many hosts at once, in a tab or split beside the console while a device reloads.

MacWindows

• Open with New Ping Tab, right-click a host or an SSH tab ▸ Ping, or type ping 10.0.0.1 … in the connect box.
• Targets: IPv4, IPv6, names, CIDR from /24 to /32, ranges like 10.0.0.1-20 or 10.0.0.1-10.0.0.20, separated by commas, semicolons or spaces. Up to 64 per tab.
• Columns: Hostname, IP, Status, Latency, OK, Failed, Rate and a Last minute graph. A narrow pane drops columns instead of overflowing.
• The Status badge is the latest packet alone: a reply within 100 ms is OK, slower is Slow, a lost packet is Fail at once. The threshold is fixed.
• The graph holds the last 60 packets. It stays amber when the latest reply was slow, even after a lost packet.
• Interval of 0.5, 1, 2 or 5 s.
• Rows keep the order you type. Drag to reorder. An address typed between two rows lands there.
• Right-click a row: Stop, Restart, Remove, Rename… (a name for this tab only), Copy Address, Open SSH.
• A packet log per host, 500 packets a row: Copy Log, Save Log… as CSV, Clear Log. Restart All on the tab.
• The bottom bar shows a summary such as “3 up · 1 down” with Session Info on.
• Nothing pings until you add a target. Targets are not saved. Closing the tab stops every ping.

File Server & Files tab

Serve a firmware image to a device, take its config back, or browse a device's files in a tab.

MacWindows

File Server

• The server glyph in the bottom bar, left of the clock, or Serve File… in File and ＋.
• Chips for TFTP, SFTP, SCP and FTP. SFTP and SCP share one server and light together. Every server is off at launch.
• TFTP on port 69, SFTP and SCP on 22, FTP on 21. Only those ports. Device copy commands cannot carry another one, so a taken port says who holds it, such as “Port 22 is in use by Remote Login”.
• Pick the file, then a command box shows the copy command for the tab's device family. Copy it, or ↵ types it into the tab without Return.
• A family it cannot detect gets a Choose menu that sets that tab only.
• The address beside Receive files is Automatic, the route toward the device, or an interface you pick.
• Receive files is off at launch and when the last server stops, with its own folder.
• Uploads never overwrite a file. A TFTP upload to a taken name lands beside it as name-2.ext. 16 GB per upload, and 1 GB of disk is always left free.
• A server with no transfer for 10 minutes stops itself. A running transfer is never cut.
• SFTP, SCP and FTP log in as sheepterm by default, with your own password or a random one per launch. Nine wrong passwords lock an address out for 60 s.
• The Transfer Log keeps the newest 1,000 transfers in both directions. Percent and size show in the bottom bar: View ▸ Bottom Bar ▸ Transfer Progress.

Files tab

• Open File… in File and ＋, Open File on an SSH tab or a saved host, or sftp:// scp:// ftp:// tftp:// in the connect box.
• Two panes: this machine and the device. SFTP, SCP, FTP or TFTP.
• From an SSH tab it rides the tab's own connection: no second login, no host-key question, and through a jump host too. It falls back to its own login when a device allows one channel only.
• A device with no SFTP falls back to SCP with a get / put form. TFTP has no listing, so it uses the same form.
• A device whose shell answers instead of SFTP, like a Check Point clish user, is named with what it printed.
• Host keys are checked before any credential. Replacing and deleting ask first. One transfer at a time per tab.

Web tabs & login key

A device's web page in a tab, in panes like any session, next to its console.

Web tabs

• Save a host as Web in Add Host…, type an http(s):// URL in the connect box, or use New Web Tab: an empty tab with the URL field focused.
• Bar: back, forward, reload or stop, URL field, Open in Default Browser. View ▸ Web: Open Location, Reload Page, Back, Forward, Clear Website Data….
• Find in the page, and page zoom through Bigger, Smaller and Actual Size in View ▸ Terminal ▸ Font.
• Self-signed certificate: a card with Trust & Connect, Connect Once and Cancel, like an SSH host key. A changed certificate is flagged in red.
• Save as Host… on the tab chip or pane header keeps a page you opened.
• Downloads, uploads and a clear error page work as expected. http and https only.
• Web tabs have no session log, highlighting, snippets or Broadcast.

Login key

• A key appears inside the login form's field. Click it to fill the username and password. Nothing is filled on its own and nothing is submitted.
• The host's own credential is offered only on its own site. Then credentials that list the page's site, then Other Logins.
• A login typed by hand is offered for saving: Save or Not Now in the URL field. A changed password offers to update.
• Sites belong to credentials on the Passwords… page.

Snippets, Broadcast, Command History

Saved commands, one line sent to many tabs, and each host's own history.

Snippets

• The Snippets menu lists your commands. Edit Snippets… adds, edits and reorders them, with Press Return after it.
• Variables: {{name}} and {{name=default}} ask for a value with a preview of the exact text.
• A multi-line snippet goes through Safe Paste.
• Snippets are in Backup and Sync.

Broadcast

• Broadcast to Tabs… types one line, then Return, into every ticked tab. Tick All, Tick None, Tick This Tab's Panes.
• Connected SSH, serial and Telnet tabs only. It does not mirror keystrokes.
• A dangerous line asks once for all tabs.

Command History

• Command History… in the History menu: per host, up to 500 commands. Picking one types it without Return.
• Clear History for This Host….
• Read from the screen after you press Return, so pastes and snippets are not recorded.
• Lines with passwords, keys, community strings and similar are filtered out. History is not in Backup or a .sheepterm file.

Sync & Security

Passwords stay on your machine in an encrypted store. Sync is end to end encrypted and off until you sign in.

Passwords

• Passwords…: search, copy the username or password, show, edit and delete. A credential can list web sites.
• A copied password leaves the clipboard after 60 s.
• Group credentials: Set Credential for Group… covers the whole branch.
• Passwords are never in a backup, a .sheepterm file or a session log.

Sync

• Sign in with Google: hosts, groups, credentials and their passwords, snippets and most settings follow you between Mac and Windows.
• End to end encrypted: your passphrase, through PBKDF2 with 600,000 rounds, wraps a random vault key, and data is AES-GCM encrypted before upload.
• Stored in a private app folder in your own Google Drive. No server of ours is involved.
• Each record merges on its own, so two machines can edit different hosts.
• A missing or unreadable file is never treated as a deletion. Signing out keeps your data.
• Off until you sign in: nothing leaves the machine before that.

Elsewhere

• Web logins run in the app's own isolated script world, out of the page's reach.
• Port-forward listeners bind 127.0.0.1 only. File Server writes are off until you allow them.
• Updates are signature-checked before they are unpacked.

AI panel

Ask about the output in front of you, using the Claude, ChatGPT or Gemini subscription you already have.

• View ▸ AI ▸ Show AI Panel, or the button after ＋ in the tab bar. A column at the right, resizable, for all panes.
• Reaches the models only through the vendors' own CLIs, installed and signed in by you: claude, codex, gemini. No API key is handled by SheepTerm.
• Settings ▸ AI shows each provider's status with Install… or Sign In…, the default provider and the model. Every provider starts on auto.
• Attach Selection and Attach New Output. A chip reads “N lines · K secrets removed”, and clicking it shows exactly what will be sent.
• Passwords, keys and community strings are masked before anything is sent, along with the session's saved password.
• Paste an image into the box to attach it.
• It never runs a command. Answers have Copy and Paste into Tab, which types without Return.
• One conversation per session, in memory only. Changing provider starts a new chat.
• AI Assistant in View ▸ AI turns the whole feature off.

Console cable

Plug in a USB console cable and connect at the right speed, with the tools a recovery needs.

Console cable card

• A USB cable plugged in while the app runs opens a card at the bottom right of the terminal area, never a system notification.
• It names the device and the cable kind: FTDI, Prolific, CH340, Silicon Labs, or the USB product name.
• A speed menu from 1200 to 921600, plus Other… for any rate from 50 to 4,000,000. Connect opens it.
• Default speed: a saved host on that device keeps its own. Otherwise an Aruba CX USB-C console is 115200 and every console cable is 9600.
• The card goes after 15 s, when the cable is pulled or when a tab opens the port. The 15 s wait while the pointer is on it.

Speed

• A serial tab's speed in the bottom bar is a menu that changes it on the open port. Nothing is reopened and the saved host is not changed.
• Garbled? Try 115200: wrong-speed text gets a small card offering the next speed. It only listens, and nothing is sent to the device.
• × stops the hints for that tab. Never on Telnet or during a transfer.

Send Break and XMODEM

• Send Break in Edit, for a boot loader that asks for it.
• Send File via XMODEM… in Edit: XMODEM, XMODEM-1K and YMODEM up to 256 MB, on serial and Telnet tabs, with progress and Stop.
• Typing, Break, pastes and snippets are refused while a transfer runs.

Also on a serial tab

• New Serial Console… picks a port and speed by hand.
• Highlighting, Auto-page, Safe Paste, Danger Command Guard, logs and Broadcast work as on SSH.
• The tab takes the device's prompt name, such as Core-SW (cu.usbserial-1420).
• Auto-reconnect covers a cable on a rebooting switch.

Backup / Import / Export

Move hosts in bulk, keep a copy of your setup, and share a group with a colleague.

Add many hosts

• Add Hosts… in View ▸ Sidebar, the sidebar's ≡ menu or a group's right-click menu.
• A grid with Name, Host / IP, Credential and Subgroup. Paste a block from a spreadsheet into any cell, or Import CSV….
• Tab moves on and Return adds a row. Subgroups can be paths like Building A/Floor 3.
• A URL in the Host / IP cell makes a web host.

Backup

• Back Up Configuration… and Restore Configuration… in File and Settings: one .sheeptermbackup file.
• Holds groups, hosts, the Recent list, credential names, snippets and app settings. Passwords are never in it.
• Restore asks first, shows what the backup holds and keeps a copy of your current files.

Import and export

• Export Group… on a group, Import Group… in File, or double-click a .sheepterm file.
• A name that exists offers Merge into Existing, Create New Group or Cancel. Hosts that differ ask Replace or Keep, one by one or for all.
• A file never carries credentials, agent forwarding, cipher choice or port forwards.

Share Link

• Share Link… on a group seals it with a random key and a passphrase you pass on separately. The link alone, or the passphrase alone, opens nothing.
• The encrypted file sits in your own Google Drive. Recipients are named, and a link can expire or stay open.
• Import from Link… and Shared Links… in File. Needs Sync sign-in.

What's New & Updates

Updates are signed and installed in one click. What changed is shown once per release.

• What's New opens on its own once per release, one page per change. What's New… in Help opens it any time.
• The current pages: Ping tab, Console cable, Safe Paste and Fixes.
• Check for Updates…, plus an automatic check about 5 s after launch and every 24 h. Check for updates automatically in Settings, on by default.
• An offer shows the release notes with Install & Relaunch, Later and Skip This Version. Nothing installs without the button.
• Each download is checked against an Ed25519 signature before it is unpacked.
• Nine languages: English, 简体中文, 日本語, 한국어, Español, Português (Brasil), Français, Deutsch, Русский. App Language in Settings.

Shortcuts

Every keyboard shortcut in the menus, for each platform.

Inside cards and panels

• Danger Command Guard and connection cards: Return and Esc cancel. A host key is trusted only by a click.
• Find bar: Return finds the next match. On a web tab Shift+Return goes back and Esc closes it.
• AI panel: Return sends, Shift+Return or Option+Return (Alt+Return on Windows) adds a line.
• Add Hosts: Tab moves on, Return adds a row, ⌘V or Ctrl+V pastes a block.
• Sidebar: Return opens the selected host.