SSH TunnelBuilder

Stop typing ssh -L 5432:db.prod.internal:5432 alice@jump.example.comevery time you need a tunnel. SSH TunnelBuilder turns those commands into named profiles you click once — no flags to remember, no terminal window to keep open, no shell history to leak.

Pick a connection from the sidebar, click Connect, and your local port is ready. Profiles sync between your Macs through your private iCloud database, while passwords and keys stay in the Keychain on each device — never in iCloud.

Mac App Store — US$ 0.99Source on GitHub

Features

  • Named connection profiles for every server and tunnel you reach regularly
  • Local port forwarding: point a local client at localhost on the port you choose, and traffic is forwarded over SSH to your chosen remote host and port
  • Password or private-key authentication, including passphrase-protected keys
  • Ed25519 and ECDSA (P-256, P-384, P-521) in OpenSSH, PKCS#8 and SEC1 formats. RSA and DSA keys are not supported; the app detects them and shows the exact command to generate a compatible replacement.
  • Host keys are pinned on first connection. If one later changes, the connection is blocked behind a clearly-marked warning until you re-trust it yourself.
  • Encrypted backup: export your connections to a passphrase-protected.sshtunnels file and import them on another Mac
  • Menu bar traffic indicator, and per-connection sent/received byte counters

Security

  • Passwords and private keys are stored in the macOS Keychain. Only non-sensitive metadata — names, hostnames and port numbers — lives in your private iCloud database.
  • Private-key passphrases are entered per session and never persisted.
  • Optional Touch ID or login-password gate for using saved credentials, with a configurable grace window so ordinary workflows don't prompt twice.
  • Spotlight indexing is off by default, and indexes only the connection name — never hosts, usernames or credentials.
  • Sandboxed and hardened-runtime signed. No telemetry, no third-party analytics.

Open source

The full source is published on GitHub under Apache 2.0. The cryptography, the key parsing, the host-key trust model — every line that ever sees your credentials — is open for inspection. The app is built on Apple's SwiftNIO and NIOSSH.

Requirements

macOS 14 (Sonoma) or newer. An iCloud account is needed if you want profiles to sync across Macs; the app works fully without one.

SSH TunnelBuilder is not affiliated with the OpenSSH Project.

kantn.no

kantn.no is a dating service we are building, with privacy as the starting point rather than something bolted on at the end.

The principle is simple: the service should know nothing about you beyond what you choose to enter yourself. No cross-site tracking, no bought-in data sets, no profile-building in the background.

Encryption

Private messages are end-to-end encrypted with the Signal protocol — X3DH for the initial key agreement, Double Ratchet thereafter. The plaintext exists only on the devices of the people in the conversation. Our server never sees it, and so cannot hand it over.

Group messages are encrypted with wrapped keys, so only members of the group can read them. Images shared in a group are stored encrypted the same way, but are classified before they are encrypted — seeImage moderation below.

Image moderation

Profile avatars, profile gallery images and images shared in groups go through four steps: upload, classify, encrypt, store. The image is therefore readable by the server for the moment classification takes place, and is encrypted before it goes into storage.

That means these images are not end-to-end encrypted, and we would rather say so plainly than dress it up. The classification is a safety measure, and it applies to the images that are visible to people other than you anyway.

Images in private messages are not classified. They are end-to-end encrypted and the server never holds them in the clear. We do not scan on your device to work around that.

Verification

Age and sex are verified through BankID, without storing personally identifying information. The service learns that you are verified — not who you are.

Pricing

Creating an account and using the service is free. Premium adds:

  • access to other people's profile galleries
  • unlimited likes — free accounts get 20 per 24 hours
  • keeping a match from expiring
  • seeing who viewed your profile, not just how many
  • advanced discovery filters
  • higher limits on uploads, gallery images and devices

Premium costs:

  • NOK 59 for one month
  • NOK 149 for three months
  • NOK 499 for one year

kantn.no is still in development and not open for sign-ups yet.Get in touch if you would like to know when it opens.