Set up a server once, use it on every Mac
Signing in is optional. When you do, HostDock syncs on two channels: a vault for servers, credentials and forwarding rules, end-to-end encrypted with a sync password our server never sees; and Cloud Space for notes, scripts and files, which syncs as soon as you sign in.
What you can do
Encrypted vault
Servers, passwords, private keys, saved credentials and forwarding rules are encrypted on your device with XChaCha20-Poly1305 before upload.
Recovery code
Alongside your sync password you get a 32-character recovery code. Forget the password and the code still unlocks your vault.
Notes and scripts
Keep Markdown notes and a script library with nested folders. Fill a script into the quick-command panel and run it on open terminals.
File Station
Keep files you push to servers again and again: configs, installers, certificates you’re comfortable storing unencrypted. Download them on another Mac only when needed.
Hands-off syncing
HostDock syncs at launch, a few seconds after you change something, every 5 minutes, and whenever you ask. Choose whether servers and forwarding rules sync.
Never deletes on a whim
Local data is only removed by a delete record your own key can decrypt. If something is missing on the server, HostDock uploads it again rather than deleting your copy.
At a glance
| Sign-in | One-time 6-digit code by email, valid 10 minutes; no account password |
|---|---|
| Devices | Up to 10 per account; sign out any device remotely |
| Vault contents | Servers, per-server secrets, saved credentials, port-forwarding rules |
| Vault encryption | Argon2id (64 MiB, 3 passes) wraps a random 256-bit data key; each record is XChaCha20-Poly1305 |
| Cloud Space contents | Notes, scripts, File Station files, appearance settings and profile |
| Cloud Space encryption | Encrypted in transit (HTTPS), not end-to-end; the server can read it |
| Never synced | AI conversations and API keys, MCP tokens, trusted host keys, the command log |
| Conflicts | Whole-record, last change wins; an edit beats a delete. Conflicting notes keep a “conflict copy” |
| Without an account | Everything works locally; nothing leaves your Mac |
Frequently asked questions
Why is Cloud Space not end-to-end encrypted like the vault?
So notes, scripts and files sync the moment you sign in, without typing a sync password on every Mac. HostDock keeps the two channels separate on purpose: passwords, keys and server addresses only ever travel in the encrypted vault.
What happens if I forget my sync password?
Use the recovery code you saved when you set up sync. If you lost that too but a Mac is still signed in, you can reset the vault from that Mac, which re-encrypts its local data under a new password. If no copy is left anywhere, the vault data on our server cannot be decrypted by anyone.
Is signing in required to use HostDock?
No. Every feature except sync works without an account, and nothing is uploaded until you sign in.
More in HostDock
Bring your servers into one window
Free download for macOS 12 Monterey or later.