SSH2FA keeps a warm connection to your 2FA-gated hosts and answers the Duo / TOTP login for you — so your own ssh connects instantly, with no code to retype and zero ssh-config editing.
A small background helper handles the tedious part, so your terminal stays exactly the way you like it.
SSH2FA reads your ~/.ssh/config — enable hosts in one click, or add one and scan its 2FA QR. Credentials live in the macOS Keychain.
The daemon keeps a connection alive per host and auto-recovers it after sleep, network changes, and reboots.
Run ssh <alias> in your own terminal — it reuses the warm connection. SSH2FA sets that up for you; you edit nothing.
A real macOS app for the connection you live in — see it set up, stay warm, and run your cluster.
SSH2FA lives in your menu bar and holds a live connection to each host. Green means warm — open a terminal, mount it in Finder, or forward a port straight from the row. No window to go hunting for.
Forward a port straight to your job's compute node, then watch a live countdown pulled from squeue. SSH2FA warns you before the allocation ends — and tears the tunnel down cleanly when it does.
Hit ⌘K and start typing. Connect, open a terminal, mount a host, start a tunnel, or jump to settings — all without leaving the keyboard. Prefer the shell? There's a full CLI and TUI too.
Because SSH2FA holds your credentials so it can log in for you, you can require Touch ID before anything sensitive happens — revealing a secret, editing a host, or exporting a setup. The convenience stays; the gate comes back.
Enrolling a new host? Screenshot the Duo / TOTP QR to your clipboard (⌘⇧⌃4) and SSH2FA reads the secret straight into the Keychain — no long Base32 string to copy by hand, and no typos to lock you out.
Auto-submits your password + a fresh TOTP at login.
Your own ssh reuses the warm master — no edits.
Reads ~/.ssh/config to enable your hosts in one click.
Browse a host's files over sshfs, right in Finder.
Know the moment a new release ships.
Your settings follow you across all your Macs.
Move your tunnel and host setups between Macs.
A Troubleshoot panel diagnoses connection issues.
Manage every host and tunnel from the terminal.
Alerts if a host quietly leaves your ssh config.
Test-login before saving — never lock yourself out.
Liquid Glass UI, universal binary, zero telemetry.
SSH2FA stores your SSH password and TOTP secret in the macOS Keychain and submits the second factor for you. That convenience means your "second factor" no longer protects you against someone with access to your unlocked Mac — so you can turn on an optional Touch ID lock to require your fingerprint before any credential is revealed. Read the full security model before you rely on it.
SSH2FA is free and open source. With an Apple Developer membership ($99/year) the app can be notarized — installing with zero Gatekeeper warnings for everyone. If it saves you the daily 2FA dance, chip in toward the $99.
Buy me a coffeeRequires macOS 26 (Tahoe) or later. Pick a method below — it's not notarized yet (the $99 goal), so each one clears macOS's one-time "unverified developer" warning for you.
Open Terminal (press ⌘ Space, type Terminal, hit Enter), click Copy on whichever applies, paste, and press Enter. SSH2FA downloads, installs, and opens itself — no warnings, nothing else to click. No Homebrew? Use the second command — it needs nothing extra.
Nothing in the menu bar after a few seconds? The bundled helper can stay quarantined on this path — run xattr -dr com.apple.quarantine /Applications/SSH2FA.app once in Terminal, then reopen SSH2FA.
Once it's open, click the SSH2FA menu-bar icon → Add Host to connect your first cluster.
Prefer to build it yourself? git clone https://github.com/gasvn/ssh2fa && cd ssh2fa/auto2fa-mac && ./package-app.sh