BURSU Connection Manager

What is BURSUcm

BURSU Connection Manager (BURSUcm) is a fast remote connection manager. It brings everything an engineer works with into one window: servers, network gear, remote desktops, file panels, saved credentials and team access rights. It runs natively on Windows, Linux and macOS, has a mobile companion for Android, and can — but does not have to — sync everything through the BURSUcloud service.

Supported protocols

Quick start in 10 minutes

From a blank machine to your first SSH session, saved password and file transfer. Every step links to the chapter that covers it in depth — but you will not need those links to finish.

1. Install the app. Windows: download and run BURSUcm-Setup.exe. Linux: install the package for your distribution. macOS: drag the app from the .dmg into Applications.
2. Choose where the data lives. On first run the app asks; pick Local database — the safest default, fully offline, and you can move it to the cloud later without losing anything.
3. Sign in and change the password. A fresh local database has one account, admin / admin; the app asks you to replace the password right away.
4. Save a credential. Open Credentials in the sidebar → New credential → a label (say, “root — lab servers”), the username and the password. One saved credential can serve any number of servers — that is the point.
5. Add a connection. Press Ctrl+T (or + Add Connection): a name, type SSH, the host address — port 22 is pre-filled. In the credential field pick the one you just saved. In Group type Servers\Lab — both folders appear by themselves.
6. Connect. Double-click the new entry. On the very first connection the app shows the server's key fingerprint — that is the host-key check working as intended; confirm with Trust & remember. A green dot on the tab means the session is live.
7. Move a file. In the session toolbar press Files (SFTP): your computer on the left, the server on the right. Drag a file across — it goes through the transfer queue with a progress bar.
8. Lock it down. When real passwords start accumulating, set a master password in Settings → Security — from then on your secrets are encrypted with a key only you know, and the database becomes portable to any other machine. Details in Master password & the vault.

Install on Windows

System requirements

• Windows 10 or 11 (x64, x86 or ARM64), including Windows Server 2012–2025.
• ~150 MB of disk space. The .NET runtime is bundled with the installer — nothing else to install.

Installation

1. Download BURSUcm-Setup.exe from bursucm.com/download. The SHA-256 checksum is published next to the button — verify it with certutil -hashfile BURSUcm-Setup.exe SHA256 if you like.
2. Run the installer and follow the wizard. It picks the right build (x64/x86/ARM64) for your CPU automatically.
3. Launch BURSUcm and continue with Data storage & first run.

Updates

The app checks the release feed on startup (you can turn this off in Settings → Appearance) and shows a dialog when a newer version is available, with the changelog and a download link. Installing a new version over the old one keeps all your data.

Install on Linux

Native x86_64 packages are built for the three big families. Grab the file from bursucm.com/download (the page picks your distribution's tab automatically) — or better, add the repository once and let your package manager handle updates forever.

The app lands in /opt/bursucm, appears in your application menu as “BURSU Connection Manager”, and can be started from a shell as bursucm. Every package's SHA-256 checksum is published on the download page.

Package repositories — automatic updates

All three repositories are served from bursucm.com and signed with the BURSUsofts Package Signing GPG key. Add the one for your family and new releases arrive with your regular system updates.

APT (Debian / Ubuntu / Mint / Pop!_OS)

sudo wget -qO /usr/share/keyrings/bursucm.gpg https://bursucm.com/repo/bursucm.gpg
sudo tee /etc/apt/sources.list.d/bursucm.sources >/dev/null <<'EOF'
Types: deb
URIs: https://bursucm.com/repo/apt
Suites: stable
Components: main
Signed-By: /usr/share/keyrings/bursucm.gpg
EOF
sudo apt update && sudo apt install bursucm

The modern deb822 .sources format is used on purpose: Ubuntu's “Software & Updates” window shows such entries properly under Other Software.

DNF / YUM (Fedora / RHEL / AlmaLinux / Rocky)

sudo rpm --import https://bursucm.com/repo/bursucm.asc
sudo tee /etc/yum.repos.d/bursucm.repo >/dev/null <<'EOF'
[bursucm]
name=BURSUcm
baseurl=https://bursucm.com/repo/rpm
enabled=1
gpgcheck=1
repo_gpgcheck=1
gpgkey=https://bursucm.com/repo/bursucm.asc
metadata_expire=6h
EOF
sudo dnf install bursucm

Pacman (Arch / CachyOS / Manjaro / EndeavourOS)

curl -fsSL https://bursucm.com/repo/bursucm.asc | sudo pacman-key --add -
sudo pacman-key --lsign-key BA53B57D047CE8F14610C02A037A882DB839E2E0
echo -e '\n[bursucm]\nServer = https://bursucm.com/repo/arch' | sudo tee -a /etc/pacman.conf
sudo pacman -Sy bursucm

Runtime dependencies

The packages declare everything they need (GTK 3, NSS, ALSA); your package manager pulls those in automatically. There is no separate .NET or Electron to install — the app is self-contained.

Install on macOS

1. Download the disk image for your Mac from bursucm.com/download: Intel (BURSUcm-1.5.3-x64.dmg) or Apple Silicon (BURSUcm-1.5.3-arm64.dmg). Not sure which chip you have? Apple menu → About This Mac.
2. Open the .dmg and drag BURSU Connection Manager into the Applications folder.
3. Launch it from Applications or Spotlight.

Everything in this guide applies on the Mac; the details specific to the Linux/macOS edition are collected in its chapter.

Install on Android

1. Download BURSUcm.apk from bursucm.com/download on the phone (Android 8.0 or newer).
2. Open the file. If the system asks, allow installing apps from this source — that is a one-time permission for your browser or file manager.
3. Open BURSUcm and sign in with your bursucm.com account (email/password, Google or Microsoft), or with a database user login like name@handle.

The Android app is a companion to the cloud: it needs a BURSUcloud account and shows the same catalog as your desktop. Its features and security model are described in the Android chapter.

Data storage & first run

BURSUcm keeps the whole catalog (connections, credentials, users, snippets) in a single database. On first launch the app asks where that database should live — and you can change your mind later in Settings → Database:

• Local database — sign in as admin / admin; the app immediately asks you to change the password.
• BURSUcloud — sign in with your bursucm.com email and password, or with Google or Microsoft (a browser window opens; the app picks the sign-in up automatically), then choose a database from the list.

How BURSUcloud works inside

• Every database gets its own PostgreSQL database on the server — customer data is never mixed.
• Apps reach it only through the HTTPS API; the DBMS itself is not exposed to the internet.
• Connection passwords are stored encrypted with your master password. The master password never travels to the server: the key is derived on your device, the server only ever sees ciphertext. That is why a forgotten master password cannot be recovered — keep it safe.
• Database users travel inside the database: a full backup or SQL dump carries the user accounts along with the data.

Migrating between modes

1. In Settings → Database select and test the target database (the “Test” button).
2. Click “Migrate to selected database…” — connections, credentials, users and snippets move over wholesale.
3. If several computers will use the database, enable a master password BEFORE migrating — otherwise DPAPI-encrypted passwords will not open on other machines.

Connections

Creating a connection

1. Click “+ Add Connection” (or Ctrl+T, or right-click a folder → “Add connection here…”).
2. Fill in the name, type (protocol), host and port. The port is pre-filled per protocol (22, 3389, 23…).
3. Enter the username and password manually — or pick a saved credential from the vault (see Credentials).
4. The “Group” field sets the folder; nest with \, e.g. Servers\Production. New folders are created automatically.
5. Optionally add tags (comma-separated) and notes.

Folders, favorites, search

• Folders — unlimited nesting; the expanded/collapsed state is remembered, and in cloud mode it syncs across devices along with folder order.
• Filters above the tree: All, Favorites, Recent. The star on a connection card adds it to favorites.
• Search (Ctrl+F) matches names and hosts instantly.
• Quick Connect — a user@host:port line for a one-off session without saving it to the catalog.

The right-click menu — the fast lane

Most day-to-day catalog surgery never opens a dialog; it lives in the context menu.

• On a folder: “Add connection here…”, “New subfolder…”, “Rename folder…” and “Default credential for this folder” — one login for everything inside (see folder inheritance).
• On a connection: Connect, Open in split view, Copy Username / Copy Password (the password goes to the clipboard without ever being shown on screen), Copy As — duplicate the entry to make a similar one in two clicks, Wake-on-LAN — send a magic packet to the connection’s MAC address to power on a sleeping machine before you connect, Move to folder, Edit, Delete.
• Extras per platform: on Windows — “Open with PuTTY / WinSCP / Remote Desktop” when those are installed; on Linux and macOS — “Open in system terminal” (an ssh command in your own terminal emulator) and a direct “Open SFTP”.
• On a credential: Edit, Copy As, Move to folder, Delete — same idea, same speed.

Your own order — arranging folders and entries by hand

Alphabetical order is the default, but rarely how you actually think about your servers. Both trees — connections and credentials — can be arranged manually:

• Hover any row — a folder, a connection or a credential — and small ▲ ▼ arrows appear on the right. Each click swaps the row with its neighbour.
• Folders move among folders, entries move among entries within their folder — the tree structure never changes, only the display order.
• The order is saved in the database, not on the device: in cloud mode the Windows app, the Linux/macOS app, the web portal and the Android app all show exactly the order you set. On the portal the same arrows sit on each row of the Connections and Credentials tabs.
• Anything you never reordered — and anything newly created — simply follows in alphabetical order after the arranged items, so new entries never disappear.

The connection card

Click a connection to open its card: host/port/protocol, the linked credential with Copy and Show/Hide buttons, tags, notes, last-used time. On top — Connect, favorite, Edit, Delete. On Windows, for SSH/RDP there are also “Open with PuTTY” / “Open with WinSCP” / “Open with Remote Desktop” — when those programs are installed.

Terminal & sessions

Tabs

• Every session is a tab. Drag to reorder; right-click for Duplicate, Pin, Close.
• Status dot on each tab: yellow — connecting, green — live, red — dropped, purple — connected through a jump host. You can spot a dead session without opening the tab.
• On an unexpected drop (network, timeout) an overlay appears inside the session with a Reconnect button — just press Enter. An intentional exit (exit, Ctrl+D) closes the tab as usual.
• Duplicate with cwd: duplicating an SSH tab opens the new session in the same directory you were working in — no cd ceremony.

Working in the terminal

• Full ANSI colours: Midnight Commander, htop and other TUI apps render correctly.
• Right mouse button — configurable: “copy selection, paste on right-click” (default), “copy if selected, otherwise paste”, or a context menu.
• Safe paste: if the clipboard holds multiple lines (commands would run immediately), a confirmation with a preview appears — protection against hidden commands copied from web pages. This guards every paste route: Ctrl+V, Shift+Insert, right-click and the context menu.
• Clean paste: line endings are normalised and bracketed paste is supported, so modern shells (bash 5.1+, zsh) and REPLs receive a multi-line paste as one editable block instead of executing it line by line — and pasting into editors never leaves stray ^M characters.
• Full Window expands the session to the whole app window; Full Screen (exit with F11) takes the entire monitor with an auto-hiding toolbar and session tabs on top.
• A slim scrollbar on the right lets you scroll back through the buffer without covering the text.

Appearance — colour scheme and font

Make the terminal your own in Settings → SSH (it applies to every terminal session — SSH, Telnet and Serial):

• Colour scheme: pick from built-in themes — Classic, Dracula, Solarized and more — matched for both readability and looks.
• Font: choose the font family and size; the whole scrollback re-renders instantly so you can compare at a glance.

Logging a session to a file

Need a transcript of what happened on a server? Turn on session logging per connection and BURSUcm writes the session’s output to a text file as you work.

• Enable it on the connection (or as a default in Settings); the log folder is configurable in Settings → Data.
• Each session gets its own timestamped file, so you keep a clean record for audits, change tickets or just remembering what you typed last week.

Split view — two sessions side by side

One tab can hold two terminal sessions:

• Another server alongside: right-click a connection in the tree → “Open in split view” (joins the active tab).
• The same server again: the “Duplicate in split” button in the session toolbar.
• The ⇅ button flips the layout: side-by-side ⟷ stacked.
• If one pane exits, the other takes over the whole tab. Jump hosts and tunnels work in the second pane too.

Broadcast — type once, send everywhere

The Broadcast toggle in the session toolbar mirrors your keystrokes to every open terminal session (tabs and split panes). While it is on, a bright orange banner shows “Broadcasting input to N sessions” with a Stop button.

Command snippets

Snippets are a shared library of saved commands you send into a terminal in one click.

• Send: the Snippets button in an SSH/Telnet/Serial session toolbar → pick a command from the grouped menu. It is typed into the terminal (without Enter — you decide when to run it); keyboard focus stays in the terminal.
• Placeholders: write {name} in a command — e.g. systemctl status {service}. A dialog asks for each value at send time.
• Managing: the Snippets window opens from the Home dashboard (“⚡ Command snippets”) or from Settings → Other → “Manage snippets…”. Fields: name, group, command, description.
• Sync: snippets live in the database — in cloud mode they are shared with the whole team and can also be edited on the web portal (the Snippets tab).
• Permissions: everyone can use snippets; adding and changing them requires the administrator role or the “Can manage command snippets” right. A new database comes pre-seeded with useful defaults (df, systemctl, journalctl, apt, docker, ss…).
• With Broadcast on, a snippet goes to every session at once.

Keyboard shortcuts

Toggled in Settings → Appearance → “Enable keyboard shortcuts”; the same page shows this legend.

Inside a terminal, copy and paste follow terminal conventions: Ctrl+Shift+C copies the selection, Ctrl+V or Shift+Insert pastes, and plain Ctrl+C stays what it should be — the interrupt key for the remote program.

SSH power features

Authentication

In the connection card → SSH options there are three ways to sign in:

The same page sets keep-alive and connect timeout (empty = the global defaults from Settings → SSH) and the terminal type (TERM).

SSH agent

On Windows the app talks to the OpenSSH Authentication Agent (and Pageant); on Linux and macOS, to the standard ssh-agent.

1. Windows: enable the service “OpenSSH Authentication Agent” (Services → startup type “Automatic” → Start). Linux/macOS: the agent is usually already running in your session.
2. Add a key: ssh-add /path/to/key — the passphrase is asked once.
3. In the connection’s SSH options select the “SSH agent” method. Done: the passphrase is never stored or asked again.

Jump host — connecting through a bastion

If a server is only reachable through an intermediate host (a bastion), BURSUcm builds the tunnel automatically, like ssh -J:

1. Open the bastion in your catalog → Edit → SSH options → tick “This connection can be used as a jump host”.
2. In the target connection → SSH options → “Connect via (jump host)” → pick the bastion. Only flagged connections appear as candidates.
3. Connect as usual. Both the terminal and the SFTP panel work. Chains are supported: the bastion itself may go through another jump host.

• Such a session’s tab gets a purple dot, and the card shows a “Jump host” row.
• Security: the host key is verified against the real target, not the tunnel — swapping the destination server will be noticed.

Port forwarding (-L / -R tunnels)

Each SSH connection can carry a list of tunnels (SSH options → Port forwards) that open automatically with the session:

Each tunnel’s status is printed into the terminal when the session starts. Tunnels work through a jump host too. A tab whose connection carries forwards shows an “(F)” suffix in its title.

Host-key verification (MITM protection)

Like PuTTY, BURSUcm verifies the server’s identity by its key fingerprint:

• First connection: an “Unknown SSH server” dialog with the fingerprint — verify it and choose “Trust & remember” (or “Connect once”).
• Key changed: a prominent warning. Continue only if the server really was reinstalled or its key rotated.
• Modes in Settings → SSH: “Ask once, then remember” (recommended), “Strict — only already-trusted hosts”, “Off” (insecure). The “Forget all trusted host keys” button lives there too.

The SFTP file panel

• The “Files (SFTP)” button in an SSH session opens a dual-pane manager: this computer on the left, the server on the right.
• Transfer queue: every upload and download goes through a queue with per-file progress bars and speed. Long copies no longer block the panel — keep browsing while they run.
• Drag & drop: drop files straight from your file manager (Explorer on Windows) into the remote pane.
• Whole folders: uploading or downloading a directory mirrors the entire tree, subfolders included.
• Create folders and files, rename, delete, chmod (octal permissions: 644, 755…), replace confirmation with file dates.
• Auto-open for new SSH sessions and follow the shell’s folder (the panel follows cd; bash only) are toggled in Settings → SSH.

RDP: remote desktop

On Windows: two engines

The engine is chosen per connection (RDP options) or globally (Settings → RDP). On the first connection to a new server the app asks you to verify its certificate.

On Linux and macOS: BURSUrdp and IronRDP

The Linux/macOS app renders RDP right inside the tab with its own BURSUrdp engine — the same one as on Windows, with H.264 graphics and multi-monitor support — and a lightweight IronRDP engine as an in-browser fallback. No external client, no X11 tricks, identical behaviour on both systems. Copy and paste work with the system clipboard, the session renegotiates its resolution when you resize the window, and reconnecting after a drop is a single click. Certificates of servers you accept are remembered; the list can be cleared in Settings → Trusted hosts. An “open in the system RDP client” action is still available from the connection’s context menu if you prefer an external window.

Per-connection options

• Display: colour depth (15/16/24/32-bit), connection quality (LAN / broadband / low / auto), all monitors (multimon, Windows engine).
• Local resources: clipboard, local drives, printers, microphone; where remote audio plays.
• Other: domain, RD Gateway.

VNC: remote desktop

Alongside RDP, BURSUcm speaks VNC (RFB) and renders the remote screen right inside a tab — the same window, tabs and full-screen behaviour as every other session. It works with the common servers: RealVNC, TigerVNC, TightVNC, UltraVNC, x11vnc and the built-in screen sharing on macOS and Linux.

Encryption & authentication

• TLS / VeNCrypt: when the server offers it, the session is encrypted (VeNCrypt, or the RealVNC/UltraVNC TLS variants). The server’s certificate is verified on the first connection and remembered — if it later changes you are warned (the same Trust-On-First-Use model as SSH host keys and RDP).
• Password: the standard VNC password (and, where the server uses it, a username) can be saved in a linked credential or asked at connect time. Plain VNC without TLS sends the framebuffer unencrypted — prefer a TLS-capable server, or tunnel it through SSH port forwarding.

Encodings & performance

• Supports Tight, ZRLE and Hextile encodings and negotiates the best one with the server; only the changed part of the screen is redrawn, so even a slow link stays usable.
• Scaling: the remote screen can be shown at full size or scaled to fit the tab.
• View-only mode disconnects your keyboard and mouse from the session — watch or present without touching the far side by accident.
• Clipboard sharing copies text both ways between your machine and the remote desktop.

Importing existing VNC connections

Already have .vnc connection files (from RealVNC Viewer, TigerVNC and others)? Bring them in from Import in one click — host, port and options come across; passwords are asked or linked afterwards. See Importing from other tools.

Telnet · Serial · Web · FTP

Telnet

The same embedded terminal as SSH (colours, copy/paste, broadcast, snippets). Note: Telnet sends everything in plain text — use it on trusted networks only.

Serial (COM port)

• Set the port (e.g. COM3 on Windows, /dev/ttyUSB0 on Linux) and baud rate on the connection.
• Serial options cover data bits, parity, stop bits, flow control.
• The classic case: a switch/router console over a USB-COM adapter.

Web (HTTP/HTTPS)

• The page opens in an embedded browser tab — handy for web panels (routers, IPMI, NAS). The tab has its own Back / Forward / Reload buttons, so multi-page panels are comfortable to walk through.
• You can store a login/password and enable “Ignore certificate errors” for internal self-signed panels; the exception applies only to that host, never globally.

FTP / FTPS

• A dual-pane file manager with the same transfer queue and whole-folder transfers as SFTP.
• Encryption: plain FTP (none), FTPS explicit (AUTH TLS) or FTPS implicit. Plain FTP sends the password in cleartext — use FTPS whenever the server supports it.
• Passive mode (PASV) is on by default — works behind NAT.

Credentials

Saved credentials live separately from connections — one credential can be linked to dozens of servers, and a password change is done in one place.

How to use them

1. Open Credentials in the sidebar → “New credential”. Fill in a display label, username, password, group.
2. In a connection, pick this credential in the “Saved credential” field — instead of typing.
3. If a credential is deleted, linked connections switch to manual entry (the password is asked on connect).

Built-in password generator

Next to the password field is a generate button: choose the length and which character classes to include (upper/lower case, digits, symbols) and drop a strong random password straight into the field — no separate tool, and the new value is stored encrypted like any other.

Two-factor codes (TOTP)

A credential can also hold a two-factor secret, so the one-time code lives right next to the login it belongs to:

• Paste the Base32 secret or a full otpauth:// URI into the credential’s TOTP field (the same value a phone authenticator would store).
• The credential then shows a live six-digit code with a countdown; “Copy TOTP code” puts the current one on the clipboard in a single click — no phone in hand.
• The secret is protected by the master-password vault exactly like a password, and syncs the same way, so the code is available on every device you sign in on.

Folder inheritance

A connection folder can have a default credential: every connection inside without its own credential uses the folder’s one. The typical case — one admin login for a whole rack/subnet. The connection card shows “Folder credential — …” when inheritance applies.

Credential groups can be reordered by hand just like connection folders — hover a row for the arrows (see Your own order).

Master password & the vault

Saved secrets are encrypted always. The only question is with which key:

Day-to-day

• On startup the app asks for the master password. You may skip: connecting still works, but saved passwords stay locked. If a locked password is needed for a connection, the app simply asks for it right there instead of failing.
• “Remember on this computer” stores not the password itself but a local key protected by the operating system — no typing at startup. “Forget” undoes it.
• The state is visible on the Home dashboard (the vault card) and in Settings. Quick lock — Ctrl+L.
• Change the master password: Settings → Security → “Change master password…” — all secrets are re-encrypted.
• A master password must be at least 12 characters — long enough to resist offline guessing, since it is the one key that protects every saved secret.

Password policy

The administrator sets requirements for app users’ passwords: minimum length and required character classes (lowercase, uppercase, digits, special) — Settings → Security.

Users & permissions

The User Management window (Home dashboard → “Manage users”, or the sidebar). The permission model is the same for local, PostgreSQL and cloud databases.

Roles

Per-folder rights

For every connection folder and credential group — three checkboxes:

• Read — see the folder and connect;
• Edit — create/change/delete inside it;
• Passwords — reveal saved passwords in cleartext (without this right connecting still works, but the password stays hidden).

A grant on a folder covers its subfolders. The “All folders” row is the default rule.

Users in cloud mode

For a BURSUcloud database the Users window lists two kinds of entries:

• Both kinds carry the same per-folder rights (read/edit/passwords) and the snippets right. They can be managed both from the app and on the portal — it is one and the same database.
• Database users are stored inside the customer database itself, so a full backup or SQL dump moves them together with the catalog, and changing the database handle applies instantly.
• The database owner (the account that created it on the portal) is always an administrator: they cannot be demoted or removed — the database is never left without an admin. Local databases enforce the same rule for the last administrator.

BURSUcloud

BURSUcloud is the optional cloud that syncs your catalog across devices and a team. The same catalog is available from the Windows app, the Linux/macOS app, the web portal and Android.

Creating an account

1. Open bursucm.com/register. Three ways: email + password (8 characters minimum), “Continue with Google” or “Continue with Microsoft” (personal and work accounts both work).
2. With email sign-up a confirmation link arrives by mail — it is valid for 24 hours. Nothing came? Check spam or click “Resend link” on the sign-in page.
3. After confirming, sign in — you land in “My databases”.

Creating a cloud database

1. Click “+ New database”.
2. Name — how the database appears in lists (e.g. “Prod infrastructure”).
3. Handle — a unique short id of letters, digits and dashes. It becomes part of database users’ logins: name@handle. Leave blank to auto-generate; you can change it later, but that updates user logins.
4. Master password (optional) — you can set it right away to encrypt connection passwords. Without one the database works plainly; set it later in the database’s Settings or from the app.

Connecting the app to the cloud

1. In the app: Settings → Database → BURSUcloud (or pick BURSUcloud on first run).
2. Sign in with your portal email and password — or with Google or Microsoft (a browser opens; the app picks the sign-in up automatically).
3. Choose a database from the list (“Refresh databases” re-reads it) → “Use selected”.
4. If the database has a master password, the app asks for it and offers to remember it on this computer (a locally protected key is stored, not the password itself).

What syncs

Connections and folders (including folder order, your manual item order and collapsed state), credentials, snippets, users and rights, each connection’s SSH/RDP options (including jump hosts and tunnels). The app’s own preferences (theme, language, hotkeys) stay local.

The security model

• Every database is a separate PostgreSQL database; the DBMS is not reachable from the internet — only the portal itself, on the server, talks to it.
• Clients use the HTTPS API with tokens: a token lives 30 days, sliding with use (hard cap 90 days), at most 10 active tokens per account, and signing in again revokes the previous token.
• Connection passwords are encrypted with the master password on your device; the server stores and relays ciphertext only (zero-knowledge). That is why a forgotten master password cannot be recovered even by support.
• A sign-in from a new IP address triggers an email notification; so does a password change.

Working offline

When the network drops — or the database itself becomes unreachable — the app keeps working from an encrypted local copy of your catalog. You can browse and edit connections and credentials, and even start the app with no connection at all. A status bar shows the state: red while offline (with a counter of unsynced changes and a “Retry” button), amber while synchronizing, green “Synchronized” for a moment when it finishes.

Changes you make offline are queued and uploaded automatically as soon as the database is reachable again. If the same item was changed both on your device and on the server, a conflict window shows the two versions side by side and lets you keep either one (passwords are never shown there). Availability is detected by pinging the database itself, so a dead server is noticed even while the internet is fine. This works for both BURSUcloud and a direct PostgreSQL database — for PostgreSQL an up-to-date local mirror is kept on your computer.

The web portal: a full guide

The portal at bursucm.com is the browser control centre for cloud databases. Whatever you change on the portal is immediately visible to the apps, and vice versa.

My databases

The Databases section lists your databases: name, technical name, your role (owner or member of someone else’s database), status and creation date. Manage opens the database console with its tabs.

The Connections tab

• The same folder tree as in the app: expand/collapse (plus “expand all / collapse all”), per-folder connection counts.
• Reordering: ↑ ↓ arrows on every folder and on every connection — the page reorders instantly, without reloading, and the result is the same order your apps show.
• Add: “+ Add connection” — a three-step wizard: folder → details (type, name, host, port, username) → password. New folders via “+ New folder” or right inside the wizard.
• Edit / delete / move — the Edit/Delete buttons on a connection row; an empty folder can be deleted.
• Revealing passwords: the “Master password” field on top with “Unlock & reveal”. Passwords are decrypted only for the current page view; the server never sees them. When editing a connection the password box is always empty — “leave blank to keep the current one”.

The Credentials tab

The same saved credentials as in the app, grouped, with the same ↑ ↓ reordering on rows. Adding and editing works like connections (label, username, password, group); folder inheritance is configured in the app.

The Snippets tab

• The shared library as a table: name, command, group. “+ Add snippet” / Edit / Delete.
• {placeholders} behave exactly as in the app: values are asked when sending from a terminal.
• The tab is visible to the owner, administrators and users with the snippets right.

The Users & access tab

Two lists:

• Both are edited with a step wizard: step 1 — role (admin = full access) and global flags (edit, reveal passwords, snippets); step 2 — per-folder connection rights (view/edit/reveal); step 3 — credential-group access.
• For database users the Sessions column shows the number of active devices: click to open the list (device, IP, last used, expiry) with per-token and revoke-all buttons.
• The database owner cannot be removed or demoted — the database always keeps an administrator.

The Settings tab

• Name and handle. Changing the handle updates every database user’s login instantly — warn your team.
• Master password: set or change (the current one is required). Setting it re-encrypts the database’s passwords.
• Export .sql — a full dump as a file; Import .sql — upload a dump (the “replace schema before import” checkbox wipes the database first). Dumps contain data — keep them private.
• Danger zone: permanent deletion of the database with all its data.

Import & export on the portal

The same import and export as in the desktop apps also lives on the portal — move connections between the app, the portal and other tools with one portable backup file (see Importing from other tools and Export & backups).

Profile & devices

• Profile — first/last name, nickname, portal language, password change (with Google or Microsoft sign-in the password is managed by that provider).
• Connected devices — every app signed in to your account: device name, IP, last used, expiry. Revoke signs out one device, “Sign out all” — all of them: each app will ask to sign in again. Use it if a device is lost.

Downloads & status

• /download — installers and packages for every platform, SHA-256 checksums, repository setup commands, the full changelog in 4 languages.
• /status — live checks of the portal, API, PostgreSQL and mail + recent incidents.

The Linux & macOS app

BURSUcm for Linux and macOS is the same connection manager, built for those systems from one codebase. If you know the Windows app, you already know this one: the same catalog, the same storage modes (local, PostgreSQL, BURSUcloud), the same SSH features, credentials, vault, users, snippets, split view and broadcast. This chapter covers what is specific to it.

What is different from the Windows app

Finding your way around

• The sidebar switches between Connections and Credentials; folders expand in place, and hovering any row shows the ↑ ↓ reorder arrows (see Your own order).
• Quick connect sits on top of the sidebar: pick a protocol, type user@host:port, press Enter — a one-off session without touching the catalog.
• The Home tab shows the same dashboard: stats, recent, favorites, vault state, quick actions. Session tabs, split view, broadcast, full-window and full-screen modes behave as described in the shared chapters.
• Light and dark themes, and the same four interface languages (English, Russian, Ukrainian, Georgian) — in Settings.

Signing in

Cloud sign-in offers the full set: email/password, Google, Microsoft, or a database user login (name@handle). Browser-based sign-ins open your default browser and return to the app automatically.

Android app

The APK is on the download page. It is a client for the cloud catalog: sign in with the same account — email/password, Google or Microsoft — and you get the same folders, the same connections, in the same order you arranged on the desktop.

• SSH terminal with hardware-keyboard and Ctrl-combo support; catalog search expands the folders that contain matches.
• Theme: follows the system light/dark setting by default; a fixed Light or Dark theme is available in Settings.
• Master password & biometrics: fingerprint unlock — the vault key is protected by an Android Keystore key that physically cannot be used without a successful scan. The “Lock App on Start” option asks for the fingerprint immediately at launch.
• Auto-lock: the credential vault locks after 5 minutes in the background.
• Screen protection: screenshots and screen recording are blocked on sensitive screens; content is hidden in the Recents switcher.
• Certificate pinning: the app accepts only the genuine bursucm.com certificate — a substituted connection (MITM) is rejected.
• Sessions: signing in again revokes the previous session on the server, so the “Connected devices” list on the portal always reflects reality.

Importing from other tools

Moving in from another connection manager is a single window: Settings → Data → Import (also available on the web portal). Pick the source, review the preview, click Import.

Supported sources

The preview step

• Before anything is written, the import shows a folder tree of what it found — tick exactly the folders and connections you want.
• Choose a target folder in your catalog; the imported structure lands inside it.
• Imports are additive: nothing existing is overwritten or deleted.

Export & backups

Portable backups (.bcmbackup)

• Export with a master password — the file is encrypted (AES-256-GCM); this is the format to move a catalog between machines or keep as a backup.
• Export without a password — for quick transfers only; the app warns you clearly that saved passwords would be stored in plain text.
• CSV export — the catalog structure without passwords, for spreadsheets and audits.
• The same export/import is available on the web portal, so a backup made in the app opens on the portal and vice versa.

Database snapshots

• Export database snapshot — a single encrypted file with the whole catalog (connections, credentials, users). You choose a snapshot master password — the file is useless without it.
• Import snapshot replaces the current database contents (the app warns you). Local mode can also import a raw SQLite file.
• For a cloud database the portal offers .sql export/import (the database’s Settings tab) — a full PostgreSQL dump, database users included.

Resetting the setup

“Clear cache & restart setup” (Settings → Database) forgets the configured database and any saved sign-in and re-runs the first-run wizard. The data inside the database itself is not deleted.

Recipes: six common jobs

Short, complete walkthroughs of tasks that come up in real infrastructures. Each one only uses features described earlier — the links lead to the details.

1 · Reach a firewalled database as if it were local

A PostgreSQL server listens on db.internal:5432, reachable only from an SSH-accessible host. You want localhost:5432 on your machine to lead there.

1. Edit the SSH connection to that host → SSH options → Port forwards → add a Local (-L) forward: local port 5432, destination db.internal, destination port 5432.
2. Connect. The terminal prints the tunnel status as the session opens.
3. Point pgAdmin, DBeaver or psql at localhost:5432. The tunnel lives exactly as long as the session tab — closing the tab closes the door. Details: Port forwarding.

2 · Give a contractor access to one folder only

An external engineer needs to work on the servers in Servers\Staging — and see nothing else, least of all passwords.

1. Open User Management → add a user (in cloud mode, a database user — the contractor needs no portal account, just the name@handle login you hand over).
2. Give the User role, leave the “All folders” rule empty, and on Servers\Staging grant Read — and Edit only if they should change entries.
3. Leave Passwords unticked: the contractor can connect with the stored credentials, but cannot reveal them in cleartext.
4. When the engagement ends, delete the user; in cloud mode also check their Sessions on the portal. Details: Users & permissions.

3 · Move in from PuTTY and WinSCP over lunch

1. Settings → Data → Import → source WinSCP: sites arrive with their folder tree and saved passwords, decrypted automatically.
2. Run the import again with PuTTY as the source — saved sessions, ports and SSH details come across; the preview step lets you untick what you do not want.
3. Both imports are additive and land in the target folder you choose, so nothing gets overwritten. Set a master password afterwards — imported passwords deserve real encryption. Details: Importing from other tools.

4 · One catalog on the work PC, the laptop and the phone

1. Create a free account and a database on bursucm.com (how).
2. On the machine that has your catalog: enable a master password first, then Settings → Database → select BURSUcloud → “Migrate to selected database…”.
3. Sign in to the same database from the laptop and the Android app. Everything follows: folders, manual order, credentials, snippets, tunnels — and each password is decrypted only on the device, never on the server.

5 · Run one command on a whole rack

1. Open sessions to every server involved (tabs and split panes both count).
2. Switch on Broadcast in the session toolbar — the orange banner confirms how many sessions are listening.
3. Type the command once — or send a snippet; with placeholders like systemctl restart {service} the app asks for the value first. Check the banner before Enter, then switch Broadcast off.

6 · A laptop is lost or stolen

1. On the portal open Profile → Connected devices and Revoke the lost device (or “Sign out all”) — its API token dies immediately and the app on it is signed out. For a database user's device, the owner does the same from the database's Users tab → Sessions.
2. Change your bursucm.com account password.
3. Assess the vault: saved passwords on the laptop are AES-encrypted under your master password — without it they are unreadable. If the master password could be known too, rotate the actual server passwords as a precaution.

Reference

The editions at a glance

Security model in one table

Where the app keeps its files

Inside: settings.json (app preferences), the local database when you use local mode, and known_hosts.json (trusted SSH host keys). Back up the whole folder and you have backed up a local installation. Saved passwords inside these files are always encrypted — see the vault chapter.

File formats

Default ports

Pre-filled when you pick the protocol; change them freely per connection. SSH/SFTP 22 · Telnet 23 · RDP 3389 · VNC 5900 · FTP/FTPS 21 · HTTP 80 · HTTPS 443.

Glossary

FAQ & troubleshooting

Frequently asked

Is it free?
Yes, the app is free on every platform. BURSUcloud is an optional add-on.

Which platforms are supported?
Windows, macOS (Intel and Apple Silicon), Linux (Debian/Ubuntu, Arch/CachyOS, Fedora/RHEL) and Android are available today. An iOS app is on the roadmap — watch bursucm.com/download.

Do I need an account?
No. Local mode is fully offline. An account is only needed for cloud sync and the Android app.

I forgot the master password. Now what?
It cannot be recovered — that is the point of zero-knowledge. Your connections and catalog structure are intact; saved passwords must be re-entered (Settings → Security → set a new master password, then update the passwords).

I moved the database to another PC and passwords will not open.
The database was protected with DPAPI (tied to a Windows account). On the original computer enable a master password (Settings → Security), copy the database again — now it is portable, including to Linux and macOS.

What is the difference between a “database user” and a “member”?
A database user is an account for the BURSUcm apps only (login name@handle); no portal account needed. A member is a full bursucm.com account granted access to the database. Per-folder rights are identical.

Where does my cloud data live?
In a dedicated PostgreSQL database on the bursucm.com server, unreachable from the internet directly. Passwords in it are ciphertext; only you hold the key.

Why don’t my devices show the same order of connections?
Manual order syncs through the database. Make sure every device runs a current version (Windows 2.5.3+, Linux 1.5.3+, Android 1.5.2+) and has refreshed the catalog; older versions simply fall back to alphabetical order without harming what you arranged.

Troubleshooting

Diagnostic logs

Settings → Logs: only operation timings are recorded — never passwords. Off by default. “Open” leads to the log folder.

Still stuck?

Write to us through bursucm.com/contact — we usually reply within one business day. The status page shows whether a cloud issue is on our side.