YubiKey or FIDO2 key
Plug in the key, enter its PIN, touch it: the vault opens. The key's PIN is always required.
Home / Windows
NextGen Shell System
MSKeyHole for Windows
SSH, RDP and a local terminal in one Windows app, with an encrypted vault locked by YubiKey and the AI of your choice (Claude, OpenAI, Mistral) that never sees passwords.
Security first
A vault locked by your YubiKey
Your hosts, credentials and keys live in an encrypted vault. Plug in the YubiKey, enter its PIN, touch it: the vault opens. Without the physical key, the secret protecting it exists nowhere on the PC.
The master password always remains available as a fallback. Methods combine: enable several, each one opens the same vault.
No stored secret
At each unlock, the key produces the same secret (FIDO2 hmac-secret extension), from which the vault derives its encryption key. Without the physical YubiKey, that secret exists nowhere on the PC.
Nothing to install
The key goes through Windows' built-in security API (WebAuthn): no driver, no Yubico software.
Windows Hello too
Key kept in the PC's TPM chip, unlocked by PIN, fingerprint or face.
Automatic locking
After inactivity, when the Windows session is locked and on sleep. With the vault locked, detached session windows are hidden and the AI has access to nothing.
Protected clipboard
A copied password is excluded from Windows clipboard history and cloud sync, then cleared after 30 seconds.
Built-in AI
The AI of your choice, under your control
The AI reads and drives the SSH, RDP and terminal sessions you entrust to it. The assistant is built in, with no other software, and works with three providers:
- Anthropic (Claude models)
- OpenAI (GPT models)
- Mistral AI (Mistral models and those offered on the Mistral platform, including GLM)
Please note: what the entrusted sessions display is sent to the chosen AI provider.
Live model list
The app queries the chosen provider and offers its current models capable of tool calling: new models appear without updating MSKeyHole.
Your own API key
You enter the key of your account with the provider. It is stored in the encrypted vault, one per provider, and never shown in the interface.
Or from an MCP client
Claude Desktop, Claude Code or any MCP-compatible client, paired with a token created in MSKeyHole and revocable.
You stay in control
The AI only sees the tabs you entrust to it, at one of three levels: read-only, confirm each action (default) or autonomous. Commands that look destructive always ask for confirmation, and every action is written to a log.
Passwords never shown
The AI can have a host's password typed into its session without ever reading it.
Installation
Install MSKeyHole in three steps
The MSIX package is signed by IT-SECURE Luxembourg: no certificate to import.
Requirements
- Windows 10 version 2004 (build 19041) or Windows 11
- 64-bit (x64) PC
- WebView2 runtime: already present on Windows 11 and up-to-date Windows 10
Download the file
Click “Download MSKeyHole for Windows”: your browser saves the .msix package.
Double-click it
Open the downloaded .msix file.
Click “Install”
Nothing else to do: no certificate to import, no install link to allow.
Features
Your servers and Windows machines, from a single app
The same family as KeyHole for Mac and iPad, with the same visual identity. The two apps look alike but differ: MSKeyHole has its own features and its own licence.
RDP remote desktop
Built in, in tabs: RD Gateway, redirections, sound, Windows shortcuts and full screen.
SSH and SFTP
SSH terminal with side-by-side SFTP, and connections through a jump host (bastion).
Forwarding and SSH agent
Port forwarding (-L, -R, -D) and an SSH agent for ssh.exe, git and VS Code.
Local terminal
PowerShell, Command Prompt and WSL.
Detachable sessions
Any session can open in its own window.
Video recording
Sessions can be recorded as MP4 video.
Credentials
Credentials shared between hosts, password generator, folders and sub-folders.
Imports
Royal TS (.rtsz, with passwords and gateways), RDCMan, mRemoteNG, CSV, PuTTY and ~/.ssh/config.
Licence
Free trial, then €24 a year
The trial version is limited to creating one host. The MSKeyHole Pro annual licence unlocks unlimited hosts and includes all updates. MSKeyHole licences are separate from App Store purchases: a KeyHole purchase on the App Store is not valid on Windows, and an MSKeyHole licence is not valid on Mac or iPad.
Trial version
€0
To try MSKeyHole, no licence key needed.
- Create a single host
- New versions downloaded from this page
MSKeyHole Pro — annual licence
€24/year
Licence key sold by IT-SECURE Luxembourg.
- Unlimited hosts
- All updates included
- Built-in updates (Settings › System)
Order by e-mail at contact@vigilancex.io, subject “Licence MSKeyHole Pro”.
Updates
Staying up to date
Updates and the revocation list are served by keyhole.vigilancex.io.
See what's newWith a Pro licence
Open Settings › System (Réglages › Système), click “Check” (« Rechercher »), then “Update” (« Mettre à jour »). All updates are included.
Trial version
Download the new version from this page, then install it.
Using version 1.0.0?
Install 1.0.1 manually, once. Later versions then install from Settings › System.
Frequently asked questions
Do I need to import a certificate?
No. The MSIX package is signed by IT-SECURE Luxembourg: download the file, double-click it, then click “Install”.
Why an .msix file rather than an install link?
The ms-appinstaller protocol, which let you install an app from a web link, has been disabled by default on Windows since 2023. MSKeyHole is therefore downloaded directly, as an .msix file.
Do I need to install WebView2?
Usually not: the WebView2 runtime is already present on Windows 11 and on up-to-date Windows 10.
Can I open the vault without a YubiKey?
Yes. Windows Hello and the master password are also available, and the master password always remains usable as a fallback. You can enable several methods: each one opens the same vault.
Does the AI see my passwords?
No. The AI can have a host's password typed into its session without ever reading it. However, what the sessions you entrust to it display is sent to the AI provider you chose.
Is my KeyHole App Store purchase valid on Windows?
No. The licences are separate: an App Store purchase (KeyHole for Mac and iPad) is not valid on Windows, and an MSKeyHole licence is not valid on Mac or iPad.
How do I get MSKeyHole Pro?
The MSKeyHole Pro annual licence costs €24 per year: unlimited hosts and all updates included. Order it by e-mail at contact@vigilancex.io, subject “Licence MSKeyHole Pro”.
Try MSKeyHole for free
Trial limited to 1 host, Pro licence €24/year. On a Mac or iPad? KeyHole is on the App Store (separate purchase).
Version 1.0.1 · MSIX package signed by IT-SECURE Luxembourg.