Every Windows homelabber’s taskbar tells the same story: PuTTY for the shell, WinSCP for the files, a notes file with the ssh -L command you copy every time you need to reach a loopback-bound service. None of those tools is broken — PuTTY has been quietly excellent since the late nineties — which is exactly why nobody ever consolidates. MakeUseOf’s piece on replacing all three with one app finally pushed me to spend an evening with Submarine, an MIT-licensed SSH client that organises the terminal, the file browser and the tunnels around a single saved server.
The problem isn’t the tools — it’s the context
Watch what actually happens during routine server work. You SSH in, poke around, realise you need to pull a log file down — so you open WinSCP and re-enter the same host, user and key you just authenticated with. Ten minutes later you need the admin page of a service that’s bound to 127.0.0.1 on the remote box, so you dig through shell history for the forwarding command you used last month.
Nothing here is hard. It’s all friction of the worst kind: small, repeated, and paid every single day. The server’s identity lives in three different places, and only one of them remembers it. Submarine’s core idea is that the saved server should be the workspace, and the terminal, SFTP browser and port-forwarding rules should all hang off it.
What you get around one saved server
Add a machine once — hostname, port, user, key or password — and everything else inherits that context:
- Terminal: multiple shells to the same host in tabs, reconnects without rebuilding the session. Covers the PuTTY routine.
- SFTP: a split view with local files on one side and the remote filesystem on the other, with transfer progress in-panel. Covers most of the WinSCP routine, including rename, move, delete, permissions and file properties.
- Ports: local, remote and dynamic forwards — the equivalents of
ssh -L,ssh -Randssh -D— saved as rules under the server profile, each startable and stoppable on its own.
Two details deserve called out because they’re where client authors usually cut corners. First, credentials and saved servers live in a password-protected encrypted profile rather than the registry or a plaintext file. Second, the first connection surfaces an ED25519 host-fingerprint prompt and remembers your acceptance — proper TOFU (trust on first use) behaviour, and the fingerprint matches what OpenSSH shows you, which is a nice cross-check against a miscreant DNS entry.
The two features that earn the install
Remote editing with auto-upload is the sleeper feature. Pick “Edit” on a remote config file, and Submarine hands a temporary copy to your normal local editor; when you save, it uploads the changed file back. Fix a docker-compose.yml or an nginx site config in your real editor, then cat it from the adjacent shell to confirm — no manual download/edit/upload dance.
The other is tunnel rules as first-class objects. The classic homelab recipe works exactly as you’d hope: a service bound to 127.0.0.1:8765 on the server, a local forward listening on localhost:8080 on your desktop, and the admin page appears in your browser over the encrypted SSH channel. Because the rule is saved under the server profile, the tunnel you needed last Tuesday is two clicks away instead of a history search. Database admin pages, Grafana, dev servers, NAS interfaces — anything you deliberately didn’t expose publicly — all become reusable bookmarks.
Beyond the big three, an Info panel surfaces CPU, memory, storage, network and listening ports, and a Docker panel handles containers, logs and shells. Neither replaces htop or docker ps for serious work, but they’re the right shape for a glance while you’re already in there.
The honest caveats
Submarine is a v0.x project, and it shows in one place you can’t ignore: the Windows build is unsigned, so SmartScreen will warn on install. The project documents this honestly, but an unsigned binary for a tool that holds your SSH credentials is a genuine consideration — verify the source, or build it yourself, and keep the encrypted profile behind a real password.
It’s also not WinSCP’s equal in depth. If your workflow leans on WinSCP’s synchronisation and scripting automation, or you have a meticulously tuned PuTTY session library, there’s no shame in keeping them. And terminal-native folks should note that Windows Terminal plus OpenSSH’s ~/.ssh/config already solves portability and forwarding for free — Submarine’s case is the GUI around it all, not raw capability.
Who should switch
My decision list after a week with it:
- Switch if your daily rhythm on Windows is shell → grab a file → open a tunnel, especially across several servers or client boxes.
- Switch if you support less terminal-fluent colleagues — saved servers with tunnels they can click are safer than a shared cheat sheet of forwarding commands.
- Stay put if you live in tmux on Linux, script everything, or need WinSCP-grade sync jobs.
- Either way, hold any client you adopt to the same bar: encrypted credential storage, host-key pinning, and tunnels saved per-server. Those three are non-negotiable in 2026.
The tool didn’t teach SSH anything new — it just stopped pretending the terminal, the files and the tunnels were three separate relationships with the same machine. That reframing is worth more than any feature list.