SFTP mount for Mac, security-first by default.
KastDrive mounts any SFTP host into Finder with TOFU host-key validation, the hardened Citadel SSH engine under the hood, and first-class ed25519 key auth. Files stream on demand over an encrypted channel. No more SSHFS kernel panics.
Free tier: 1 SFTP mount, forever — no credit card required
Why KastDrive for SFTP on macOS
SSHFS works, but it leans on a deprecated kernel extension that breaks on every other macOS update. KastDrive replaces it with a Finder-native mount that takes host-key security seriously.
TOFU host-key validation
Trust On First Use: the first time you connect, KastDrive records the server's host key fingerprint and warns loudly if it ever changes — the same model OpenSSH uses, with no silent acceptances.
Citadel SSH engine
Every SFTP session runs through Citadel, our hardened Rust SSH transport — constant-time crypto, no unsafe blocks, and an audited code path for the key exchange and channel lifecycle.
ed25519 key auth
First-class support for ed25519, ECDSA, and RSA keys loaded from ~/.ssh, 1Password, or the macOS keychain. Agent forwarding is supported but off by default — least privilege by design.
Finder, natively
SFTP hosts mount through Apple's File Provider Extension API — cloud badges, on-demand streaming, and bidirectional sync. Your VPS finally feels like a local folder.
How it works
Three steps from ssh:// address to a Finder sidebar backed by hardened crypto.
Trust the host
Enter ssh://user@host, pick a key or password, and confirm the host-key fingerprint on first connect. KastDrive pins it forever and alerts you if it ever changes.
Mount into Finder
The remote filesystem appears under Locations in Finder. Browse thousands of files over SFTP without staging a single one locally upfront.
Stream and sync
Open any file to pull it over the encrypted channel on demand. Edits push back through the same Citadel session within seconds — no manual uploads.
KastDrive vs Mountain Duck for SFTP
Mountain Duck mounts SFTP through FUSE with a generic libssh2 stack and a one-time host-key prompt. KastDrive runs the hardened Citadel engine, enforces TOFU, and streams on demand.
| Feature | KastDrive | Mountain Duck |
|---|---|---|
| SSH engine | Citadel (Rust, hardened) | libssh2 / FUSE |
| Host-key policy | TOFU + change alerts | Prompt only |
| ed25519 keys | Yes | Yes |
| Online-only files | Yes — cloud badges | No — full download |
| Finder integration | Native File Provider | Kernel extension |
| Price | $0 free / $29 once | $39 + per-year renewals |
Mountain Duck pricing as of June 2026. No affiliation with Cyberduck/Mountain Duck.
Your servers, mounted securely.
Mount your first SFTP host free. Upgrade to Pro for unlimited mounts, bandwidth scheduling, and Cryptomator vaults.