--- title: "The credential is never the first thing sent · Space Wizard" description: "Host keys checked first, secrets in your keyring, and the transport you choose." url: "https://royalsoftworks.com/products/space-wizard/security/credentials/" source: "https://royalsoftworks.com" format: "markdown" note: "Markdown rendering of the HTML page at `url`. Same content, same canonical URL." --- Security & privacy · 1 of 3 # The credential is never the first thing sent. Host keys checked first, secrets in your keyring, and the transport you choose. 0 Network calls made by a scan 0 Telemetry events, ever SHA-256 Host-key fingerprint, checked pre-auth OS keyring Where saved credentials live Connecting to a host ## The credential is never the first thing sent. ### Host keys verified during key exchange An SSH connection is checked before authentication, not after: the key the server presents is fingerprinted (SHA-256, in the same format \`ssh-keygen -lf\` prints) and compared against what was accepted for that host before. A host that fails the check never sees a credential. ### A changed key stops the connection dead If a host answers with a different key than last time, the connect is refused outright and the old and new fingerprints are both shown. Getting past it is deliberate work — edit the connection and clear its trusted key — because the alternative is a password handed to whatever is impersonating the server. ### First contact is a decision, not a default An unknown host puts its fingerprint in front of you with the command to verify it on the server itself. Cancel is the default button and the Escape key, so dismissing the dialog can never accidentally trust a key. ### Credentials in the OS keyring Saved passwords, key passphrases and FTP credentials are encrypted by the platform keychain — DPAPI, Keychain, or libsecret — and tied to this machine and user account. If the keyring is unavailable, the app says so and refuses to save the password rather than falling back to a plain-text file. ### Plain FTP is labelled, not hidden SFTP and FTPS are encrypted; plain FTP is not, and a session using it is badged "unencrypted" in the connection list with a warning at setup. Accepting a self-signed FTPS certificate is a separate, explicit opt-in that keeps the channel encrypted but unverified — and says exactly that. ### Authentication you already use Password, private key file with optional passphrase, or your running SSH agent. Nothing new to provision, and no credential is copied anywhere Space Wizard controls. [Previous Security: all 3 pages](https://royalsoftworks.com/products/space-wizard/security/) [Next Read-only until you select something.](https://royalsoftworks.com/products/space-wizard/security/read-only/) [All of Space Wizard security](https://royalsoftworks.com/products/space-wizard/security/)