Features

What RackHatch does

Private by design

Servers stay in private subnets. No inbound RDP port, no public IP and no bastion host to maintain.

One click to connect

RackHatch starts the tunnel, opens Remote Desktop and signs in with exactly the account saved for that server.

Organized environments

Group servers into environments such as Production and Staging, each with its own colour, icon and AWS account.

Every session in view

See all active Session Manager sessions of your AWS identity, from this computer or elsewhere, and close them.

Clear when things go wrong

Errors are explained in plain language with what to do next, and a timeline shows every step of each connection.

Your secrets stay yours

AWS secret keys and server passwords are encrypted for your Windows account. They leave your computer only in an export you make, encrypted with your own password.

Screenshots

A closer look

Environments, connection status and your servers, ready to connect
Connected: the banner turns green and the row offers Reconnect and Disconnect
Every active session of your AWS identity, from this app or elsewhere
Environments with their own name, colour, icon and AWS account
AWS credentials per account, with a Test button that checks them with AWS
Edit servers right in the table; passwords stay masked
The Midnight theme, one of three light and three dark themes

Overview

About RackHatch

RackHatch is a Windows desktop app for teams who run Windows servers on Amazon EC2. It keeps your servers organized by environment, connects to any of them in one click through AWS Systems Manager, and shows clearly what is connected, what is happening and what to do when something goes wrong.

Download RackHatch and read the product guide on rackhatch.jesoralabs.com.

How it works

Choose a server. Pick the environment in the side bar and click Connect next to the server.
RackHatch opens a tunnel. An AWS Systems Manager port-forwarding session to Remote Desktop (port 3389) starts with that environment's AWS credentials.
You are on the server. Remote Desktop opens through the tunnel and signs in with the account saved for that server.

Every tunnel ends at localhost, so Windows would normally reuse whatever login it saved last. RackHatch clears those saved logins before each connection, so you are always signed in as the account of the server you chose, or asked for it when no password is saved.

Plans

Free trial: 3 days with every feature and no payment details. One trial per email address and per computer.
RackHatch Pro: ₹399 a year in India (card or UPI Autopay, through Razorpay) and US$19 a year elsewhere (PayPal account or card, through PayPal). Choose a subscription that renews automatically every year until you turn renewal off, or pay once for a single year.
Sign in with your email address and a one-time code; there is no password to remember.
A license is active on one computer at a time. You can move it to another computer from the app, up to three times in 30 days; Settings › Export and Import bring your tabs, servers and credentials along.
RackHatch keeps working for up to three days without reaching the license server.
Payments are processed securely by Razorpay or PayPal; RackHatch never sees your card details. Manage subscription in the app shows your renewal date and payments and lets you turn automatic renewal off; your license stays active until the end of the period you paid for.
Try every feature free for 3 days before you buy. Purchases are final once completed, and payment problems such as a duplicate charge are refunded in full. See the refund policy and terms.

Requirements

Windows 10 or 11 with Remote Desktop Connection (included with Windows) and an internet connection.
AWS CLI version 2 and the AWS Session Manager plugin. RackHatch links to Amazon's installers under About › Requirements.
EC2 instances managed by AWS Systems Manager: SSM Agent running, an instance profile with AmazonSSMManagedInstanceCore, and outbound HTTPS to the Systems Manager endpoints.
Access keys of an IAM user allowed to start, list and end Session Manager sessions.

Getting started

Install the AWS CLI version 2 and the Session Manager plugin.
Open RackHatch, choose License and start your free trial with your email address.
In Settings › AWS credentials, add your access keys and region, and click Test.
In Settings › Tabs, create your environments and pick their credentials.
Click Add server and enter a name and the EC2 instance ID; RackHatch suggests a free local port. Add the user name and password, then click Add server.
Click Connect.

Every server needs its own local port, for example 55601, 55602 and so on; Suggest picks a free one. RackHatch warns you before it would take a port in use by another session.

Example IAM policy

{
  "Version": "2012-10-17",
  "Statement": [
    { "Effect": "Allow",
      "Action": "ssm:StartSession",
      "Resource": [
        "arn:aws:ec2:*:*:instance/*",
        "arn:aws:ssm:*::document/AWS-StartPortForwardingSession" ] },
    { "Effect": "Allow",
      "Action": [ "ssm:TerminateSession", "ssm:ResumeSession" ],
      "Resource": "arn:aws:ssm:*:*:session/${aws:username}-*" },
    { "Effect": "Allow",
      "Action": "ssm:DescribeSessions",
      "Resource": "*" }
  ]
}

Narrow the instance resources to the servers each team may reach, for example with tags.

Prices are as of October 2026 and may change; the price shown at checkout applies. Screenshots show example data. Amazon Web Services, AWS and Amazon EC2 are trademarks of Amazon.com, Inc. or its affiliates. Microsoft, Windows and Remote Desktop are trademarks of the Microsoft group of companies. RackHatch is not affiliated with or endorsed by Amazon or Microsoft.

Why people use it

Always the right account
Saved Remote Desktop logins for localhost are cleared before each connection, so a session never opens with another server's account.
Clean up in one place
Disconnect ends the AWS session and frees its local port. Release All Ports closes every session of the app at once, and on exit RackHatch closes its sessions and removes the logins it stored.
Only your own sessions
The Sessions page lists sessions started with the IAM identity of your credentials. Sessions of colleagues in the same AWS account are never listed or closed.
Add servers in seconds
A guided form explains every field, checks the instance ID and suggests a free local port. Double-click a server to edit it.
Logs that explain
Float the logs pane, dock it beside your servers or open it in its own window (Ctrl+L). Copy error report collects the details for support, without passwords or keys.
Six themes
Daylight, Arctic and Sunrise are light; Midnight, Nordic and Deep Ocean are dark. Animations can be switched off.
Take your setup along
Export your tabs, servers and AWS credentials to a file for a backup or a new computer, and import them there. Secret keys and passwords stay encrypted with a password you choose.

Available on

WindowsWindows

Visit theWebsite OpenProduct guide (PDF)

Privacy

RackHatch uses AWS's own secure path to your servers, keeps your secrets on your computer and sends only what licensing needs.

No open ports. Connections run through AWS Systems Manager over TLS. Servers need no public IP and no inbound RDP rule; access is controlled by AWS IAM.
Encrypted secrets. AWS secret keys and server passwords are encrypted with Windows DPAPI for your Windows account. They cannot be read on another computer or by another user. If you export your settings, they are left out or encrypted with a password you choose.
Keys never on the command line. Access keys reach the AWS CLI only through the environment of each call. They are never written to AWS profiles, batch files, the command line or the logs.
Signed licenses. License information is signed by the license server (Ed25519) and bound to your computer. Sign-in uses one-time email codes with strict attempt limits.
Minimal data. For licensing, the server receives your email address, your computer's name and an anonymous computer ID. It never sees your AWS keys, servers or passwords.

Your AWS access remains governed by your own IAM policies. RackHatch can do only what the credentials you enter are allowed to do, and only the Session Manager actions it needs.