Cyberduck
Cyberduck transfers files between your Mac, remote servers and cloud storage accounts. It’s made by iterate, based in Switzerland.
Criminals have used its name in fake downloads or scams, so get it only from cyberduck.io.
What it is
People use Cyberduck to upload website files, download documents and organise files on remote servers or cloud storage. It supports services including Amazon S3, Dropbox, Google Drive and OneDrive.
It reads local files you upload and writes files you download. It can also synchronise local and remote folders. Saved connection passwords can be kept in the Mac’s Keychain. Connecting Google Drive gives it permission to see, edit, create and delete your Drive files.
Cyberduck is an open-source file transfer tool, available from its official website and the Mac App Store. Its file and account access serves that purpose. The maker says it does not collect or share user data, but keeps IP addresses from submitted crash reports to identify duplicates.
Who makes it
iterate is a software company based in Bern, Switzerland, registered in 2010, that develops Cyberduck and Mountain Duck. Its legal name is iterate GmbH. Its website is iterate.ch.
Is it the real one?
Every Mac app carries a signature from the developer who made it. Apple checks who the developer is before handing out the certificate, and macOS refuses to open an app whose signature has been tampered with.
The real Cyberduck is signed by David Kocher, Apple team ID G69SCX94XU. A copy signed by anyone else isn’t from iterate. HARD’s Mac app checks this for you; to check by hand, open Terminal and run codesign -dv "/Applications/Cyberduck.app", and look for that TeamIdentifier.
Its bundle ID, the name macOS knows it by, is ch.sudo.cyberduck. Download it only from cyberduck.io or the Mac App Store, not from an ad or a link someone sends you.
Fakes. In May 2026, cirosec reported a Windows credential-stealing campaign using fake software download sites, including sites impersonating Cyberduck. Attackers promoted the sites through Bing search results and bundled malware with genuine installers.
What it connects to
In normal use, Cyberduck talks to these places on the internet. A firewall that asks before apps connect, like the one in HARD’s Mac app, will show them.
| Address | Why |
|---|---|
update.cyberduck.io | Downloads application updates. |
profiles.cyberduck.io | Downloads connection settings for storage providers. |
api.dropboxapi.com | Accesses Dropbox when you connect that account. |
*.s3.amazonaws.com | Accesses Amazon S3 buckets you connect to. |
What it can see
macOS asks you before an app can use these. You can change them any time in System Settings → Privacy & Security.
| Permission | What it’s for |
|---|---|
| Local Network | Connects to local servers and discovers FTP and WebDAV services using Bonjour. |
Security record
Problems with Cyberduck or iterate in the last three years, newest first. Keeping the app up to date covers the ones that were fixed.
| When | What happened | Source |
|---|---|---|
| Cyberduck 9.4.1 fixed a fault that could upload files without encryption into an unlocked Cryptomator vault when automatic vault detection was disabled. | ↗ | |
| The Windows version used weak SHA-1 fingerprints for manually trusted server certificates, potentially allowing intercepted connections; version 9.1.7 fixed this. | ↗ | |
| The Windows version added manually trusted server certificates to the system certificate store, extending trust to other programs; version 9.1.7 fixed this. | ↗ |
References
- Cyberduck — official website cyberduck.io
- iterate GmbH — official GitHub organisation github.com
- iterate GmbH — commercial register information moneyhouse.ch
- Cyberduck download cyberduck.io
- Cyberduck on the Mac App Store apps.apple.com
- Cyberduck preferences and updates docs.cyberduck.io
- Cyberduck privacy policy cyberduck.io
- Cyberduck opening connections docs.cyberduck.io
- Cyberduck Dropbox documentation docs.cyberduck.io
- Cyberduck Amazon S3 documentation docs.cyberduck.io
- Managing Local Network access settings using Cyberduck derflounder.wordpress.com
- Cyberduck issue archive — Mac App Store bundle identifier lists.cyberduck.io
- cirosec — Analysis of a credential-stealer malware campaign, Part I cirosec.de
- Cyberduck changelog cyberduck.io
- Cyberduck — Cleartext uploads to unlocked vault github.com
- Cyberduck and Mountain Duck — Weak Hash Algorithm for Certificate Fingerprint github.com
- Cyberduck and Mountain Duck — Improper Certificate Store Handling github.com
- The signature on a real installed copy, read by HARD with
codesign.