2.9 KiB


Secure Client for exposing TLS (aka SSL) secured services as plain-text connections locally.

Also ideal for multiplexing a single port with multiple protocols using SNI.

Unwrap a TLS connection:

sclient localhost:3000

> [listening] <= localhost:3000

Connect via Telnet

telnet localhost 3000

Connect via netcat (nc)

nc localhost 3000


curl http://localhost:3000 -H 'Host:'

A poor man's (or Windows user's) makeshift replacement for openssl s_client, stunnel, or socat.

Table of Contents


Mac, Linux

curl -sS | bash
curl.exe -A MS | powershell


Check the Github Releases for

  • macOS (x64) Apple Silicon coming soon
  • Linux (x64, i386, arm64, arm6, arm7)
  • Windows 10 (x64, i386)


sclient [flags] <remote> <local>
  • flags
    • -k, --insecure ignore invalid TLS (SSL/HTTPS) certificates
    • --servername spoof SNI (to disable use IP as <remote> and do not use this option)
  • remote
    • must have servername (i.e.
    • port is optional (default is 443)
  • local
    • address is optional (default is localhost)
    • must have port (i.e. 3000)


Bridge between and local port 3000.

sclient 3000

Same as above, but more explicit

sclient localhost:3000

Ignore a bad TLS/SSL/HTTPS certificate and connect anyway.

sclient -k localhost:3000

Reading from stdin

sclient -
sclient - </path/to/file


printf "GET / HTTP/1.1\r\nHost:\r\n\r\n" | sclient

Testing for security vulnerabilities on the remote:

sclient --servername "Robert'); DROP TABLE Students;" -k localhost:3000
sclient --servername "../../../.hidden/private.txt" -k localhost:3000

Build from source

You'll need to install Go. See for install instructions.

curl -sS | bash

Then you can install and run as per usual.

git clone

pushd sclient.go
  go build -o dist/sclient cmd/sclient/main.go
  sudo rsync -av dist/sclient /usr/local/bin/sclient

sclient localhost:3000

Install or Run with Go

go get
go run localhost:3000