diff --git a/README.md b/README.md
index 43d6142..99a3e2d 100644
--- a/README.md
+++ b/README.md
@@ -56,6 +56,12 @@ sudo apk add bash libstdc++
 [OpenSSH](https://www.openssh.com/) supports using a [configuration file](https://linuxize.com/post/using-the-ssh-config-file/) to store all your different SSH connections.
 To use an SSH config file, run the `Remote-SSH: Open SSH Configuration File...` command.
 
+## Saved passwords
+
+After you log in to a host with a typed password, you're offered to save it in the system keychain (macOS Keychain, Windows Credential Manager, or libsecret on Linux), so the next connection doesn't prompt. A saved password the server rejects is removed and you're prompted again. Passwords are saved per user, host and port, including for `ProxyJump` hops. One-time codes and other second factors are never saved.
+
+Set `remote.SSH.rememberPasswords` to `ask` (default), `always` or `never`, and run `Remote-SSH: Forget Saved Passwords` to remove them all. On Linux without a running keyring, the editor may fall back to weaker storage and warns when it does.
+
 ## SSH configuration guides
 
 - [GSSAPI / Kerberos authentication](https://github.com/jeanp413/open-remote-ssh/blob/master/docs/gssapi-kerberos-authentication.md.md)
diff --git a/package.json b/package.json
index ef0f526..aee79eb 100644
--- a/package.json
+++ b/package.json
@@ -99,6 +99,7 @@
 		"onCommand:openremotessh.openEmptyWindowInCurrentWindow",
 		"onCommand:openremotessh.openConfigFile",
 		"onCommand:openremotessh.showLog",
+		"onCommand:openremotessh.forgetSavedPasswords",
 		"onResolveRemoteAuthority:ssh-remote",
 		"onView:sshHosts"
 	],
@@ -151,6 +152,22 @@
 					"default": "reject",
 					"scope": "application"
 				},
+				"remote.SSH.rememberPasswords": {
+					"type": "string",
+					"enum": [
+						"ask",
+						"always",
+						"never"
+					],
+					"enumDescriptions": [
+						"Ask after each successful login with a typed password.",
+						"Save typed passwords without asking.",
+						"Never save passwords. Passwords saved earlier are still used; run \"Remote-SSH: Forget Saved Passwords\" to remove them."
+					],
+					"description": "Whether to offer saving SSH passwords in the system keychain after a successful password login.",
+					"default": "ask",
+					"scope": "application"
+				},
 				"remote.SSH.defaultExtensions": {
 					"type": "array",
 					"items": {
@@ -265,6 +282,11 @@
 				"title": "Show Log",
 				"category": "Remote-SSH"
 			},
+			{
+				"command": "openremotessh.forgetSavedPasswords",
+				"title": "Forget Saved Passwords",
+				"category": "Remote-SSH"
+			},
 			{
 				"command": "openremotessh.explorer.emptyWindowInNewWindow",
 				"title": "Connect to Host in New Window",
diff --git a/src/authResolver.ts b/src/authResolver.ts
index 98ab2fe..41ad0d8 100644
--- a/src/authResolver.ts
+++ b/src/authResolver.ts
@@ -1,4 +1,4 @@
-import type { ParsedKey } from 'ssh2-streams';
+import type { ParsedKey, Prompt } from 'ssh2-streams';
 import type { ServerVersion } from './server-config/types';
 
 import * as cp from 'child_process';
@@ -16,6 +16,7 @@ import NativeSSHConnection, { isGssapiAuthenticationRequested } from './ssh/nati
 import type { SSHClient, SSHExecChannel } from './ssh/sshClient';
 import SSHConfiguration, { getSSHConfigPath, type HostConfiguration } from './ssh/sshConfig';
 import { gatherIdentityFiles, SSHKey } from './ssh/identityFiles';
+import { getPasswordSecretKey, getSavedPassword, savePassword, deleteSavedPassword, type RememberPasswordsPolicy } from './ssh/savedPasswords';
 import { untildify, exists as fileExists } from './common/files';
 import { findRandomPort } from './common/ports';
 import { disposeAll } from './common/disposable';
@@ -162,6 +163,21 @@ export function getProxyJumpPort(dest: SSHDestination, config: Record<string, st
     return (config['Port'] && parseInt(config['Port'], 10)) || dest.port || 22;
 }
 
+/**
+ * Whether a keyboard-interactive round asks for nothing but the account
+ * password: a single hidden prompt that mentions a password. Only such a round
+ * is answered from, or saved to, the keychain. One-time passwords and other
+ * second factors must be typed every time, so anything that looks like one is
+ * excluded — a miss here only means an extra prompt.
+ */
+export function isPasswordPrompt(prompts: Prompt[]): boolean {
+    if (prompts.length !== 1 || prompts[0].echo) {
+        return false;
+    }
+    const text = prompts[0].prompt;
+    return /password/i.test(text) && !/one[- ]?time|otp|oath|token|code|verif|factor/i.test(text);
+}
+
 export const MAX_PROXY_JUMPS = 10;
 
 export type ProxyJumpHop = [SSHDestination, HostConfiguration];
@@ -305,6 +321,8 @@ export class RemoteSSHResolver implements vscode.RemoteAuthorityResolver, vscode
                 const useNativeClient = isGssapiAuthenticationRequested(sshHostConfig);
 
                 let proxyStream: ssh2.ClientChannel | stream.Duplex | undefined;
+                // Unset for the native client, which never prompts for a password
+                let onAuthenticated: (() => void) | undefined;
 
                 if (!useNativeClient) {
                     const preferredAuthentications = sshHostConfig['PreferredAuthentications'] ? sshHostConfig['PreferredAuthentications'].split(',').map(s => s.trim()) : ['publickey', 'password', 'keyboard-interactive'];
@@ -334,7 +352,7 @@ export class RemoteSSHResolver implements vscode.RemoteAuthorityResolver, vscode
                             const proxyIdentitiesOnly = (proxyHostConfig['IdentitiesOnly'] || 'no').toLowerCase() === 'yes';
                             const proxyIdentityKeys = await gatherIdentityFiles(proxyIdentityFiles, this.sshAgentSock, proxyIdentitiesOnly, this.logger);
 
-                            const proxyAuthHandler = this.getSSHAuthHandler(proxyUser, proxyHostName, proxyIdentityKeys, preferredAuthentications);
+                            const proxyAuth = this.getSSHAuthHandler(proxyUser, proxyHostName, proxyPort, proxyIdentityKeys, preferredAuthentications);
                             const proxyConnection = new SSHConnection({
                                 host: !proxyStream ? proxyHostName : undefined,
                                 port: !proxyStream ? proxyPort : undefined,
@@ -345,10 +363,14 @@ export class RemoteSSHResolver implements vscode.RemoteAuthorityResolver, vscode
                                 agentForward: proxyAgentForward,
                                 agent: proxyAgent,
                                 hostVerifier: this.createHostVerifier(proxyHostName, proxyPort, proxyHostConfig, verifyUnknownHosts, verifyKnownHosts),
-                                authHandler: (arg0, arg1, arg2) => (proxyAuthHandler(arg0, arg1, arg2), undefined)
+                                authHandler: (arg0, arg1, arg2) => (proxyAuth.handler(arg0, arg1, arg2), undefined)
                             });
                             this.proxyConnections.push(proxyConnection);
 
+                            // The hop is authenticated even if forwarding to the next one fails
+                            await proxyConnection.connect();
+                            proxyAuth.onAuthenticated();
+
                             const nextProxyJump = i < proxyJumps.length - 1 ? proxyJumps[i + 1] : undefined;
                             const destIP = nextProxyJump ? (nextProxyJump[1]['HostName'] || nextProxyJump[0].hostname) : sshHostName;
                             const destPort = nextProxyJump ? getProxyJumpPort(nextProxyJump[0], nextProxyJump[1]) : sshPort;
@@ -395,7 +417,8 @@ export class RemoteSSHResolver implements vscode.RemoteAuthorityResolver, vscode
                     }
 
                     // Create final shh connection
-                    const sshAuthHandler = this.getSSHAuthHandler(sshUser, sshHostName, identityKeys, preferredAuthentications);
+                    const sshAuth = this.getSSHAuthHandler(sshUser, sshHostName, sshPort, identityKeys, preferredAuthentications);
+                    onAuthenticated = sshAuth.onAuthenticated;
 
                     this.sshConnection = new SSHConnection({
                         host: !proxyStream ? sshHostName : undefined,
@@ -407,7 +430,7 @@ export class RemoteSSHResolver implements vscode.RemoteAuthorityResolver, vscode
                         agentForward,
                         agent,
                         hostVerifier: this.createHostVerifier(sshHostName, sshPort, sshHostConfig, verifyUnknownHosts, verifyKnownHosts),
-                        authHandler: (arg0, arg1, arg2) => (sshAuthHandler(arg0, arg1, arg2), undefined),
+                        authHandler: (arg0, arg1, arg2) => (sshAuth.handler(arg0, arg1, arg2), undefined),
                     });
                 } else {
                     this.logger.info(`GSSAPI authentication requested for ${sshDest.hostname}; connecting via the local SSH client`);
@@ -422,6 +445,7 @@ export class RemoteSSHResolver implements vscode.RemoteAuthorityResolver, vscode
                 }
 
                 await this.sshConnection.connect();
+                onAuthenticated?.();
 
                 const envVariables: Record<string, string | null> = {};
                 if (agentForward) {
@@ -793,11 +817,53 @@ export class RemoteSSHResolver implements vscode.RemoteAuthorityResolver, vscode
         return new TunnelInfo(localPort, remotePortOrSocketPath, disposables);
     }
 
-    private getSSHAuthHandler(sshUser: string, sshHostName: string, identityKeys: SSHKey[], preferredAuthentications: string[]) {
+    /**
+     * Builds the ssh2 `authHandler` for one host. Call `onAuthenticated` once
+     * the connection is up, so a password the user typed can be offered for
+     * saving.
+     */
+    private getSSHAuthHandler(sshUser: string, sshHostName: string, sshPort: number, identityKeys: SSHKey[], preferredAuthentications: string[]) {
         let passwordRetryCount = PASSWORD_RETRY_COUNT;
         let keyboardRetryCount = PASSWORD_RETRY_COUNT;
         identityKeys = identityKeys.slice();
-        return async (methodsLeft: string[] | null, _partialSuccess: boolean | null, callback: (nextAuth: ssh2.AuthHandlerResult) => void) => {
+
+        const secretKey = getPasswordSecretKey(sshUser, sshHostName, sshPort);
+        const destination = `${sshUser}@${sshHostName}` + (sshPort !== 22 ? `:${sshPort}` : '');
+
+        // The saved password is sent at most once per connection
+        let savedTried = false;
+        // What the attempt in flight sent. ssh2 only calls the handler again to
+        // report that attempt failed, or succeeded with more methods required.
+        let pending: { saved: boolean; typed?: string } = { saved: false };
+        // A typed password accepted with partial success, i.e. before a second factor
+        let acceptedPassword: string | undefined;
+
+        const takeSavedPassword = async (): Promise<string | undefined> => {
+            if (savedTried) {
+                return undefined;
+            }
+            savedTried = true;
+            try {
+                return await getSavedPassword(this.context, secretKey);
+            } catch (e) {
+                this.logger.error(`Couldn't read the saved password for ${destination}`, e);
+                return undefined;
+            }
+        };
+
+        const handler = async (methodsLeft: string[] | null, partialSuccess: boolean | null, callback: (nextAuth: ssh2.AuthHandlerResult) => void) => {
+            if (partialSuccess) {
+                acceptedPassword = pending.typed ?? acceptedPassword;
+            } else if (pending.saved) {
+                // The saved password was rejected, most likely because it changed
+                // on the server: drop it and prompt as usual. A wrong second factor
+                // in the same keyboard-interactive attempt also lands here; the
+                // password is then asked for and offered for saving again.
+                this.logger.info(`The saved password for ${destination} was rejected; removing it`);
+                deleteSavedPassword(this.context, secretKey).then(undefined, e => this.logger.error(`Couldn't remove the saved password for ${destination}`, e));
+            }
+            pending = { saved: false };
+
             if (methodsLeft === null) {
                 this.logger.info(`Trying no-auth authentication`);
 
@@ -872,6 +938,19 @@ export class RemoteSSHResolver implements vscode.RemoteAuthorityResolver, vscode
                 });
             }
             if (methodsLeft.includes('password') && passwordRetryCount > 0 && preferredAuthentications.includes('password')) {
+                // Doesn't count against passwordRetryCount: the user still gets all their typed tries
+                const saved = await takeSavedPassword();
+                if (saved) {
+                    this.logger.info(`Trying password authentication with the saved password`);
+                    pending.saved = true;
+
+                    return callback({
+                        type: 'password',
+                        username: sshUser,
+                        password: saved
+                    });
+                }
+
                 if (passwordRetryCount === PASSWORD_RETRY_COUNT) {
                     this.logger.info(`Trying password authentication`);
                 }
@@ -882,6 +961,7 @@ export class RemoteSSHResolver implements vscode.RemoteAuthorityResolver, vscode
                     ignoreFocusOut: true
                 });
                 passwordRetryCount--;
+                pending.typed = password || undefined;
 
                 return callback(password
                     ? {
@@ -900,6 +980,16 @@ export class RemoteSSHResolver implements vscode.RemoteAuthorityResolver, vscode
                     type: 'keyboard-interactive',
                     username: sshUser,
                     prompt: async (_name, _instructions, _instructionsLang, prompts, finish) => {
+                        const isPassword = isPasswordPrompt(prompts);
+                        if (isPassword) {
+                            const saved = await takeSavedPassword();
+                            if (saved) {
+                                this.logger.info(`Answering the password prompt with the saved password`);
+                                pending.saved = true;
+                                return finish([saved]);
+                            }
+                        }
+
                         const responses: string[] = [];
                         for (const prompt of prompts) {
                             const response = await vscode.window.showInputBox({
@@ -913,6 +1003,9 @@ export class RemoteSSHResolver implements vscode.RemoteAuthorityResolver, vscode
                             }
                             responses.push(response);
                         }
+                        if (isPassword && responses[0]) {
+                            pending.typed = responses[0];
+                        }
                         keyboardRetryCount--;
                         finish(responses);
                     }
@@ -921,6 +1014,40 @@ export class RemoteSSHResolver implements vscode.RemoteAuthorityResolver, vscode
 
             callback(false);
         };
+
+        const onAuthenticated = () => {
+            // The attempt in flight is the one the server accepted
+            const password = pending.typed ?? acceptedPassword;
+            pending = { saved: false };
+            acceptedPassword = undefined;
+            if (password) {
+                this.offerToSavePassword(secretKey, destination, password);
+            }
+        };
+
+        return { handler, onAuthenticated };
+    }
+
+    private offerToSavePassword(secretKey: string, destination: string, password: string) {
+        const policy = vscode.workspace.getConfiguration('remote.SSH').get<RememberPasswordsPolicy>('rememberPasswords', 'ask');
+        if (policy === 'never') {
+            return;
+        }
+
+        const save = () => savePassword(this.context, secretKey, password).then(
+            () => this.logger.info(`Saved the password for ${destination}`),
+            e => this.logger.error(`Couldn't save the password for ${destination}`, e)
+        );
+
+        if (policy === 'always') {
+            void save();
+            return;
+        }
+
+        // Not awaited: resolve() must not wait on a notification
+        const saveItem = 'Save';
+        void vscode.window.showInformationMessage(`Save the password for ${destination} in your keychain?`, saveItem, 'Not now')
+            .then(answer => answer === saveItem ? save() : undefined);
     }
 
     dispose() {
diff --git a/src/extension.ts b/src/extension.ts
index 4833267..56e8337 100644
--- a/src/extension.ts
+++ b/src/extension.ts
@@ -4,6 +4,7 @@ import { RemoteSSHResolver, REMOTE_SSH_AUTHORITY } from './authResolver';
 import { openSSHConfigFile, promptOpenRemoteSSHWindow } from './commands';
 import { HostTreeDataProvider } from './hostTreeView';
 import { getRemoteWorkspaceLocationData, RemoteLocationHistory } from './remoteLocationHistory';
+import { forgetSavedPasswords } from './ssh/savedPasswords';
 
 export async function activate(context: vscode.ExtensionContext) {
     const logger = new Log('Remote - SSH');
@@ -27,6 +28,11 @@ export async function activate(context: vscode.ExtensionContext) {
     context.subscriptions.push(vscode.commands.registerCommand('openremotessh.openEmptyWindowInCurrentWindow', () => promptOpenRemoteSSHWindow(true)));
     context.subscriptions.push(vscode.commands.registerCommand('openremotessh.openConfigFile', () => openSSHConfigFile()));
     context.subscriptions.push(vscode.commands.registerCommand('openremotessh.showLog', () => logger.show()));
+    context.subscriptions.push(vscode.commands.registerCommand('openremotessh.forgetSavedPasswords', async () => {
+        const count = await forgetSavedPasswords(context);
+        logger.info(`Forgot ${count} saved password(s)`);
+        void vscode.window.showInformationMessage(count ? `Forgot ${count} saved SSH password${count === 1 ? '' : 's'}.` : 'There are no saved SSH passwords.');
+    }));
 }
 
 export function deactivate() {
diff --git a/src/ssh/savedPasswords.ts b/src/ssh/savedPasswords.ts
new file mode 100644
index 0000000..349551b
--- /dev/null
+++ b/src/ssh/savedPasswords.ts
@@ -0,0 +1,48 @@
+import * as vscode from 'vscode';
+
+export type RememberPasswordsPolicy = 'ask' | 'always' | 'never';
+
+// SecretStorage can't list its keys on every editor version this extension
+// supports, so the names of the saved secrets — never their values — are kept
+// here for "Forget Saved Passwords".
+const SAVED_KEYS_STATE = 'openremotessh.savedPasswordKeys';
+
+export function getPasswordSecretKey(user: string, host: string, port: number): string {
+    return `openremotessh.password:${user}@${host}:${port}`;
+}
+
+export function getSavedPassword(context: vscode.ExtensionContext, key: string): Thenable<string | undefined> {
+    return context.secrets.get(key);
+}
+
+export async function savePassword(context: vscode.ExtensionContext, key: string, password: string): Promise<void> {
+    // Record the name first: a name without a secret is harmless, a secret
+    // without a name would survive "Forget Saved Passwords"
+    const keys = context.globalState.get<string[]>(SAVED_KEYS_STATE, []);
+    if (!keys.includes(key)) {
+        await context.globalState.update(SAVED_KEYS_STATE, [...keys, key]);
+    }
+    await context.secrets.store(key, password);
+}
+
+export async function deleteSavedPassword(context: vscode.ExtensionContext, key: string): Promise<void> {
+    await context.secrets.delete(key);
+    const keys = context.globalState.get<string[]>(SAVED_KEYS_STATE, []);
+    if (keys.includes(key)) {
+        await context.globalState.update(SAVED_KEYS_STATE, keys.filter(k => k !== key));
+    }
+}
+
+/**
+ * Deletes every saved password and returns how many there were.
+ */
+export async function forgetSavedPasswords(context: vscode.ExtensionContext): Promise<number> {
+    const keys = context.globalState.get<string[]>(SAVED_KEYS_STATE, []);
+    for (const key of keys) {
+        await context.secrets.delete(key);
+    }
+    // Only drop the names deleted above, in case a password was saved meanwhile
+    const remaining = context.globalState.get<string[]>(SAVED_KEYS_STATE, []).filter(k => !keys.includes(k));
+    await context.globalState.update(SAVED_KEYS_STATE, remaining.length ? remaining : undefined);
+    return keys.length;
+}
diff --git a/test/mocks/vscode.ts b/test/mocks/vscode.ts
index b8bdcc2..29fc1eb 100644
--- a/test/mocks/vscode.ts
+++ b/test/mocks/vscode.ts
@@ -5,6 +5,7 @@ type ProgressTask = <R>(progress: vscode.Progress<{ message?: string; increment?
 
 let $password: string = '';
 let $warningAnswer: string | undefined = undefined;
+let $infoAnswer: string | undefined = undefined;
 let $config: Record<string, unknown> = {};
 
 const DEFAULT_CONFIG: Record<string, unknown> = {
@@ -20,12 +21,46 @@ const env = {
     appRoot: '/bin/vscodium/app'
 };
 
+class SecretStorage {
+    readonly values = new Map<string, string>();
+
+    get = vi.fn(async (key: string) => this.values.get(key));
+    store = vi.fn(async (key: string, value: string) => {
+        this.values.set(key, value);
+    });
+    delete = vi.fn(async (key: string) => {
+        this.values.delete(key);
+    });
+}
+
+class Memento {
+    readonly values = new Map<string, unknown>();
+
+    get<T>(key: string, defaultValue?: T): T | undefined {
+        return this.values.has(key) ? this.values.get(key) as T : defaultValue;
+    }
+
+    keys(): readonly string[] {
+        return [...this.values.keys()];
+    }
+
+    update = vi.fn(async (key: string, value: unknown) => {
+        if (value === undefined) {
+            this.values.delete(key);
+        } else {
+            this.values.set(key, value);
+        }
+    });
+}
+
 class ExtensionContext {
     extensionPath = '/data/vscodium/extensions/open-remote-ssh';
     environmentVariableCollection = {
         persistent: false,
         replace: vi.fn(),
     };
+    secrets = new SecretStorage();
+    globalState = new Memento();
 }
 
 enum ProgressLocation {
@@ -72,18 +107,24 @@ const window = {
     setWarningAnswer: (answer: string | undefined) => {
         $warningAnswer = answer;
     },
+    setInfoAnswer: (answer: string | undefined) => {
+        $infoAnswer = answer;
+    },
     showWarningMessage: vi.fn(async (_message: string, _options?: vscode.MessageOptions, ...items: string[]) => {
         return $warningAnswer !== undefined && items.includes($warningAnswer) ? $warningAnswer : undefined;
     }),
+    showInformationMessage: vi.fn(async (_message: string, ...items: string[]) => {
+        return $infoAnswer !== undefined && items.includes($infoAnswer) ? $infoAnswer : undefined;
+    }),
     showErrorMessage: vi.fn(async () => undefined),
     // eslint-disable-next-line @typescript-eslint/no-unused-vars
-    showInputBox: async (options?: vscode.InputBoxOptions, _token?: vscode.CancellationToken) => {
+    showInputBox: vi.fn(async (options?: vscode.InputBoxOptions, _token?: vscode.CancellationToken): Promise<string | undefined> => {
         if(options?.title?.startsWith('Enter password for')) {
             return $password;
         }
 
         return undefined;
-    },
+    }),
 
     withProgress: (_options: vscode.ProgressOptions, task: ProgressTask) => {
         const mockProgressReporter = {
diff --git a/test/remember-password.test.ts b/test/remember-password.test.ts
new file mode 100644
index 0000000..fa615ea
--- /dev/null
+++ b/test/remember-password.test.ts
@@ -0,0 +1,237 @@
+import { randomUUID } from 'node:crypto';
+import fse from '@zokugun/fs-extra-plus/sync';
+import { vol } from 'memfs';
+import { afterAll, afterEach, beforeAll, expect, it, vi } from 'vitest';
+import { RemoteSSHResolver, getRemoteAuthority } from './rewires/remote';
+import { forgetSavedPasswords, getPasswordSecretKey } from '../src/ssh/savedPasswords';
+import { Log } from './mocks/logger';
+import * as vscode from './mocks/vscode';
+import { runDocker } from './utils/run-docker';
+import { getMappedPort } from './utils/get-mapped-port';
+import { waitForSSHReady } from './utils/wait-for-ssh-ready';
+import { sleep } from './utils/sleep';
+
+const SERVER_SETUP = fse.readFile('./src/scripts/server-setup.sh', 'utf8').value!;
+
+const PRODUCT_JSON = JSON.stringify({
+  nameShort: 'VSCodium',
+  nameLong: 'VSCodium',
+  applicationName: 'codium',
+  quality: 'stable',
+  commit: '4c0b0c6cc561d2d3636d1ec250935431876ce4dc',
+  version: '1.126.04524',
+  serverApplicationName: 'codium-server',
+  serverDataFolderName: '.vscodium-server',
+  serverDownloadUrlTemplate: 'https://github.com/VSCodium/vscodium/releases/download/1.126.04524/vscodium-reh-${os}-${arch}-1.126.04524.tar.gz',
+});
+
+const IMAGE = 'local-ubuntu-bash';
+const USERNAME = 'openremotessh';
+const PASSWORD = 'first-password-1234';
+const NEW_PASSWORD = 'changed-on-the-server';
+
+const suffix = randomUUID().slice(0, 8);
+const networkName = `open-remote-ssh-net-${suffix}`;
+const hostName = `open-remote-ssh-pw-${suffix}`;
+const targetName = `open-remote-ssh-pwtarget-${suffix}`;
+
+let hostPort: number;
+let hostKey: string;
+let targetKey: string;
+
+// One editor across all tests: its keychain survives each "reload"
+const extContext = new vscode.ExtensionContext();
+const logger = new Log('Remote - SSH');
+let activeResolver: InstanceType<typeof RemoteSSHResolver> | undefined;
+
+function resolveHost(host: string) {
+  const resolver = new RemoteSSHResolver(extContext, logger);
+  activeResolver = resolver;
+  return resolver.resolve(getRemoteAuthority(host), new vscode.RemoteAuthorityResolverContext());
+}
+
+function setServerPassword(password: string) {
+  runDocker(['exec', hostName, 'bash', '-c', `echo '${USERNAME}:${password}' | chpasswd`]);
+}
+
+function startContainer(name: string, publish: boolean) {
+  runDocker(['rm', '-f', name], true);
+
+  runDocker([
+    'run',
+    '--detach',
+    '--rm',
+    '--name',
+    name,
+    '--network',
+    networkName,
+    ...(publish ? ['--publish', '2222'] : []),
+    '--env',
+    `USER_NAME=${USERNAME}`,
+    '--env',
+    `USER_PASSWORD=${PASSWORD}`,
+    '--env',
+    'PASSWORD_ACCESS=true',
+    '--env',
+    'SUDO_ACCESS=false',
+    '--env',
+    'LOG_STDOUT=true',
+    IMAGE,
+  ]);
+}
+
+async function waitForTargetReady(timeoutMs: number) {
+  const start = Date.now();
+
+  while (Date.now() - start < timeoutMs) {
+    const probe = runDocker(
+      ['exec', hostName, 'bash', '-c', `timeout 1 bash -c '</dev/tcp/${targetName}/2222' && echo READY`],
+      true,
+    );
+
+    if (probe.includes('READY')) {
+      return;
+    }
+
+    await sleep(1000);
+  }
+
+  throw new Error('Timed out waiting for the target container to accept SSH');
+}
+
+beforeAll(async () => {
+  vol.reset();
+
+  runDocker(['network', 'rm', networkName], true);
+  runDocker(['network', 'create', networkName]);
+
+  startContainer(hostName, true);
+  startContainer(targetName, false);
+
+  hostPort = getMappedPort(hostName);
+  hostKey = getPasswordSecretKey(USERNAME, '127.0.0.1', hostPort);
+  targetKey = getPasswordSecretKey(USERNAME, targetName, 2222);
+
+  await waitForSSHReady(USERNAME, PASSWORD, hostPort, 60_000, hostName);
+  await waitForTargetReady(60_000);
+
+  vol.fromJSON({
+    '/etc/ssh/ssh_config': [
+      'Host pwtest',
+      '  HostName 127.0.0.1',
+      `  Port ${hostPort}`,
+      `  User ${USERNAME}`,
+      '',
+      'Host behind',
+      `  HostName ${targetName}`,
+      '  Port 2222',
+      `  User ${USERNAME}`,
+      '  ProxyJump pwtest',
+    ].join('\n'),
+    '/bin/vscodium/app/product.json': PRODUCT_JSON,
+    '/data/vscodium/extensions/open-remote-ssh/src/scripts/server-setup.sh': SERVER_SETUP,
+  });
+
+  logger.capture();
+}, 180_000);
+
+afterEach(() => {
+  activeResolver?.dispose();
+  activeResolver = undefined;
+  vscode.window.showInputBox.mockClear();
+  vscode.window.showInformationMessage.mockClear();
+});
+
+afterAll(() => {
+  vscode.workspace.resetConfiguration();
+  runDocker(['rm', '-f', hostName], true);
+  runDocker(['rm', '-f', targetName], true);
+  runDocker(['network', 'rm', networkName], true);
+});
+
+it('prompts on first connect and offers to save the password', async () => {
+  vscode.window.setPassword(PASSWORD);
+  vscode.window.setInfoAnswer('Save');
+
+  const result = await resolveHost('pwtest');
+  expect(result.host).to.eql('127.0.0.1');
+
+  expect(vscode.window.showInputBox).toHaveBeenCalledOnce();
+  expect(vscode.window.showInformationMessage).toHaveBeenCalledWith(`Save the password for ${USERNAME}@127.0.0.1:${hostPort} in your keychain?`, 'Save', 'Not now');
+  await vi.waitFor(() => expect(extContext.secrets.values.get(hostKey)).to.eql(PASSWORD));
+}, 120_000);
+
+it('reconnects with the saved password and no prompt', async () => {
+  // Typing this would fail, so connecting proves the saved one was used
+  vscode.window.setPassword('not-the-password');
+
+  const result = await resolveHost('pwtest');
+  expect(result.host).to.eql('127.0.0.1');
+
+  expect(vscode.window.showInputBox).not.toHaveBeenCalled();
+  expect(vscode.window.showInformationMessage).not.toHaveBeenCalled();
+}, 60_000);
+
+it('replaces the saved password once it changed on the server', async () => {
+  setServerPassword(NEW_PASSWORD);
+  vscode.window.setPassword(NEW_PASSWORD);
+  vscode.window.setInfoAnswer('Save');
+
+  const result = await resolveHost('pwtest');
+  expect(result.host).to.eql('127.0.0.1');
+
+  expect(vscode.window.showInputBox).toHaveBeenCalledOnce();
+  await vi.waitFor(() => expect(extContext.secrets.values.get(hostKey)).to.eql(NEW_PASSWORD));
+}, 60_000);
+
+it('forgets saved passwords', async () => {
+  expect(await forgetSavedPasswords(extContext)).to.eql(1);
+  expect(extContext.secrets.values.size).to.eql(0);
+});
+
+it('saves nothing after three wrong passwords', async () => {
+  vscode.window.setPassword('not-the-password');
+  vscode.window.setInfoAnswer('Save');
+
+  await expect(resolveHost('pwtest')).rejects.toThrow();
+
+  expect(vscode.window.showInputBox).toHaveBeenCalledTimes(3);
+  expect(vscode.window.showInformationMessage).not.toHaveBeenCalled();
+  expect(extContext.secrets.values.size).to.eql(0);
+}, 60_000);
+
+it('saves nothing when declined', async () => {
+  vscode.window.setPassword(NEW_PASSWORD);
+  vscode.window.setInfoAnswer('Not now');
+
+  const result = await resolveHost('pwtest');
+  expect(result.host).to.eql('127.0.0.1');
+
+  expect(vscode.window.showInformationMessage).toHaveBeenCalledOnce();
+  await sleep(100);
+  expect(extContext.secrets.values.size).to.eql(0);
+}, 60_000);
+
+it('saves a ProxyJump hop\'s password under its own key', async () => {
+  setServerPassword(PASSWORD);
+  vscode.window.setPassword(PASSWORD);
+  vscode.window.setInfoAnswer('Save');
+
+  const result = await resolveHost('behind');
+  expect(result.host).to.eql('127.0.0.1');
+
+  expect(vscode.window.showInputBox).toHaveBeenCalledTimes(2);
+  expect(vscode.window.showInformationMessage).toHaveBeenCalledTimes(2);
+  await vi.waitFor(() => {
+    expect(extContext.secrets.values.get(hostKey)).to.eql(PASSWORD);
+    expect(extContext.secrets.values.get(targetKey)).to.eql(PASSWORD);
+  });
+}, 120_000);
+
+it('never writes a password to the log', () => {
+  const messages = logger.messages();
+  expect(messages).toContain('Trying password authentication with the saved password');
+  expect(messages).not.toContain(PASSWORD);
+  expect(messages).not.toContain(NEW_PASSWORD);
+  expect(messages).not.toContain('not-the-password');
+});
diff --git a/test/saved-passwords.test.ts b/test/saved-passwords.test.ts
new file mode 100644
index 0000000..a469439
--- /dev/null
+++ b/test/saved-passwords.test.ts
@@ -0,0 +1,305 @@
+import type * as ssh2 from 'ssh2';
+import type { Prompt } from 'ssh2-streams';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { RemoteSSHResolver, isPasswordPrompt } from '../src/authResolver';
+import { deleteSavedPassword, forgetSavedPasswords, getPasswordSecretKey, savePassword } from '../src/ssh/savedPasswords';
+import { Log } from './mocks/logger';
+import * as vscode from './mocks/vscode';
+
+const PASSWORD = 'correct horse';
+const OLD_PASSWORD = 'battery staple';
+const KEY = getPasswordSecretKey('me', 'example.com', 22);
+
+let context: vscode.ExtensionContext;
+let logger: Log;
+
+function createAuth(port = 22) {
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const resolver = new RemoteSSHResolver(context as any, logger as any);
+    const { handler, onAuthenticated } = resolver['getSSHAuthHandler']('me', 'example.com', port, [], ['publickey', 'password', 'keyboard-interactive']);
+
+    // Calls the handler the way ssh2 does: once to start, then once per
+    // failure reply, and resolves with the method it picked
+    const next = (methodsLeft: string[] | null, partialSuccess = false) => new Promise<ssh2.AuthHandlerResult>(resolve => {
+        void handler(methodsLeft, partialSuccess, resolve);
+    });
+
+    return { next, onAuthenticated };
+}
+
+function answerPrompts(method: ssh2.AuthHandlerResult, prompts: Prompt[]) {
+    expect(method).toMatchObject({ type: 'keyboard-interactive' });
+    return new Promise<string[]>(resolve => (method as ssh2.KeyboardInteractiveAuthMethod).prompt('', '', '', prompts, resolve));
+}
+
+function flush() {
+    return new Promise(resolve => setImmediate(resolve));
+}
+
+beforeEach(() => {
+    context = new vscode.ExtensionContext();
+    logger = new Log('Remote - SSH');
+    logger.capture();
+    vscode.window.setPassword(PASSWORD);
+    vscode.window.setInfoAnswer('Save');
+});
+
+afterEach(() => {
+    // Whatever happened, no password may reach the log
+    expect(logger.messages()).not.toContain(PASSWORD);
+    expect(logger.messages()).not.toContain(OLD_PASSWORD);
+
+    vscode.workspace.resetConfiguration();
+    vscode.window.showInputBox.mockClear();
+    vscode.window.showInformationMessage.mockClear();
+});
+
+describe('isPasswordPrompt', () => {
+    it('accepts a lone hidden password prompt', () => {
+        expect(isPasswordPrompt([{ prompt: 'Password: ', echo: false }])).toBe(true);
+        expect(isPasswordPrompt([{ prompt: 'me@example.com\'s password: ', echo: false }])).toBe(true);
+    });
+
+    it('rejects echoed or multiple prompts', () => {
+        expect(isPasswordPrompt([{ prompt: 'Password: ', echo: true }])).toBe(false);
+        expect(isPasswordPrompt([{ prompt: 'Password: ', echo: false }, { prompt: 'Verification code: ', echo: false }])).toBe(false);
+        expect(isPasswordPrompt([])).toBe(false);
+    });
+
+    it('rejects second factors', () => {
+        for (const prompt of ['Verification code: ', 'One-time password (OATH) for `me\': ', 'Password + OTP: ', 'Password and token: ', 'Enter your password and Duo passcode: ']) {
+            expect(isPasswordPrompt([{ prompt, echo: false }]), prompt).toBe(false);
+        }
+    });
+});
+
+describe('saved password storage', () => {
+    it('keys secrets by user, host and port', () => {
+        expect(getPasswordSecretKey('me', 'example.com', 2222)).toBe('openremotessh.password:me@example.com:2222');
+    });
+
+    it('records only key names, and forgets them all', async () => {
+        await savePassword(context, 'a', PASSWORD);
+        await savePassword(context, 'b', PASSWORD);
+        await savePassword(context, 'b', OLD_PASSWORD);
+
+        expect(context.globalState.keys().map(k => context.globalState.get(k))).toEqual([['a', 'b']]);
+
+        await deleteSavedPassword(context, 'a');
+        expect(context.secrets.values.has('a')).toBe(false);
+
+        expect(await forgetSavedPasswords(context)).toBe(1);
+        expect(context.secrets.values.size).toBe(0);
+        expect(context.globalState.keys()).toEqual([]);
+        expect(await forgetSavedPasswords(context)).toBe(0);
+    });
+});
+
+describe('password authentication', () => {
+    it('offers to save a typed password once authenticated', async () => {
+        const { next, onAuthenticated } = createAuth();
+
+        expect(await next(null)).toMatchObject({ type: 'none' });
+        expect(await next(['password'])).toMatchObject({ type: 'password', password: PASSWORD });
+        onAuthenticated();
+
+        await vi.waitFor(() => expect(context.secrets.values.get(KEY)).toBe(PASSWORD));
+        expect(vscode.window.showInformationMessage).toHaveBeenCalledWith('Save the password for me@example.com in your keychain?', 'Save', 'Not now');
+    });
+
+    it('saves nothing when declined', async () => {
+        vscode.window.setInfoAnswer('Not now');
+        const { next, onAuthenticated } = createAuth();
+
+        await next(['password']);
+        onAuthenticated();
+        await flush();
+
+        expect(vscode.window.showInformationMessage).toHaveBeenCalledOnce();
+        expect(context.secrets.store).not.toHaveBeenCalled();
+    });
+
+    it('uses the saved password without prompting', async () => {
+        context.secrets.values.set(KEY, PASSWORD);
+        const { next, onAuthenticated } = createAuth();
+
+        expect(await next(['password'])).toMatchObject({ type: 'password', password: PASSWORD });
+        onAuthenticated();
+        await flush();
+
+        expect(vscode.window.showInputBox).not.toHaveBeenCalled();
+        expect(vscode.window.showInformationMessage).not.toHaveBeenCalled();
+    });
+
+    it('replaces a saved password the server rejects', async () => {
+        context.secrets.values.set(KEY, OLD_PASSWORD);
+        const { next, onAuthenticated } = createAuth();
+
+        expect(await next(['password'])).toMatchObject({ password: OLD_PASSWORD });
+        expect(await next(['password'])).toMatchObject({ password: PASSWORD });
+        expect(context.secrets.delete).toHaveBeenCalledWith(KEY);
+        onAuthenticated();
+
+        await vi.waitFor(() => expect(context.secrets.values.get(KEY)).toBe(PASSWORD));
+    });
+
+    it('still allows three typed tries after the saved one', async () => {
+        context.secrets.values.set(KEY, OLD_PASSWORD);
+        const { next } = createAuth();
+
+        expect(await next(['password'])).toMatchObject({ password: OLD_PASSWORD });
+        for (let i = 0; i < 3; i++) {
+            expect(await next(['password'])).toMatchObject({ password: PASSWORD });
+        }
+        expect(await next(['password'])).toBe(false);
+        expect(vscode.window.showInputBox).toHaveBeenCalledTimes(3);
+    });
+
+    it('offers the password that worked, not an earlier wrong one', async () => {
+        const { next, onAuthenticated } = createAuth();
+
+        vscode.window.showInputBox.mockResolvedValueOnce(OLD_PASSWORD);
+        expect(await next(['password'])).toMatchObject({ password: OLD_PASSWORD });
+        expect(await next(['password'])).toMatchObject({ password: PASSWORD });
+        onAuthenticated();
+
+        await vi.waitFor(() => expect(context.secrets.values.get(KEY)).toBe(PASSWORD));
+    });
+
+    it('offers nothing when the typed password was rejected and another method got in', async () => {
+        const { next, onAuthenticated } = createAuth();
+
+        vscode.window.showInputBox.mockResolvedValueOnce(OLD_PASSWORD);
+        await next(['password', 'keyboard-interactive']);
+        vscode.window.showInputBox.mockResolvedValueOnce('123456');
+        await answerPrompts(await next(['keyboard-interactive']), [{ prompt: 'Verification code: ', echo: false }]);
+        onAuthenticated();
+        await flush();
+
+        expect(vscode.window.showInformationMessage).not.toHaveBeenCalled();
+    });
+
+    it('saves a password accepted before a second factor', async () => {
+        const { next, onAuthenticated } = createAuth();
+
+        await next(['password']);
+        vscode.window.showInputBox.mockResolvedValueOnce('123456');
+        // Partial success: the password was right, a second factor is required
+        await answerPrompts(await next(['keyboard-interactive'], true), [{ prompt: 'Verification code: ', echo: false }]);
+        onAuthenticated();
+
+        await vi.waitFor(() => expect(context.secrets.values.get(KEY)).toBe(PASSWORD));
+    });
+
+    it('keeps a saved password accepted before a second factor', async () => {
+        context.secrets.values.set(KEY, PASSWORD);
+        const { next } = createAuth();
+
+        await next(['password']);
+        await next(['keyboard-interactive'], true);
+        // ...the second factor failed
+        await next(['password', 'keyboard-interactive']);
+
+        expect(context.secrets.delete).not.toHaveBeenCalled();
+    });
+
+    it('saves without asking when rememberPasswords is always', async () => {
+        vscode.workspace.setConfiguration('rememberPasswords', 'always');
+        const { next, onAuthenticated } = createAuth();
+
+        await next(['password']);
+        onAuthenticated();
+
+        await vi.waitFor(() => expect(context.secrets.values.get(KEY)).toBe(PASSWORD));
+        expect(vscode.window.showInformationMessage).not.toHaveBeenCalled();
+    });
+
+    it('neither asks nor saves when rememberPasswords is never', async () => {
+        vscode.workspace.setConfiguration('rememberPasswords', 'never');
+        const { next, onAuthenticated } = createAuth();
+
+        await next(['password']);
+        onAuthenticated();
+        await flush();
+
+        expect(vscode.window.showInformationMessage).not.toHaveBeenCalled();
+        expect(context.secrets.store).not.toHaveBeenCalled();
+    });
+
+    it('keeps passwords for different ports apart', async () => {
+        context.secrets.values.set(KEY, OLD_PASSWORD);
+        const { next } = createAuth(2222);
+
+        expect(await next(['password'])).toMatchObject({ password: PASSWORD });
+        expect(context.secrets.get).toHaveBeenCalledWith(getPasswordSecretKey('me', 'example.com', 2222));
+    });
+
+    it('prompts when the keychain cannot be read', async () => {
+        context.secrets.get.mockRejectedValueOnce(new Error('no keyring'));
+        const { next } = createAuth();
+
+        expect(await next(['password'])).toMatchObject({ password: PASSWORD });
+    });
+});
+
+describe('keyboard-interactive authentication', () => {
+    const PASSWORD_PROMPT = [{ prompt: 'Password: ', echo: false }];
+    const OTP_PROMPT = [{ prompt: 'Verification code: ', echo: false }];
+
+    it('answers a lone password prompt with the saved password', async () => {
+        context.secrets.values.set(KEY, PASSWORD);
+        const { next } = createAuth();
+
+        expect(await answerPrompts(await next(['keyboard-interactive']), PASSWORD_PROMPT)).toEqual([PASSWORD]);
+        expect(vscode.window.showInputBox).not.toHaveBeenCalled();
+    });
+
+    it('offers to save a password typed at a password prompt', async () => {
+        const { next, onAuthenticated } = createAuth();
+
+        vscode.window.showInputBox.mockResolvedValueOnce(PASSWORD);
+        await answerPrompts(await next(['keyboard-interactive']), PASSWORD_PROMPT);
+        onAuthenticated();
+
+        await vi.waitFor(() => expect(context.secrets.values.get(KEY)).toBe(PASSWORD));
+    });
+
+    it('saves only the password when a code is asked in the same attempt', async () => {
+        const { next, onAuthenticated } = createAuth();
+
+        const method = await next(['keyboard-interactive']);
+        vscode.window.showInputBox.mockResolvedValueOnce(PASSWORD);
+        await answerPrompts(method, PASSWORD_PROMPT);
+        vscode.window.showInputBox.mockResolvedValueOnce('123456');
+        await answerPrompts(method, OTP_PROMPT);
+        onAuthenticated();
+
+        await vi.waitFor(() => expect(context.secrets.values.get(KEY)).toBe(PASSWORD));
+    });
+
+    it('never answers or saves a one-time code', async () => {
+        context.secrets.values.set(KEY, PASSWORD);
+        const { next, onAuthenticated } = createAuth();
+
+        vscode.window.showInputBox.mockResolvedValueOnce('123456');
+        expect(await answerPrompts(await next(['keyboard-interactive']), OTP_PROMPT)).toEqual(['123456']);
+        onAuthenticated();
+        await flush();
+
+        expect(vscode.window.showInformationMessage).not.toHaveBeenCalled();
+        expect(context.secrets.store).not.toHaveBeenCalled();
+    });
+
+    it('replaces a saved password the server rejects', async () => {
+        context.secrets.values.set(KEY, OLD_PASSWORD);
+        const { next, onAuthenticated } = createAuth();
+
+        expect(await answerPrompts(await next(['keyboard-interactive']), PASSWORD_PROMPT)).toEqual([OLD_PASSWORD]);
+        vscode.window.showInputBox.mockResolvedValueOnce(PASSWORD);
+        expect(await answerPrompts(await next(['keyboard-interactive']), PASSWORD_PROMPT)).toEqual([PASSWORD]);
+        expect(context.secrets.delete).toHaveBeenCalledWith(KEY);
+        onAuthenticated();
+
+        await vi.waitFor(() => expect(context.secrets.values.get(KEY)).toBe(PASSWORD));
+    });
+});