Download

Built so a stolen laptop is a boring story.

An SSH client holds the keys to everything you run. This page explains exactly how Termora protects them, in enough detail that you can check our reasoning.

The vault

Everything you save in Termora, from hosts and groups to keys and known hosts, is encrypted on your computer before it's written to disk.

  1. 1Your master password

    Never stored and never sent anywhere.

  2. 2A slow, memory-hard key

    Turning your password into a key is deliberately expensive, so guessing it is too.

  3. 3Your vault key

    Random, unique to your vault, and only ever unlocked in memory.

  4. 4Sealed records

    Every item is encrypted on its own with modern authenticated encryption, so any tampering is caught.

One saved host, as it sits on your disk

9f2c 71ae 0b4d e83f 5a61 c9d0 7e12 44b8 a3f6 0c9e 2d57 b1a4 68ef 13c0 d95b 7a28 f041 6ce3 8b1d 52a9 e7c4 309f 1bd6 84e2 af73 c518 06bd 3e9a 72f5 d460

Without your password, a copy of your vault is noise. Names, addresses, users, tags and keys are all inside the encrypted part.

Tampering is caught

Every item is sealed individually. If anything in your vault is edited, swapped or rolled back behind Termora's back, it refuses to use it.

Not just passwords

Host names, addresses, users and tags are encrypted too, so your vault file says nothing about what you run.

The Recovery Key

A random key, shown once when you set up, that can open your vault if you forget your password. Termora keeps no copy.

Secrets kept apart from the screen

The part of Termora that draws the screen is the part most exposed to what servers send back, so it's the part that never sees a secret.

  1. What you see

    Does
    Draws the app and your terminals.
    Holds
    Names, fingerprints and terminal text. Never a private key or password.

  2. The go-between

    Does
    Windows, menus and updates.
    Holds
    Nothing secret, and it never talks to your servers.

  3. The security core

    Does
    Connections, encryption, keys and the vault.
    Holds
    The only place a secret is ever unlocked, and only while it is needed.

Termora is split into separate parts that can only talk to each other in narrow, checked ways, so a problem in one can't reach what the others hold.

A locked-down window

The interface runs sandboxed, with no access to your files or system, and loads nothing from the internet.

Server output is only ever text

Terminal output, file names and login banners are rendered as text, never as HTML, so a hostile server can't inject anything into the app.

Keys in, fingerprints out

Private keys are unlocked only when a connection needs them and wiped from memory afterwards. The interface only ever sees public keys and fingerprints.

Connections

Host keys are checked every time

The first time you connect to a server, Termora shows its fingerprint and asks you to confirm it. After that, if the fingerprint ever changes, the connection is blocked and you see the old and new keys side by side. Trusting a new key takes a deliberate step in the host's settings, never a click on a warning.

Passwords you can't read back

Saved passwords are write-only. You can replace one, but the interface can never display it, so there's nothing to shoulder-surf.

Agent forwarding is off until you turn it on

Per host or per group, so a key can only be used through servers you've chosen.

Locking and unlocking

Termora locks after the idle time you choose, when your computer sleeps and when your screen locks. On lock, every decrypted key and password is wiped from memory.

Your master password always works. Before 1.0, you'll also be able to unlock with Touch ID, Windows Hello or a FIDO2 security key such as a YubiKey, either instead of your password or as a second factor.

What we can see

Nothing, today. Termora doesn't need an account and makes no network connections of its own except to the servers you connect to.

Crash reports will arrive with the beta, and they'll be off unless you turn them on. Host names, commands, terminal output and keys are removed before a report ever leaves your computer.

When sync arrives, it will be end-to-end encrypted. Our servers will store data they can't read.

Testing and audits

Every sign-in method, jump hosts and host key changes are tested against real SSH servers, and the vault is tested to prove it rejects anything that has been tampered with.

Before paid plans launch, Termora will have an independent security audit.

Found a problem?

Please email security@termora.dev with the details. We'll confirm we have it and keep you updated until it's fixed. Please give us a reasonable chance to ship a fix before you publish.