Download

Security

An SSH client has access to every server you run. This page describes how Termora protects that access.

The vault

Everything you save in Termora, including hosts, groups, keys and known hosts, is encrypted on your computer before it's written to disk.

  1. 1Your master password

    Never stored or sent anywhere.

  2. 2Memory-hard key derivation

    Deliberately slow, so guessing passwords is expensive.

  3. 3Your vault key

    Random and unique to your vault. Only decrypted in memory.

  4. 4Encrypted records

    Each item is encrypted separately with authenticated encryption, so tampering is detected.

One saved host, as stored on disk

9f2c 71ae 0b4d e83f 5a61 c9d0 7e12 44b8 a3f6 0c9e 2d57 b1a4 68ef 13c0 d95b 7a28 f041 6ce3 8b1d 52a9 e7c4 309f 1bd6 84e2 af73 c518 06bd 3e9a 72f5 d460

Without your master password, the vault file can't be read. Names, addresses, users, tags and keys are all encrypted.

Tampering is detected

Each item is encrypted separately. If an item is edited, swapped or rolled back, Termora refuses to use it.

Hostnames too

Host names, addresses, users and tags are encrypted, so the vault file doesn't reveal your servers.

The Recovery Key

A random key, shown once during setup, that unlocks the vault if you forget your password. Termora doesn't keep a copy.

Secrets stay out of the interface

The interface handles what servers send back, the least trusted input, so it never has access to secrets.

  1. Interface

    Does
    Draws Termora and your terminals.
    Holds
    Names, fingerprints and terminal text. Never a private key or password.

  2. Main process

    Does
    Windows, menus and updates.
    Holds
    No secrets. Never connects to your servers.

  3. Security core

    Does
    Connections, encryption, keys and the vault.
    Holds
    The only process that decrypts secrets, and only while they are needed.

The three processes communicate only through narrow, validated channels, so a flaw in one can't expose what the others hold.

Sandboxed interface

The interface runs sandboxed, with no file or system access, and loads nothing from the internet.

Server output is text

Terminal output, file names and login banners are rendered as text, never HTML, so a server can't inject content into Termora.

Only fingerprints reach the interface

Private keys are decrypted only when a connection needs them, then cleared from memory. The interface only receives public keys and fingerprints.

Connections

Host keys are checked on every connection

On first connect, Termora shows the server's fingerprint and asks you to confirm it. If the fingerprint later changes, the connection is blocked and both keys are shown. Trusting the new key is a separate step in the host's settings.

Saved passwords can't be read back

You can replace a saved password, but Termora never displays it.

Agent forwarding is off by default

Turn it on per host or per group.

Locking and unlocking

Termora locks after the idle time you choose, on sleep and when the screen locks. Locking clears every decrypted key and password from memory.

Your master password always works. Before 1.0, Termora will also support Touch ID, Windows Hello and FIDO2 security keys such as YubiKey, instead of the password or as a second factor.

What we can see

Nothing about your servers. Termora doesn't need an account. Other than your servers, Termora only contacts our update server to check for new versions.

The counters on Home, such as commands run and time connected, are counts only. They don't include what you typed, stay on this computer and can be reset in Settings.

Crash reports will come with the beta, off by default. Host names, commands, terminal output and keys are removed before a report is sent.

Sync will be end-to-end encrypted. Our servers will store data they can't read.

Testing

Every sign-in method, jump hosts and host key changes are tested against real SSH servers. The vault is tested to confirm it rejects tampered data.

Found a problem?

Please email security@termora.dev with the details. We'll confirm receipt and keep you updated until it's fixed. Please allow reasonable time for a fix before publishing.