winget install --id=Ternix.Ternix -e Ternix is a modern, feature-rich SSH and remote session manager built with Electron. It supports SSH, serial, RDP and SFTP connections with a sleek, fast interface. Features include split panes, session recording, tunneling, and more.
One terminal. Everything.
A modern, cross-platform SSH & remote session manager built with Electron, React, and xterm.js.
Ternix is a privacy-first desktop terminal and remote-session manager. It speaks SSH, Telnet, Serial, local shells, RDP, and VNC from a single interface, and bundles the tools you normally reach for separately: an SFTP file manager, an SSH key vault, port forwarding, session recording, a live system monitor, and command snippets.
Everything is stored locally in a SQLite database. Credentials are encrypted at rest with AES-256-GCM. Nothing is sent to a cloud service.
It ships as a native app for Linux (AppImage/deb) and Windows (NSIS installer/portable).
| Protocol | What Ternix does |
|---|---|
| SSH | Password, public-key, SSH-agent, keyboard-interactive (MFA/OTP), and none auth. Multi-hop jump-host chains (ProxyJump). Host-key pinning. Per-session keepalives and compression. Server banner display. Round-trip latency probe. Startup commands. Optional agent forwarding (under agent auth). |
| Telnet | Raw TCP with IAC option negotiation — NAWS (window size, re-sent on resize), terminal-type (xterm-256color), suppress-go-ahead, and echo. Auto-login on login: / password: prompt detection. |
| Serial / COM | Native serialport. Port enumeration with manufacturer names. Baud 300–921600, 7/8 data bits, 1/1.5/2 stop bits, parity (none/even/odd/mark/space), flow control (RTS/CTS or XON/XOFF). |
| Local shell | Native PTY via node-pty. Defaults to $SHELL (or /bin/bash) on Unix and $COMSPEC (or PowerShell) on Windows. Custom shell, args, cwd, and env supported. |
| VNC | Embedded in-pane viewer (noVNC) over a loopback, token-gated WebSocket↔TCP bridge. VNC password auth. Scales and centres to the pane. Falls back to a native client (vncviewer, xtigervncviewer, Remmina on Linux; TightVNC on Windows). |
| RDP | Embedded in-pane viewer (Apache Guacamole) through a local guacd daemon on Linux. guacd reachability is probed automatically; when it's unavailable — and always on Windows — Ternix hands off to a native client (mstsc, with credentials pre-stashed via cmdkey, or xfreerdp/wlfreerdp). guacd host/port configurable in Settings → Advanced. |
Ctrl + / - / 0Ctrl+Shift+D) or down (Ctrl+Shift+E); a new pane inherits the active pane's sessionCtrl+1…Ctrl+9 to jumpCtrl+R to reconnect a dropped pane manuallyCtrl+P opens a fuzzy palette over every saved session plus quick actions (new SSH session, new local shell, split, toggle sidebar, open SFTP, key vault, broadcast, settings, import/export).
All 21 shortcuts below are rebindable in Settings → Keyboard (click a row, press the combo). Overrides are stored as JSON.
| Action | Default | Action | Default |
|---|---|---|---|
| New tab (local shell) | Ctrl+T | Toggle SFTP panel | Ctrl+Shift+F |
| New SSH session | Ctrl+Shift+N | Toggle broadcast | Ctrl+Shift+B |
| Close tab | Ctrl+W | Increase font size | Ctrl+= |
| Next / previous tab | Ctrl+Tab / Ctrl+Shift+Tab | Decrease font size | Ctrl+- |
| Split right | Ctrl+Shift+D | Reset font size | Ctrl+0 |
| Split down | Ctrl+Shift+E | Clear terminal | Ctrl+L |
| Toggle sidebar | Ctrl+B | Disconnect | Ctrl+Shift+Q |
| Command palette | Ctrl+P | Toggle recording | Ctrl+Shift+R |
| Find in terminal | Ctrl+F | Open key vault | Ctrl+Shift+K |
| Open settings | Ctrl+, | Full screen | F11 |
Ctrl+1…Ctrl+9 (jump to tab) and Ctrl+R (reconnect) are fixed.
aes256-cbc)~/.ssh to batch-import local keys (passphrase-protected keys are skipped — they can't be fingerprinted unattended)ssh-copy-id equivalentSHA256: fingerprints and a "used by N sessions" countHost keys are pinned in a known_hosts table (SQLite, not the OpenSSH file). Three modes via ssh.hostKeyStrictness:
A changed host key always raises a warning dialog showing both the stored and the offered fingerprint, in every mode.
[IV | GCM tag | ciphertext] with a fresh random IV per encryption.> See Security Notes for exactly where the key lives in each mode. It matters.
chmodCtrl/Cmd-click, Shift-click ranges, and Ctrl+Achmod editor — a 3×3 permission grid tied to a live octal fieldtransfer.maxConcurrent, default 3), applied across an entire folder tree rather than per-directory-L), Remote (-R), and Dynamic (-D, SOCKS5) tunnels, saved per session${VAR} interpolation — each unique variable prompts once at run time.cast).castA live dashboard for the machine you're connected to — local or remote over SSH — polled every 3 seconds:
Remote stats are gathered by a small /proc probe over the SSH connection. While a session is still handshaking the panel says so rather than quietly showing your local machine's numbers.
Import from 7 formats — Ternix JSON backup, OpenSSH config, PuTTY .reg, WinSCP .ini, MobaXterm .mxtsessions, Tabby config.yaml, and generic CSV.
Export to 5 — Ternix JSON, CSV, OpenSSH config, MobaXterm, Tabby. (PuTTY and WinSCP are import-only.)
Smart key auto-linking — IdentityFile and other key paths are resolved against the vault by fingerprint first, then filename. Keys found on disk are imported automatically; keys that can't be located are recorded in the session's notes so nothing silently breaks. Duplicate sessions (same name + protocol + host + user) are skipped.
Exporting a backup with private keys requires the master password, when one is set.
12 built-in themes: Default Dark · Default Light · Dracula · Nord · Solarized Dark · Solarized Light · Tokyo Night · Gruvbox Dark · Monokai · One Dark Pro · Catppuccin Mocha · Catppuccin Latte
Every setting key and its default
| Section | Key | Default |
|---|---|---|
| General | general.defaultShell | (empty) |
| General | general.startupBehavior | blank (blank / reopen / picker) |
| General | general.newTabProtocol | local |
| General | general.confirmCloseActive | true |
| General | general.autoReconnect | false |
| General | general.autoReconnectRetries | 3 |
| General | general.autoReconnectDelay | 3 |
| Terminal | terminal.scrollback | 5000 |
| Terminal | terminal.bell | none (none / visual / audio) |
| Terminal | terminal.wordSeparators | ()[]{}'"` |
| Terminal | terminal.copyOnSelect | false |
| Terminal | terminal.pasteOnMiddleClick | true |
| Terminal | terminal.pasteConfirmMultiline | true |
| Terminal | terminal.trimPasteWhitespace | false |
| Terminal | terminal.rightClick | menu (menu / paste) |
| Appearance | appearance.theme | dark-default |
| Appearance | appearance.fontFamily | JetBrains Mono, Fira Code, … |
| Appearance | appearance.fontSize | 14 |
| Appearance | appearance.ligatures | false |
Powered by electron-updater against GitHub Releases. Ternix checks on startup (when enabled) and surfaces a toast with a View button that jumps straight to Settings → Updates, where you can download with a live progress bar and restart to install.
The Beta channel opts you into GitHub pre-releases; Stable offers only full releases. The choice takes effect on the next check — no restart needed. Updates only work in packaged builds.
ternix/
├── electron/ # Main process (Node.js / Electron)
│ ├── main.ts # Window, CSP, power monitor, navigation lockdown
│ ├── preload.ts # Context-isolated IPC bridge (TernixApi)
│ ├── db/
│ │ ├── schema.ts # SQLite schema (WAL, foreign keys on)
│ │ ├── migrations/ # user_version-based forward migrations
│ │ ├── repo.ts # Repository layer
│ │ └── snippetScope.ts # Global vs session-scoped snippet invariant
│ ├── ipc/ # 20 IPC namespaces, {ok,data}/{ok,error} envelope
│ └── services/
│ ├── SshService.ts # SSH2 client: jump chains, host-key pinning, MFA
│ ├── SftpService.ts # SFTP ops + chunked transfers, pause/cancel
│ ├── TelnetService.ts # Telnet with IAC option negotiation
│ ├── SerialService.ts # serialport (lazy-loaded)
│ ├── PtyService.ts # Local PTY (node-pty)
│ ├── RdpGatewayService.ts # guacd gateway (guacamole-lite)
│ ├── VncBridgeService.ts # Token-gated loopback WebSocket↔TCP bridge
│ ├── NativeClientService.ts # mstsc / xfreerdp / vncviewer fallbacks
│ ├── TunnelService.ts # -L / -R / -D (SOCKS5)
│ ├── RecordingService.ts # asciinema v2 + storage cap
│ ├── KeyService.ts # Key vault: generate, import, deploy
│ ├── CryptoService.ts # AES-256-GCM vault + PBKDF2
│ ├── ImportExportService.ts # 7 import / 5 export formats
│ ├── ConnectionManager.ts # Active connection registry, OSC 7 cwd tracking
│ └── DatabaseService.ts # SQLite lifecycle
│
├── src/ # Renderer process (React + TypeScript)
│ ├── components/
│ │ ├── layout/ # RootLayout, ActivityBar, Sidebar, TabBar, StatusBar,
│ │ │ # TitleBar, CommandPalette, Toast, StatsPoller
│ │ ├── terminal/ # TerminalArea, TerminalPane, SplitLayout, BroadcastBar,
│ │ │ # TerminalSearch, TerminalToolbar, RemoteDesktopPane
│ │ ├── sidebar/ # SessionTree, GroupFolder, SessionCard, SnippetsPanel,
│ │ │ # TunnelsPanel, RecordingsPanel, StatsPanel,
│ │ │ # SearchPanel, SftpSidebar, TransferQueue
│ │ ├── sftp/ # SftpPanel, FileList, FileRow, PermissionsEditor
│ │ ├── settings/ # SettingsPanel + 9 sections
│ │ ├── dialogs/ # NewSession, KeyVault, Tunnel, ExportImport,
│ │ │ # RecordingPlayer, ThemeEditor, Snippet, ConnectionLog
│ │ └── ui/ # Modal, ContextMenu
│ ├── store/ # Zustand: tabs, sessions, settings, theme, sftp,
│ │ # transfers, stats, ui
│ ├── hooks/ # useTerminal, useSftp, useKeyboard, useTheme, useSsh
│ ├── themes/ # 12 built-in themes
│ └── utils/ # fuzzy, path, sftpSort, statsTarget, snippets, format*
│
├── electron-builder.json # AppImage + deb (Linux), NSIS + portable (Windows)
└── electron.vite.config.ts
better-sqlite3, synchronous, in the main process — no races on credential storage. WAL journal, foreign keys on, user_version migrations applied in a transaction.ssh2 for the full protocol: multi-hop jump hosts, the SFTP subsystem, exec channels, and the latency probe.OPENSSH_MAX_PKT_LEN − PKT_RW_OVERHEAD). ssh2's SFTP streams issue one request and wait for the reply, so on a high-latency link the chunk size is the throughput.node-pty for local shells with real signal handling; serialport loaded lazily so the app still boots if its native build failed.[IV | tag | ciphertext].contextBridge surface; each IPC call returns an {ok, data} / {ok, error} envelope and pings the vault idle timer.Download the .exe installer or the portable build from Releases.
Download the .AppImage or .deb from Releases.
For embedded RDP, install guacd (the .deb declares it as a dependency). Without it, RDP falls back to a native client.
libsecret-1-dev (keytar), libudev-dev (serialport); rpm and libarchive-tools to packagesetuptools (the distutils shim node-gyp needs on Python 3.12+)git clone https://github.com/PraneethReddy-github/ternix.git
cd ternix
npm install
npm run dev
If you hit native module errors (node-pty, better-sqlite3, serialport, keytar):
npm run rebuild
npm run build:linux # AppImage + .deb → dist-electron/linux
npm run build:win # NSIS + portable → dist-electron/win
npm run typecheck # tsc across renderer + main
npm run lint # eslint over .ts / .tsx
Ternix has no test framework. Instead, non-trivial pure logic keeps a runnable self-check beside it — plain assert, no fixtures. Run them with Node's type stripping:
node --experimental-strip-types electron/db/snippetScope.check.ts
node --experimental-strip-types electron/services/sftpOwner.check.ts
node --experimental-strip-types electron/services/transferOutcome.check.ts
node --experimental-strip-types electron/services/vaultKeyPlan.check.ts
node --experimental-strip-types src/utils/sftpSort.check.ts
node --experimental-strip-types src/utils/statsTarget.check.ts
Ternix keeps every credential on your machine. Here is precisely how.
SSH passwords, key passphrases, VNC passwords, and stored private keys are encrypted with AES-256-GCM. Each blob is laid out as [12-byte IV | 16-byte auth tag | ciphertext] with a fresh random IV per encryption, so identical secrets never produce identical ciphertext, and any tampering fails the GCM tag check on decrypt.
Hosts, usernames, ports, notes, tags, and snippet commands are not encrypted — they are ordinary columns in the SQLite database.
Everything above is encrypted with one 256-bit vault key. There are two modes.
Keychain mode (default). The key is generated on first run and stored in your operating system's credential store:
| Platform | Backing store |
|---|---|
| Windows | Credential Manager |
| Linux | Secret Service (libsecret / GNOME Keyring / KWallet) |
Ternix writes the key, then reads it back and compares before trusting the store. On every launch the key is read from the keychain — it is not kept on disk.
If the machine has no credential store at all (a headless Linux box without libsecret, or a failed keytar build), Ternix falls back to a 0600 key file at /.vaultkey. That fallback is the only situation in which the key touches the filesystem, and in that case the file protects the vault exactly as well as your user account does.
Master-password mode. The key is derived from your password with PBKDF2 (100,000 iterations, SHA-512) against a stored random salt, and is never written anywhere — not the keychain, not the disk. It exists only in memory while the vault is unlocked. Switching modes re-encrypts every stored secret in a single database transaction, and old keys are zeroed in memory afterwards.
Your password itself is never stored. It is verified by decrypting a known verifier string: the wrong password fails the GCM auth tag.
Master-password mode locks the vault on an idle timeout and on system sleep, zeroing the key. Keychain mode is always unlocked — the key is available whenever the app runs, so the idle and sleep settings do nothing there. Choose master-password mode if you want a vault that actually locks.
ignore-cert). Treat in-pane RDP as protected by the network path, not by TLS identity.contextIsolation is on, nodeIntegration is off, webviewTag is off, in-app navigation is blocked, window.open is denied, and a Content-Security-Policy is injected on every response.Documented so you don't discover them the hard way:
server_alive_interval, and RDP colour-depth/fullscreen are exposed in the session editor but not yet wired to the connection.mstsc.~/.ssh scanning skips passphrase-protected keys (they can't be fingerprinted without the passphrase).| Package | Purpose |
|---|---|
@xterm/xterm + addons (fit, search, web-links, webgl, unicode11) | Terminal emulator |
ssh2 | SSH2 protocol client + SFTP |
node-pty | Local shell PTY |
serialport | Serial / COM |
better-sqlite3 | Synchronous SQLite |
keytar | OS keychain (optional) |
guacamole-lite + guacamole-common-js | Embedded RDP via guacd |
@novnc/novnc + ws | Embedded VNC over a loopback bridge |
js-yaml | Tabby YAML import/export |
react + react-dom + zustand | UI and state |
lucide-react | Icons |
electron-updater (optional) | Auto-update against GitHub Releases |
Contributions are welcome — please open an issue first to discuss substantial changes.
git checkout -b feature/amazing-feature)npm run typecheck and the relevant *.check.ts self-checksgit commit -m 'feat: add amazing feature')MIT — see LICENSE.
Built with ❤️ using Electron, React, and xterm.js
>T<
| Appearance |
appearance.lineHeight |
1.2 |
| Appearance | appearance.letterSpacing | 0 |
| Appearance | appearance.cursorStyle | block |
| Appearance | appearance.cursorBlink | true |
| Appearance | appearance.compactMode | false |
| Appearance | appearance.showClock | false |
| Appearance | appearance.customCss | (empty) |
| SSH | ssh.defaultPort | 22 |
| SSH | ssh.defaultUsername | (empty) |
| SSH | ssh.agentSock | (empty) |
| SSH | ssh.hostKeyStrictness | prompt (strict / prompt / auto-accept) |
| SSH | ssh.connectTimeout | 20000 ms |
| SSH | ssh.showBanner | true |
| Security | security.vaultLockTimeout | 0 min (0 = never) |
| Security | security.lockOnSleep | false |
| Security | security.clearClipboard | 0 s (0 = never) |
| Transfers | transfer.downloadDir | (empty → local pane's dir) |
| Transfers | transfer.conflict | prompt (prompt / overwrite / skip / rename) |
| Transfers | transfer.maxConcurrent | 3 |
| Transfers | transfer.preserveTimestamps | true |
| Recording | recording.autoRecord | false |
| Recording | recording.maxStorageMb | 0 (0 = unlimited) |
| Updates | updates.autoCheck | true |
| Updates | updates.channel | stable |
| Advanced | rdp.guacdHost | 127.0.0.1 |
| Advanced | rdp.guacdPort | 4822 |
| Advanced | advanced.hardwareAcceleration | true |
| Advanced | advanced.rendererType | webgl (webgl / canvas) |
| Advanced | advanced.debugLogLevel | info |