Terminal, SFTP, tunnels and jump hosts in one window. Share a session with a colleague, sync it to your other machines, and keep every password and key encrypted on your own hardware — by a password we never see.
The hop
Chain as many bastions as your network needs. Termiyo flattens the path, catches loops before it dials, and tells you which hop failed.
One window
A shell, a file you need off a machine before it reboots, a forward you want for the next ten minutes, and the switch whose network is the thing you are fixing. Same window, same vault, same host list.
deploy@prod-web-01:~$ tail -f /var/log/nginx/access.log
10.0.4.18 - - [30/Aug/2026:04:12:31] "GET /health" 200 2
10.0.4.21 - - [30/Aug/2026:04:12:31] "GET /health" 200 2
10.0.4.18 - - [30/Aug/2026:04:12:33] "POST /api/v1/jobs" 201 148
10.0.4.33 - - [30/Aug/2026:04:12:34] "GET /api/v1/jobs" 200 9214
deploy@prod-web-01:~$
The vault
Termius derives its vault key with PBKDF2 at a thousand iterations, which a rented GPU chews through. Termiyo uses Argon2id, which charges every attempt 64 MiB of memory before it can even be wrong.
The whole grid is one attempt — and an attacker pays it again for every password they try
Argon2id key derivation — 64 MiB of memory per guess, not a fast hash
XChaCha20-Poly1305 for every record, bound to its own identity
Host keys pinned on first sight and checked on every reconnect
No telemetry on by default, and no credential ever leaves your device
Session sharing
Send a link and someone watches the session you are already in. You admit each person, read-only unless you say otherwise, and you never gave anyone a key to the box.
deploy@prod-web-01:~$ journalctl -u api -n 3
Aug 30 04:12:31 api[1184]: worker 3 timed out
Aug 30 04:12:31 api[1184]: restarting worker 3
Aug 30 04:12:34 api[1184]: worker 3 ready
deploy@prod-web-01:~$ you
guest · read-only
Where the stream goes
The server hands the two of you each other's address and then has nothing to carry. It never sees a keystroke, and it could not replay the session if it wanted to.
Everything else
The features below are the ones you reach for on a bad afternoon — a bastion that will not answer, a tunnel you need right now, a file you have to get off a box before it reboots.
628 command specs — docker, kubectl, terraform, git, helm, gh and the rest — from the same open spec format the Fig project publishes. Flags and subcommands, with what they do, before you run the wrong one.
Change it once and every open tab follows.
Termiyo Dark
Browse, upload, rename and chmod without leaving the host you are already connected to.
Encrypted sync across your devices. The server stores ciphertext and revision numbers — it has never held a key that opens any of it.
Describe what you want and Termiyo writes the command onto your line for you to read. It never runs anything, and it says when something is destructive.
Keep the commands you always run. Fire them at one host or a whole tag, or have them run the moment a session opens.
Ed25519 and RSA keys, agent forwarding, and keyboard-interactive challenges — including the 2FA prompt your bastion asks for.
WebGL rendering and a 10,000-line scrollback per tab, so a noisy build log scrolls at the speed the server sends it.
For the switch, the PDU, the bootloader — and the machine whose network is the thing you are trying to fix. 8-N-1 where it belongs.
Point Termiyo at an AWS account and it lists what is running, including the instances with no public address.
Measured, not asserted
Two SSH clients look identical until you ask what happens to the password you typed. These figures come from reading the shipped Termius 9.43.1 bundle, not from anybody's marketing.
Vault key derivation
Record encryption
Where credentials sit at rest
Chromium the app runs on
Post-quantum key exchange
Termius is a good product with a decade of work in it, and this table is not a claim that it is not. It is the short list of things we decided we could not ship the way they were shipped.
Every connection feature is in the free version. No account needed to start — the vault lives on your machine until you decide otherwise.
Get TermiyomacOS and Windows today, Linux next