Documentation
Termiyo, end to end
Short pages, in the order you will need them.
Getting started
Create your vault
The first time you open Termiyo it asks for a master password. This is the only thing protecting everything the app stores, it is never sent anywhere, and there is no recovery — use a passphrase of several unrelated words.
Add an identity
An identity is a username plus how to authenticate: a password, a private key, or an agent. Identities are separate from hosts so the same login works across a fleet without being retyped.
Add a host
Give it an address and pick an identity. Double-click it to connect. The first connection shows the server’s key fingerprint; accepting it pins the key for every reconnect after.
Jump hosts
Reaching a private host
Open the host, expand Advanced, and pick a jump host. Termiyo connects to the bastion first and opens a channel through it to the target — the target never needs to be reachable from your machine.
Chains
A jump host can have a jump host of its own. Termiyo flattens the whole path before it dials, refuses a chain that loops, and names the hop that failed when one does.
Port forwarding
Local
Listen on your machine, deliver on the server’s side. The usual case is reaching a database that only binds to localhost on the host.
Remote
The reverse: the server listens, and connections come back to a port on your machine. Useful for showing a local build to something that can only reach the server.
Dynamic (SOCKS5)
Termiyo runs a SOCKS5 proxy locally and sends every connection out through the session, with the destination resolved on the far end. Point a browser at it and you are browsing from the server.
Sync
Signing in
Settings, Sync. Use the password that already unlocks your vault — Termiyo derives two separate keys from it, one that stays here and one the server can check without ever learning the password.
A second machine
Install Termiyo, create a vault with the same password, and sign in. Your hosts, keys and snippets arrive on the first sync. Nothing is decrypted anywhere but on your own machines.
Signing out
Removes the token, not your data. What is on the machine stays on it, still encrypted under your vault password.
Asking for a command
Setting it up
Settings, AI, and an Anthropic API key. The key is stored in your vault, encrypted like every other credential.
Asking
Describe what you want. The suggestion lands on your command line for you to read; Termiyo never runs one for you. Anything that deletes, overwrites or stops a service is labelled.
What is sent
Your question, and the operating system if the login banner stated it. Recent commands are sent only if you turn that on. Hostnames, usernames, passwords and keys are never sent.
Telnet and serial
Serial consoles
Pick Serial when adding a host and Termiyo lists the ports it can see. 8-N-1 at 9600 is what most console ports use; a wrong speed does not error, it produces garbage, so check that first if the output looks wrong.
Sending a break
The break signal is how you interrupt a hung bootloader or drop a device into its recovery monitor. There is no other way to produce it from a terminal.
Telnet
Supported because network equipment often speaks nothing else. It is unencrypted — everything, including a password, travels in the clear. Use it on a management network, not across the internet.
Importing from AWS
What it needs
An access key with ec2:DescribeInstances, and nothing else. The credentials are used for that one call and are not stored.
What you get
Every running instance in the regions you pick, including the ones with no public address — those are the ones you reach through a bastion. Tick what you want.
Running it again
Re-importing updates the hosts you already have rather than adding a second copy, and leaves the identity you gave them alone.
Snippets
Saving a command
Snippets are commands you keep. Group them into packages, and restrict one to hosts carrying a given tag when it only makes sense in one place.
Startup commands
A snippet marked as a startup command runs the moment a session opens — for setting an environment, attaching to tmux, or dropping into the right directory.