Termiyo

Documentation

Termiyo, end to end

Short pages, in the order you will need them.

Getting started

Create your vault

The first time you open Termiyo it asks for a master password. This is the only thing protecting everything the app stores, it is never sent anywhere, and there is no recovery — use a passphrase of several unrelated words.

Add an identity

An identity is a username plus how to authenticate: a password, a private key, or an agent. Identities are separate from hosts so the same login works across a fleet without being retyped.

Add a host

Give it an address and pick an identity. Double-click it to connect. The first connection shows the server’s key fingerprint; accepting it pins the key for every reconnect after.

Jump hosts

Reaching a private host

Open the host, expand Advanced, and pick a jump host. Termiyo connects to the bastion first and opens a channel through it to the target — the target never needs to be reachable from your machine.

Chains

A jump host can have a jump host of its own. Termiyo flattens the whole path before it dials, refuses a chain that loops, and names the hop that failed when one does.

Port forwarding

Local

Listen on your machine, deliver on the server’s side. The usual case is reaching a database that only binds to localhost on the host.

Remote

The reverse: the server listens, and connections come back to a port on your machine. Useful for showing a local build to something that can only reach the server.

Dynamic (SOCKS5)

Termiyo runs a SOCKS5 proxy locally and sends every connection out through the session, with the destination resolved on the far end. Point a browser at it and you are browsing from the server.

Sharing a terminal

Creating a link

Open the share panel on a connected terminal and create a link. Anyone who follows it waits until you let them in, and joins read-only.

Letting someone type

Typing is off for the whole session until you turn it on, and then granted per person. Turning it back off takes it from everyone who already had it, immediately.

What travels where

The terminal stream goes directly between the two machines. Our service introduces the two of you and sees nothing after that. The link stops working after four hours or when you stop sharing, whichever is first.

Sync

Signing in

Settings, Sync. Use the password that already unlocks your vault — Termiyo derives two separate keys from it, one that stays here and one the server can check without ever learning the password.

A second machine

Install Termiyo, create a vault with the same password, and sign in. Your hosts, keys and snippets arrive on the first sync. Nothing is decrypted anywhere but on your own machines.

Signing out

Removes the token, not your data. What is on the machine stays on it, still encrypted under your vault password.

Asking for a command

Setting it up

Settings, AI, and an Anthropic API key. The key is stored in your vault, encrypted like every other credential.

Asking

Describe what you want. The suggestion lands on your command line for you to read; Termiyo never runs one for you. Anything that deletes, overwrites or stops a service is labelled.

What is sent

Your question, and the operating system if the login banner stated it. Recent commands are sent only if you turn that on. Hostnames, usernames, passwords and keys are never sent.

Telnet and serial

Serial consoles

Pick Serial when adding a host and Termiyo lists the ports it can see. 8-N-1 at 9600 is what most console ports use; a wrong speed does not error, it produces garbage, so check that first if the output looks wrong.

Sending a break

The break signal is how you interrupt a hung bootloader or drop a device into its recovery monitor. There is no other way to produce it from a terminal.

Telnet

Supported because network equipment often speaks nothing else. It is unencrypted — everything, including a password, travels in the clear. Use it on a management network, not across the internet.

Importing from AWS

What it needs

An access key with ec2:DescribeInstances, and nothing else. The credentials are used for that one call and are not stored.

What you get

Every running instance in the regions you pick, including the ones with no public address — those are the ones you reach through a bastion. Tick what you want.

Running it again

Re-importing updates the hosts you already have rather than adding a second copy, and leaves the identity you gave them alone.

Snippets

Saving a command

Snippets are commands you keep. Group them into packages, and restrict one to hosts carrying a given tag when it only makes sense in one place.

Startup commands

A snippet marked as a startup command runs the moment a session opens — for setting an environment, attaching to tmux, or dropping into the right directory.