your servers.
your keys.
your terminal.
termikal is the local terminal and ssh client that keeps nothing. no account to start. every byte encrypted on your machine with sqlcipher. a real local shell, live ssh, and production guardrails, with linux commands on any os. zero-knowledge is enforced by math.
a terminal that trusts nothing, including us.
four principles are non-negotiable. they shape every feature, and they're why termikal can promise what other clients can't.
local-first
core features work 100% offline with no account. sqlite on your disk is the source of truth. lose our servers and you lose nothing.
zero-knowledge
everything you save is encrypted on your device. hosts, keys, and settings live in a sqlcipher vault only your passphrase can unlock.
ai is opt-in
off by default. turn it on when you want it; turn it off and it vanishes from the ui entirely. bring your own key.
no spyware
zero behavioral analytics. no background process when you're not in a session. crash reports are strictly opt-in.
guardrails stop the command you'd regret.
terminals are context-blind: typing rm -rf on prod looks exactly like typing it on dev. termikal tags every host by environment and catches destructive commands before you press enter. it runs locally, with no ai, and nothing is sent anywhere.
- ❯production wears red. hosts tagged env=production get an unmistakable red banner and border.
- ❯plain-language confirm. the dialog explains what the command actually does, on which host, in which environment.
- ❯your rules, your ruleset. ships with sane defaults; add your own patterns. all matching runs on-device.
everything they gate, we give away.
no account, a real local terminal, and production guardrails come standard. rows are shipping today unless marked roadmap.
| termius | tabby | putty | termikal | |
|---|---|---|---|---|
| account required | yes (even local) | no | no | no |
| local terminal | none | yes | none | default, real os pty |
| server can read your data | yes (trust-based) | n/a | n/a | no server · fully local |
| ai | toolbar, can't disable | none | none | opt-in, fully removable |
| production guardrails | none | none | none | built-in |
| multi-device sync | paywall $9.99/mo | plugin, limited | none | roadmap |
| mobile app | yes | none | none | roadmap |
your passphrase is the key. it never leaves.
hosts, identities, and private keys are sealed in a sqlcipher vault on your disk. the key is derived from a passphrase termikal never receives and never stores.
what the vault holds
hosts, snippets, settings, ssh identities, and private keys, all sealed with your vault key. lock the app and every record goes opaque. the passphrase is not stored and not recoverable by anyone but you.
roadmapzero-knowledge sync
multi-device sync where the server only ever sees ciphertext, plus a self-host option, is designed but not yet shipped. today termikal is fully local, and this page marks everything unshipped as roadmap.
a real local terminal first. a live ssh client second.
every card below works in the current build. no background process when you're not in a session.
local terminal
opens a real os shell by default. tabs that stay alive across switches, 100k-line scrollback, copy and paste, and a theme that follows the app.
live ssh
connect over ssh with host-key trust-on-first-use. keep-alive, optional tmux persistence, and auto-reconnect keep long sessions from dropping.
linux commands on any os
type ll, grep, sed, awk, vim on windows and macos. the native shell stays, the gnu tools are layered onto the path so you're not stuck.
shell picker
powershell, cmd, wsl, git-bash, zsh, bash. termikal detects what's installed and lets you choose per tab.
host imports
one-click import from ~/.ssh/config, putty, and mobaxterm. tag hosts by environment for guardrails to read.
command palette
cmd+k fuzzy-searches every host and action. the whole app is one keystroke away.
keys & vault
generate ed25519 keys and store them vault-encrypted. a private key is never written to disk in plaintext.
guardrails
destructive commands trigger a plain-language confirm on production hosts. runs on-device, with no ai.
built for everyone
10 languages, light and dark themes, signed auto-updates, and opt-in ai with your own key and custom endpoint.
these are on the plan and honestly labelled. they are not in the current build.
sftp
dual-pane transfers, drag-drop, and edit-on-remote.
fleet mode
run one command across many hosts by tag, output in a grid.
auto-inventory
pull hosts from aws, gcp, hetzner, or a tailscale tailnet.
snippets & runbooks
parameterized commands chained into one-button runbooks.
multi-device sync
zero-knowledge sync where the server only sees ciphertext.
mobile app
ios and android, sharing the same encrypted vault.
generous where it's cheap. priced where it's hard.
today termikal is free and fully local. the paid tiers below are the planned model for teams, and are not yet available.
- unlimited hosts
- local terminal + live ssh
- encrypted vault + key management
- production guardrails
- host imports + 10 languages
- everything in free
- unlimited devices
- fleet mode
- cloud auto-inventory
- priority support
- team vault (zero-knowledge)
- ssh certificate ca
- audit & session recording
- sso + scim
- self-host sync server
what happens when things go wrong.
security you can't inspect is just branding. here's exactly what an attacker gets in each scenario, and why it isn't enough.
frequently asked
what is termikal?
termikal is a local-first, zero-knowledge terminal and ssh client for developers and devops. it works fully offline with no account, opens a real local shell by default, connects over ssh, and stores every host and key encrypted on your device with sqlcipher.
is termikal free?
yes. today termikal is free and fully local: unlimited hosts, the local terminal, the ssh client, the encrypted vault, host imports, and production guardrails. paid pro and team tiers with fleet mode, sync, and audit are on the roadmap and clearly marked as not yet shipped.
what does zero-knowledge mean?
the vault key is derived on your device from a passphrase termikal never receives, using argon2id. hosts, identities, and private keys are encrypted with xchacha20-poly1305 and stored inside a sqlcipher database on your disk. the passphrase is never stored and cannot be recovered by anyone but you.
how are guardrails different?
termikal tags each host by environment and checks commands against an on-device ruleset before they run. destructive commands like rm -rf, drop database, or mkfs trigger a plain-language confirm on production hosts. no other mainstream ssh client has this, and nothing is ever sent off-device.
does termikal store my private keys?
never in plaintext. a private key is stored only as a vault-encrypted blob (xchacha20-poly1305) inside the sqlcipher database, and can be decrypted only with your passphrase-derived vault key. it never leaves your device.
stop trusting your terminal with your secrets.
open it and you're in a local shell in seconds. no account, no card, nothing to configure. windows, macos, and linux builds are available now.