Termnox user guide

Getting started

What Termnox is and what happens on the first launch.

Termnox is a local-first desktop terminal and SSH client. There is no account and no Termnox cloud: everything you save—hosts, credentials, snippets, notes, history, and settings—lives in a single encrypted KDBX vault file that you own.

First launch

1. Start Termnox. The welcome screen offers Open a vault and Create a new vault.
2. Choose Create a new vault, pick where the file should live, and set a strong master password. A key file is optional.
3. The vault unlocks and you land on the hosts home. Press ⌘ T for a local terminal or add your first host.

Vaults you have opened before appear under Recent vaults, so unlocking next time is a single click plus your password.

The vault

How your data is stored, locked, and synchronized.

The vault is a standard KDBX4 file protected with Argon2 and your master password (optionally combined with a key file). Because it is KeePass-compatible, you can also open it in KeePassXC or other KeePass apps; Termnox keeps its data in a Termnox group.

Locking

• Lock manually with ⌘ ⇧ L or by clicking the lock indicator in the status bar.
• Auto-lock after a period of inactivity (15 minutes by default, configurable under Settings → Security; 0 turns it off).
• Lock when the computer wakes from sleep (on by default).
• Pending changes are written to disk before locking, closing the window, or quitting.

Syncing between computers

Termnox has no sync service of its own. Put the vault file in a folder that you already sync—iCloud Drive, OneDrive, Dropbox, Nextcloud, a NAS, or a USB drive. Termnox notices when the file changes on disk and reloads it before writing, so edits from another device or from KeePassXC are never overwritten.

If your sync service creates a conflict copy, Termnox shows a banner. Choose Merge into vault to combine both versions (you may be asked for the copy’s master password), or Ignore.

Hosts and connections

Add servers, choose authentication, and import existing configuration.

Open the Hosts panel in the left activity bar and click New host. Every host has a label, protocol, address, user, and port, plus an optional group and color label used to organize the list and the hosts home (⌘ ⇧ H).

Protocols

• SSH — the default, with all features below.
• Mosh — roaming, latency-tolerant sessions over SSH. Requires mosh-client to be installed.
• Telnet — for legacy devices.
• Serial port — pick the device and baud rate for console cables.

Authentication

• Agent — use keys loaded in your SSH agent (including Windows agents).
• Password — stored encrypted in the vault.
• Private key (stored in vault) — paste a key or generate a new one.
• Key file (path on disk) — for example ~/.ssh/id_ed25519, with an optional passphrase.

Generating and installing a key

1. In the host dialog choose Private key (stored in vault).
2. Generate an Ed25519 (recommended), ECDSA P-256, or RSA 4096 key.
3. Use the install action to add the public key to the server’s authorized_keys. From then on the host signs in without a password.

Importing ~/.ssh/config

Click Import from ~/.ssh/config in the Hosts panel (or choose another file). Termnox lists every host with its user, port, key file, and ProxyJump; hosts you have already saved are marked, and you pick which ones to import.

Host-key verification

On the first connection Termnox shows the server’s fingerprint and asks you to trust it. Only the exact fingerprint you accepted is trusted afterwards; if it ever changes, the connection is blocked and you are warned.

Under Advanced you can also set a per-host terminal theme and a MAC address for Wake-on-LAN.

Terminal, tabs, and panes

Work with several sessions at once.

• ⌘ T opens a local terminal; clicking a host opens it in a new tab. ⌘ W closes the tab.
• ⌘ D splits the pane to the right, ⌘ ⇧ D splits it down. Splitting never restarts a session.
• Any pane can be detached into its own tab.
• ⌘ ⌥ I toggles broadcast input: what you type goes to every pane of the tab.
• ⌘ F searches the terminal output; ⌘ click opens links.
• Autocomplete suggests commands from your history and snippets as you type—accept with Tab or →.

Status bar and server status

The status bar shows the active host, latency, and how long the session has been running. For SSH hosts, open Server status to see live CPU, memory, and disk usage of the remote machine.

Dropped SSH, Telnet, and serial sessions reconnect automatically. Turn this off under Settings → Connections & privacy.

SFTP files

Browse, transfer, and edit remote files.

Open the SFTP Files panel and pick a host, or use the SFTP button on a host card. The file browser opens as a tab with your local files on one side and the server on the other.

• Upload and download files; transfers are streamed with progress and can be cancelled.
• Before overwriting an existing file, Termnox asks first.
• Create folders, rename, delete, refresh, and move up one level.
• Quick edit opens a text file in place; save it back to the server with ⌘ S.

Port forwarding and jump hosts

Tunnels and bastion hosts.

In the host dialog, add forwards under Port forwarding. Three kinds are available:

• Local — a port on your computer (for example 127.0.0.1:8080) reaches a destination as seen from the server.
• Remote — a port on the server reaches a destination on your side.
• SOCKS — a dynamic proxy (default port 1080) for browsers and other apps.

Once connected, the forwards bar above the terminal shows every tunnel. Click one to start or stop it; a green dot means it is running, red means it failed (hover for the error).

Jump hosts

Pick a saved SSH host as the jump host to reach machines that are only accessible through a bastion. Jump hosts can be chained, and the network tools can also run through them.

Snippets and variables

Reusable commands with placeholders.

Snippets are saved commands stored in your vault. A snippet can contain several steps that run one after another in the focused terminal. Edit them in the Snippets panel and save with ⌘ S.

Variables

• {{name}} — Termnox asks for a value before running.
• {{name:default}} — the prompt is pre-filled with a default.
• Built-ins are filled automatically from the focused terminal: {{host}}, {{user}}, {{port}}, {{label}}, {{date}}, {{time}}.

ssh-keygen -R {{host}}
tar czf /backup/{{label}}-{{date}}.tgz {{path:/etc}}

History and recordings

Find past commands and replay sessions.

Command history

Commands you type are saved to an encrypted history inside the vault. In the Command history panel you can search by command or host, show only the current host, copy a command, insert it into the terminal, or run it right away (double-click). You can delete single entries or clear everything, and switch history off under Settings.

Session recordings

• Hover a terminal and press Rec to record that session, or enable record every session in Settings.
• Open a recording from the Recordings panel to replay it with its original timing; seek and change speed in the player.
• Export a recording to share it. Files use the open asciicast format.

Notes and layouts

Keep context and restore workspaces.

Notes are secure, searchable notes stored in the vault and grouped like your hosts—useful for runbooks, IP plans, or recovery steps.

Layouts save your current workspace—all open tabs and their split panes—under a name. Open a layout later to bring the whole arrangement back in one click.

Network tools

Diagnostics built into the app.

Open the Network tools panel. Most tools can run from your computer or from inside a saved host’s network over SSH, so you see what the server sees.

• Network scanner — finds devices on a private network without root (TCP probes and the ARP table), shows open ports, MAC vendor, hostname, and SSH banner, draws a network map, and turns results into hosts.
• Ping & traceroute — live latency graph, packet loss, and every hop.
• Port checker — is a port open, from here or from a host.
• DNS lookup — any record type from any resolver, side by side.
• TLS certificate — chain, expiry, names, and trust.
• Wake-on-LAN — send a magic packet; hosts with a MAC address get a wake button.
• IP calculator — IPv4/IPv6 subnets, masks, ranges, and splitting networks.

Opening device web UIs

Routers, NAS boxes, and printers often have an admin page that is only reachable inside their network. From a host card or a scan result, choose Open web UI: Termnox opens it in an in-app browser through an SSH tunnel.

Appearance and settings

Themes, fonts, and behavior.

Open Settings with ⌘ , or the gear icon. Changes are saved automatically and stored in the vault, so they travel with it to other computers.

• Appearance — app theme (Dark, Midnight, Nord, Dracula, Light, Solarized, or System), terminal font, and font size.
• Terminal — 31 built-in terminal themes, cursor style and blink, scrollback, and command suggestions.
• Behavior — copy on select and confirmation before closing tabs.
• Connections & privacy — auto-reconnect, command history, and recording every session.
• Security — auto-lock delay and lock on sleep.

Import your own terminal theme from an iTerm2 .itermcolors file, a Windows Terminal scheme JSON, or a Termnox export. A host can override the global theme—handy for making production look different.

Keyboard shortcuts

The complete list. Use Ctrl instead of ⌘ on Windows and Linux.

The command palette (⌘ K) also lists hosts, snippets, tools, and every action, so you rarely need the mouse.

Security model

What protects your data.

• Passwords and private keys stay in the Rust core. The interface only receives hosts with secrets redacted.
• Strict host-key checking: only the exact fingerprint you accepted is trusted.
• A strict content security policy for the app window.
• No telemetry, no analytics, and no account. Termnox does not talk to any server of its own.
• Writes are atomic; if a save fails, the change is rolled back or marked Not saved.