Documentation
Vault, sync, and updates
The vault is the copy that matters. Sync is optional. You need a server you can reach over HTTPS. How to run one is Your own server.
What the vault holds
Hosts, groups, identities, keys, known hosts, serial profiles, and the passwords saved on them. Each record is encrypted separately. Names of hosts are encrypted too, not only the secrets. On a Mac the files are vault.db, vault.db-wal, and vault.db-shm in ~/Library/Application Support/app.termiport.desktop/. Copy all three, with TermiPort quit.
The master password opens the vault. It is not sent anywhere. Touch ID on a Mac, and a fingerprint on Android 12 or later, wrap that secret for the one device. They do not sync.
Lock
Lock Vault (⇧⌘L on a Mac) hides the sidebar and the protected tabs. New connections are refused. Sessions that are already connected keep running, including local shells, serial tabs, and SSH, but typing into them is blocked until you unlock. SSH sessions that are still connecting, or waiting for an answer, are closed. Sync stops. The agent stops serving keys, or asks you to unlock, depending on Settings → Agent.
By default the vault also locks after 15 minutes without input, and when the computer locks or sleeps. Terminal output does not count as input. Change both under Settings → Security.
Reset TermiPort… on the lock screen deletes the vault after you type RESET. It closes every open session first. Files in ~/.ssh are not touched. Secure Enclave keys TermiPort created are destroyed. Erase All Data… is different: it deletes the records on this device and, through sync, on the other devices, but it keeps the master password and the sync account.
What sync sends
Records are encrypted on the device with an account key before they leave. That key is random. It is not derived from the master password or the account password. Only the account’s devices hold it. It has a generation: revoking a device moves the account to a new generation, and the remaining devices re-encrypt as they sync.
The server sees ciphertext and metadata: the email address, IP addresses and times, the number of records and their padded sizes, record ids, the number of devices and their platforms, and the number of key generations. It does not see host names, usernames, keys, or device names. Device names live only in the encrypted device list.
Synced: hosts and groups, including forward rules and notes; file keys in full; the public part of a Secure Enclave or Android Keystore key; the handle and public part of a FIDO2 key; known hosts; serial profiles.
Not synced: the master password, vault security settings, theme and font, keyboard shortcuts, agent settings, and the serial log folder. A license is shown in the app but belongs to the account on the server.
If the same record changes on two devices, the newer field wins. A deletion beats an older edit. Sync does not run while the vault is locked.
Create an account
- Open Settings → Sync, or the indicator at the bottom of the sidebar, and choose Set Up Sync…, then Create Account….
- Server address is the host name you were given, such as
sync.example.org. TermiPort addshttps://.http://is accepted only for a loopback address. - Email, and an Invite code if the server registers by invitation.
- Continue. The server emails a code, unless the administrator handed you one. Enter the code and an account password of at least 8 characters, twice. This password only signs in. It does not open the vault.
- TermiPort shows a Recovery Code once. Copy it or use Save as Text File…, tick I saved it, and continue.
The app checks that the server’s public_url is the address you typed. If not, it stops with “The server calls itself …”. The recovery code is the way in when no other device is left. It is shown once. After you use it, the app asks you to replace it. It restores the sync account, not a forgotten master password.
Another device
Set Up Sync…, then the server, email, and password, then Sign In. If a second factor is on, enter the authenticator code or use the account’s FIDO2 key (Use Security Key). A new device can also be approved from one that is already in: both show the same six-digit code, the old device chooses Approve, and the new one chooses Codes Match. The request lasts 10 minutes. An account can have at most 3 pending approvals.
I Have No Other Device… takes the recovery code. Afterwards, revoke devices you no longer have, and replace the recovery code.
The indicator
| Label | Meaning |
|---|---|
| Synced | Up to date. A click syncs now. |
| Syncing | An exchange is in progress. |
| Waiting to Sync | Waiting for approval, or the network is down, or the server is rate-limiting. |
| Sync Needs Attention | An error, a pending request, a read-only device, or a recovery code that should be replaced. |
| Not syncing | Sync is not set up. |
Devices lists name, platform, when it was added, and when it was last seen. This device is marked This device. Rename… renames it for the other devices. Revoke… cuts a device off immediately. It keeps whatever it already had locally. The others re-encrypt onto a new account key.
Sign Out on This Device stops sync here and leaves the records in the vault. Delete Account… removes the sync account after you type its email. Records on the devices remain, and they stop syncing.
License
Until 2028 there is a development and testing period. During this period all licenses are free, for unlimited duration and unlimited number of devices. Licenses are issued on request. Get in touch via yukh.net.
Without a license an account has 3 active devices. Pending and revoked devices do not count. Settings → License → Install License… takes a license file issued for that email. It applies on any TermiPort server, without a restart. The screen shows Free plan., a valid-until date, Valid with no end date., or an expiry with the end of the 14-day grace period. Past the grace period the oldest devices keep full sync and the rest become read-only. They can still download, revoke, sign out, and delete the account. Nothing is deleted. You can install the file before sync is on: it stays on the device and applies when sync starts.
This site does not sell licenses and does not list a price.
Updates
Updates come from the developer, whether or not sync is on. TermiPort checks at launch and from Check for Updates…. Software Update shows what changed. Install and Restart installs it. Later skips that version. Only an update signed by the key built into the app is installed. On Android the same check installs a signed APK through the system installer, for the android-aarch64 target, after you allow installs from TermiPort.
If the server you sync with is restored from an older backup, TermiPort warns that it has older data than this computer and sends the newer local records again. Dismiss the warning. A device that never saw the newer data, such as one just added, receives what the server currently has.