Features

Termi Features

A complete look at what Termi can do — organized by category. See the Home page for an overview, or Getting Started to try it yourself.

Termi is built around a zero-trust credential model: secrets are decrypted only in memory, never stored or logged in plaintext.

AES-256-GCM encryption for every stored server credential (host, username, password, private key, passphrase, notes)
TOTP-based two-factor authentication — works with Google Authenticator, Authy, 1Password, or any standard TOTP app
Passkey / WebAuthn login — passwordless sign-in with hardware security keys, Touch ID, Face ID, or Windows Hello
Google OAuth — optional "Sign in with Google"
Optional master key — an additional PBKDF2-derived encryption layer on top of the base encryption
SSRF protection on every user-supplied host
Rate limiting on authentication and credential-reveal endpoints
Full audit log of credential reveals, exports, and account changes

Termi is a genuine multi-protocol remote access client — not just an SSH tool:

SSH — full terminal emulation powered by xterm.js, with resizable viewport, multiple shell tabs per server, and a quick-tools toolbar (root shell, htop, df, free, listening ports, and custom saved command snippets)
SCP / SFTP — a web-based file manager: upload, download, rename, create folders, and delete, without leaving the browser
RDP — Windows Remote Desktop access via Apache Guacamole
VNC — Virtual Network Computing support, also via Apache Guacamole
Local terminal — open a shell on your own machine from inside the app (Electron: PowerShell/bash/zsh; browser: opt-in gateway-hosted shell)

Invite teammates to a specific server without ever sharing the underlying password or key
Per-server, per-user permission and revocation controls
Every share and revoke action is audit-logged

Export your full server inventory to encrypted JSON, plain JSON, Excel (.xlsx), or CSV
Passphrase-based encryption (PBKDF2 + AES-256-GCM) so a backup file is never a plaintext credential dump
Step-up re-authentication (password, 2FA, or passkey) required for every export
Import is additive-only — it never overwrites or deletes existing servers — and every imported host is SSRF-checked before it's saved

Installable on iOS, Android, and desktop — behaves like a native app once installed
Fully touch-optimized interface
On-screen virtual keyboard with Ctrl, Alt, Shift, Fn, and arrow keys for mobile terminal use
Web push notifications for monitoring alerts, even when the app is closed

Built with Electron for macOS, Windows, and Linux, in both x64 and arm64 builds
Local terminal access via node-pty
Remembers window size and position between launches
Native right-click context menu and keyboard shortcuts for shell management
Connects to your own self-hosted Termi instance — see Desktop App for downloads

One-command Docker Compose deployment
PostgreSQL database — every byte of your data stays on infrastructure you control
Zero telemetry, no third-party analytics, no cloud dependency
Built-in Traefik reverse-proxy support for TLS termination

Ready to try it? See Getting Started for the Docker Compose quick start, or Desktop App to install the native client.

Termi — self-hosted SSH, SCP, RDP & VNC from your browser. MIT Licensed · Source · Support