Security

What xtermium keeps, where, and how it keeps it safe. The short version is in Usage › Security and backups.

Your data folder

Everything xtermium keeps lives in one folder, ~/.xtermium (%USERPROFILE%\.xtermium on Windows): settings and sessions, terminal logs, website profiles, the windows' browser data, and what a run needs only while it runs (temp, cleared at the next start). Only the data key stays outside, in the OS keychain; macOS keeps the windows' browser data in its own place.

• Portable: set XTERMIUM_HOME to use another folder, for example next to the portable build on a USB stick.
• From an older version: the first start moves the data from where older ones kept it (%APPDATA%\xtermium\config, ~/.config/xtermium or ~/Library/Application Support/xtermium).

File	What's in it
sessions.xtm	sessions, folders and their tags, logins, tunnels, snippets, saved layouts, workspaces
settings.xtm	everything in the Settings window, including the default SSH password
known.xtm	trusted SSH host keys and RDP server keys
lock.xtm	the lock: its password and PIN as Argon2id hashes, the passkey's public key, when it locks
logins.xtm	the passwords you chose to remember
recovery.key	the data key, sealed under your recovery passphrase
custom.css	your own stylesheet, if you made one (Customization)

Encryption

Every .xtm file is encrypted with XChaCha20-Poly1305 under a random 256-bit data key. The key lives in the OS keychain (Windows Credential Manager, macOS Keychain, Secret Service on Linux), so there's nothing to type day to day.

• Post-quantum safe: only symmetric cryptography is used (XChaCha20-Poly1305, and Argon2id for passphrases). Quantum computers threaten public-key schemes; 256-bit symmetric keys stay secure.
• From plain text: coming from a version that kept plain text, the first start encrypts the old sessions.toml, settings.toml, known_hosts and known_rdp, checks the result and deletes the plain-text files.

Recovery passphrase

Set one in Settings › Security. On a new computer, after a reinstall, or if the keychain entry is lost, xtermium asks for it and opens everything. Without it, a lost keychain entry means your files can't be read. Changing it takes the current one. Sync needs it first: a new computer opens your data with it, and devices never send each other keys.

The lock

For stepping away from the computer, Settings › Security sets ways to unlock: a password, a PIN, a passkey (a security key or the computer's own) and Windows Hello (face, fingerprint or Windows' PIN).

• Locked, every window shows only the lock screen while your sessions keep running.
• Agents and scripts wait: the MCP server and the xtermium command line refuse every tool until you unlock (AI agents), and nobody in a Terminal Co-op ring can type into, copy from or paste into your shared tabs.
• When: when xtermium starts, with Ctrl+Shift+K (⇧⌘K) or the lock beside Settings, and after the minutes you pick without input.
• Changing the lock takes an unlock first, and wrong passwords and PINs make the next try wait.

Server keys

SSH host keys and RDP server keys are confirmed the first time you connect (trust on first use). A changed key refuses the connection instead of asking. Settings › Security lists the trusted keys: remove one after a server's key changed on purpose.

Passwords

• Remembered passwords: "Remember" at a prompt keeps a session's password in logins.xtm, on this computer only unless you tick "Saved logins and passwords" in Settings › Account and sync. Settings › Saved logins lists, changes and forgets them.
• Shared logins are stored encrypted with the sessions, and no export carries them except the passphrase-protected .xtermium file.
• Agents and scripts never see a password.

SSH keys

Settings › SSH keys lists the key pairs in ~/.ssh, with their public keys to copy, and makes new ones: Ed25519 by default, ECDSA P-256 or RSA 4096, with a passphrase if you like.

Restore points and backups

Settings › Import and export keeps full copies of everything (sessions, logins, tunnels, snippets, settings, trusted keys) on this computer: one a day, one before each restore, and any you take ("Take a restore point"). The newest 10 stay. Restoring one can also replace the cloud copy.

Back up everything…, on the same page, writes one .xtermium file with all of xtermium's configuration (sessions, folders, shared logins with their passwords, tunnels, snippets, settings and trusted server keys), encrypted with a passphrase of at least 8 characters. Restore everything replaces everything here with such a backup. A restore keeps this device's account sign-in and automation token.

Tunnels on your network

New tunnels listen on 127.0.0.1. Imported ones keep the bind address from the imported file, which is often 0.0.0.0, reachable from your network: check them.