prod-eu-1 ~ $ uptime
14:22 up 41 days, load 0.08 0.11 0.09
prod-eu-1 ~ $ ▌ connected via ProxyJump bastion
A fast, native, open-source desktop app for SSH, SFTP, VNC and RDP — with an encrypted vault your keys never leave. MIT-licensed and built in the open. macOS, Windows and Linux.
Your keys, passwords and hosts live in a local vault, sealed by your OS keychain. No mandatory cloud account, no telemetry — nothing leaves your machine.
Pixel-perfect remote desktops, always tunneled through SSH. No exposed VNC ports, no extra agents — encrypted graphical access by default.
Built-in MCP server lets Claude, Cursor or any agent list hosts and run commands across your fleet — every action approval-gated and logged. Your keys never leave the app.
Most tools make you choose: a fast terminal, or a connection manager, or a remote desktop client. TermDesk is all three, without the cloud strings.
Saved hosts, jump hosts, agent & port forwarding, and a built-in SFTP browser with drag-and-drop transfers. It reads your existing ~/.ssh/config, so you're connected in seconds.
Open a graphical session on any host without leaving TermDesk. VNC is always tunneled over SSH — port 5900 is never exposed — and Windows hosts connect over RDP with trust-on-first-use certificate pinning. Nothing extra to install on the server.
Hosts, keys, snippets and known-hosts live in a local SQLite vault. Passwords and passphrases are encrypted with your OS keychain (Electron safeStorage) the instant they arrive — and decrypted only at connection time, inside the sandboxed main process.
TermDesk is a Model Context Protocol server, so Claude, Cursor or any MCP client can list hosts, run commands and fan out across a fleet. Credentials stay in the main process — the agent gets hands, never keys.
Your keys never leave your machine.
Security isn't a tier you upgrade into. TermDesk is local-first by default and encrypted always — and because the source is public, you don't have to take our word for any of it. Read the code that touches your keys.
Secrets are encrypted with Electron safeStorage — macOS Keychain, Windows DPAPI, Linux libsecret. The key is held by the OS and never written to disk.
Graphical sessions ride your SSH tunnel through a loopback bridge with single-use 30-second tokens. Port 5900 is never exposed.
The UI has no Node access (contextIsolation + sandbox). All SSH, SFTP, VNC and secrets live in the main process behind a Zod-validated IPC contract.
Your hosts, keys and history never leave your machine. No mandatory cloud, no telemetry — and on Linux, TermDesk refuses an insecure keyring rather than store secrets weakly.
The tools that do all three aren't cross-platform or aren't cheap. The cheap, polished ones drop VNC or lock your vault in the cloud.
| TermDesk | Termius | Royal TSX | Devolutions RDM | |
|---|---|---|---|---|
| SSH & SFTP | ✓ | SFTP paid | ✓ | ✓ |
| VNC / remote desktop | ✓ over SSH | — | ✓ | ✓ |
| Cross-platform (Win / Mac / Linux) | ✓ | ✓ | no Linux | ✓ |
| Local-first vault (no cloud required) | ✓ | cloud | ✓ file | server to share |
| AI agent access (MCP) | ✓ | — | — | — |
| Open source (auditable) | ✓ MIT | closed | closed | closed |
Comparison compiled from public product pages, June 2026. Competitor capabilities and prices change — verify against their sites.
TermDesk is MIT-licensed and developed in public on GitHub. Read every line that touches your keys, build it yourself, file an issue, or send a PR — no account, no telemetry, no black box.
TypeScript + Electron. Follow the README for install & build steps on your platform.
Prebuilt, signed installers are on the way. Until then, TermDesk runs from source — or leave your email and we'll ping you when they land.
One open-source app for SSH, SFTP, VNC and RDP — with a vault that's yours alone. Star it, fork it, hold your own keys.
View on GitHub