prod-eu-1 ~ $ uptime
14:22 up 41 days, load 0.08 0.11 0.09
prod-eu-1 ~ $ ▌ connected via ProxyJump bastion
A fast, native desktop app for SSH, SFTP and VNC — with an encrypted vault your keys never leave. macOS, Windows and Linux.
Your keys, passwords and hosts live in a local vault, sealed by your OS keychain. No mandatory cloud account, no telemetry — nothing leaves your machine.
Pixel-perfect remote desktops, always tunneled through SSH. No exposed VNC ports, no extra agents — encrypted graphical access by default.
Built-in MCP server lets Claude, Cursor or any agent list hosts and run commands across your fleet — every action approval-gated and logged. Your keys never leave the app.
Most tools make you choose: a fast terminal, or a connection manager, or a remote desktop client. TermDesk is all three, without the cloud strings.
Saved hosts, jump hosts, agent & port forwarding, and a built-in SFTP browser with drag-and-drop transfers. It reads your existing ~/.ssh/config, so you're connected in seconds.
Open a graphical session on any host without leaving TermDesk. VNC is always tunneled over SSH — you never expose a VNC port to the network, and there's nothing extra to install on the server.
Hosts, keys, snippets and known-hosts live in a local SQLite vault. Passwords and passphrases are encrypted with your OS keychain (Electron safeStorage) the instant they arrive — and decrypted only at connection time, inside the sandboxed main process.
TermDesk is a Model Context Protocol server, so Claude, Cursor or any MCP client can list hosts, run commands and fan out across a fleet. Credentials stay in the main process — the agent gets hands, never keys.
Your keys never leave your machine.
Security isn't a tier you upgrade into. TermDesk is local-first by default and encrypted always — and we're honest about exactly what does and doesn't leave your device.
Secrets are encrypted with Electron safeStorage — macOS Keychain, Windows DPAPI, Linux libsecret. The key is held by the OS and never written to disk.
Graphical sessions ride your SSH tunnel through a loopback bridge with single-use 30-second tokens. Port 5900 is never exposed.
The UI has no Node access (contextIsolation + sandbox). All SSH, SFTP, VNC and secrets live in the main process behind a Zod-validated IPC contract.
Your hosts, keys and history never leave your machine. No mandatory cloud, no telemetry — and on Linux, TermDesk refuses an insecure keyring rather than store secrets weakly.
The tools that do all three aren't cross-platform or aren't cheap. The cheap, polished ones drop VNC or lock your vault in the cloud.
| TermDesk | Termius | Royal TSX | Devolutions RDM | |
|---|---|---|---|---|
| SSH & SFTP | ✓ | SFTP paid | ✓ | ✓ |
| VNC / remote desktop | ✓ over SSH | — | ✓ | ✓ |
| Cross-platform (Win / Mac / Linux) | ✓ | ✓ | no Linux | ✓ |
| Local-first vault (no cloud required) | ✓ | cloud | ✓ file | server to share |
| AI agent access (MCP) | ✓ | — | — | — |
Comparison compiled from public product pages, June 2026. Competitor capabilities and prices change — verify against their sites.
TermDesk isn't public yet. Request early access and, once you're approved, we'll email you a secure build to evaluate on your platform — no payment, no commitment.
One app for SSH, SFTP and VNC — with a vault that's yours alone.
Request early access