Changelog

A big one: Termalin now has a built-in database client.

Data — a database client for 13 engines

• New "Data" host type. Browse and query PostgreSQL, MySQL/MariaDB, SQLite, MongoDB, Redis, ClickHouse, Elasticsearch, Cassandra/ScyllaDB, Neo4j, InfluxDB, RabbitMQ, SQL Server and Cloudflare D1 — a schema tree of every database, table and column (with row counts, indexes, foreign keys and access), a SQL editor with Ctrl+Enter, and a results grid with CSV/JSON export.
• Edit right in the grid. Open a table and click a cell to change it, right-click a row to delete it, add rows from a form, add columns, create tables (with a column builder and a per-engine type picker) and databases. Tables without a primary key are editable too. Every generated statement is shown for review before it runs — nothing executes unseen.
• Document and broker stores included. MongoDB and Elasticsearch documents are edited by their id, with an "Add document" JSON form; RabbitMQ queues can be published to, purged and created; Redis keys are listed with type, TTL and a value preview — edit, expire or delete them in place.
• Behind a firewall — no exposed port. Reach a private database through a saved SSH host, and in the web cabinet through a Connector.
• Everything on the record. Each statement lands in the per-host command history (encrypted like your terminal commands) and the activity log — for you and for agents alike.

Agents

• Agents can query your databases — on your terms. The local MCP server adds data tools (list databases, tables, schema, run a query): off by default, read-only unless a connection grants full access, and every agent query is recorded and audited.
• Chat agents too, passwordless. claude.ai and ChatGPT connected over Termalin's hosted MCP can query databases on your servers using the database's own local trust over the keyless tunnel — no database password is sent or stored anywhere. Read-only by default.

Fixes

• Windows: the app no longer freezes after the machine wakes from sleep.
• Connectors no longer flap to "offline" while their tunnel is up; file transfers over a Connector handle files up to 100 MB; fixed an SFTP-over-Connector address that broke downloads.
• Unlinked Connectors now appear as one-click hosts in the sidebar.
• Changing a table's schema no longer breaks the next query on Postgres and MySQL ("cached plan must not change result type").

iOS

• Fixed: the app could not sign in on iPhone. The core library shipped in the previous build was out of step with the app, so signing in failed with "core library didn't load". Local hosts, keys and the terminal were affected too. Rebuilt and verified.

Command suggestions in every terminal, two-factor auth and passkeys, and a big terminal polish for Claude Code and friends.

Terminal

• Inline command suggestions: start typing and the rest of the command appears as ghost text — drawn from your history on that host, the server's own shell history (fetched at connect), your snippets and a built-in dictionary. Right arrow accepts, Alt+Up/Down pick between matches, Esc hides; several matches open a picker panel with a full-command preview and a bookmark that saves any suggestion as a snippet. Works in the desktop app and the browser cabinet alike. Settings has an on/off switch.
• Copy, paste and rendering fixed for Claude Code and other full-screen CLIs: large pastes arrive whole (bracketed, in order), Ctrl+C copies a selection without breaking interrupt, files can be dragged into the terminal to type their path, and the underline/color glitches some TUIs triggered are gone. The Claude Code mascot renders pixel-perfect with the bundled Cascadia Mono font.
• Selection survives scrolling: select with the mouse, roll the wheel — the selection grows with you instead of sliding away.
• The local terminal reopens in your last directory, and reconnecting a tab resumes exactly where that tab was.
• Command history no longer picks up interface text from full-screen apps; existing noise is cleaned up automatically.

Account security

• Two-factor authentication (TOTP): enable it in the web cabinet, sign in with your authenticator code (backup codes included). The desktop app prompts for the code too.
• Passkeys: sign in to termal.in with your device's screen lock instead of the password.
• "Sign in with browser" in the desktop app: approve the sign-in in your already-authenticated cabinet — the password never touches the app.
• Removing a device in the Devices view now actually signs that device out.

Fixes

• SSH-agent auth works again when the agent also holds a certificate (Fedora setups) — one unreadable entry no longer hides all your keys.
• SSH key generation produces real keys (a placeholder slipped into a previous build), and imported keys extract their public half correctly.
• Jump hosts (ProxyJump) for reaching servers through a bastion.
• The web cabinet's reverse-tunnel component is now called the Termalin Connector.

Connector alerts on iPhone, a smarter Dynamic Island card, and the subscription sheet in all nine languages.

iOS

• Server alerts: turn on the new switch in Settings → Security and your phone gets a notification when one of your Connectors goes offline — and another when it comes back. Short blips (a reboot, a network hiccup) stay quiet.
• The Dynamic Island card stays current in the background: when a connector drops or returns, the card updates on its own — no need to open the app.
• The subscription sheet speaks your language: every line of the App Store paywall is now translated, and "Plan & billing" explains itself properly on iPhone and Mac.
• "Restore purchases" now says so when there is nothing to restore, instead of spinning silently.
• Signing out no longer hangs when the server is unreachable.

Encrypted local storage on every desktop OS, auto-reconnect for password hosts, and the whole interface now follows your language setting.

Security

• Local data is now encrypted at rest on macOS and Linux too: saved hosts, keys and snippets are protected with a key held in the system keychain (macOS Keychain, GNOME Keyring / KWallet). Existing data is migrated automatically on first launch. Windows already worked this way and is unchanged.
• "Remember master password" now works on macOS and Linux — the password is kept in the system keychain.

Desktop

• macOS updates install themselves: the app now swaps in the new version and relaunches — no more dragging it into Applications by hand. (Takes effect for updates installed *from* this version onward.)
• Password hosts auto-reconnect: when a connection drops (network change, laptop sleep), sessions using password auth now reconnect automatically like key-based ones — no more dead "connection lost" tabs.
• Faster parallel connections: opening one SSH session no longer stalls the input and output of the others while it handshakes.
• Sessions whose connection silently died are now detected and cleaned up automatically.
• The SSH-agent key counter in the sidebar is one compact line ("32 / 36 unlocked") with an "Unlock N" button, instead of wrapping across several lines.

Languages

• The rest of the interface is translated: host screens, the file manager, the S3 browser, key/snippet/tunnel dialogs, status-bar tooltips and the account activity log now follow the language setting in all 9 languages. Previously parts of the app stayed in English.

More terminal themes with a live preview, plus a round of security hardening.

Desktop

• 20 more terminal themes (36 total): Matrix, Synthwave 84, Tokyo Night, Catppuccin, Rose Pine, Kanagawa, Night Owl, Ayu, Everforest, Homebrew, Cobalt2, Snazzy and more, with new light themes too. Set a default in Settings, or pick one per host or per folder.
• Theme preview: the picker now shows a small terminal preview of each theme, so you can see what a session will look like before choosing it.

Security

• Host backups (JSON export) no longer include saved passwords - only connection details.
• The server's identity is verified before the S3 and FTP/SFTP gateways send your stored keys or password.
• Hardened against a hostile server: capped SFTP file reads, the Telnet negotiation buffer and the terminal output buffer so they cannot exhaust memory.
• Imported host files no longer carry a local shell command, and connection details are kept out of release logs.

The macOS app is now signed and notarized by Apple.

macOS

• Signed and notarized: the macOS app is now signed with a Developer ID certificate and notarized by Apple, so it opens without the "unidentified developer" warning. The app's bundle id changed to in.termal.desktop; after updating you may be asked for your master password again on first launch (your synced data is untouched).

Termalin now speaks your language.

Everywhere

• 8 new languages: the desktop app and the web cabinet are now fully translated - Russian, Spanish, German, French, Portuguese, Chinese, Japanese and Korean, on top of English. Pick your language in Settings; the web cabinet has its own switcher too.
• Covers every screen (hosts, terminal, files, keys, snippets, recordings, tunnels, settings and the account/billing pages), including menus, tooltips, dialogs and the explanatory text.

Jump hosts, a local files browser, folders that nest, and a safer AI channel.

Desktop

• Jump hosts (ProxyJump): reach a server through a bastion — pick a Jump host in the host form and Termalin connects through it.
• Local files browser: open a files panel beside a local terminal — the same browser and built-in editor as SFTP, on your own disk (new file, rename, delete, edit).
• Folders that nest: rename and delete folders, drag one folder into another, and create subfolders (up to 4 levels). Deleting a folder lifts its hosts and subfolders to the top level.
• Remember on this device: a checkbox on the unlock screen so you’re not asked for the master password every launch.
• Report an AI response: flag inappropriate AI-generated content from Settings or the Agent Access screen.

Under the hood

• The bundled AI helper (MCP) now honours each host’s agent policy for file transfers and port forwards too, not just commands.

Bundled assistant helper and a smoother silent install.

Desktop

• Connect an assistant in one step: the local helper that lets Claude and other AI assistants reach your servers now ships inside the app and updates with it. Settings → Agent Access has a new "Connect an assistant" button with a ready-to-paste command and config.
• Cleaner unattended install: installing silently (for example via winget or scripts) no longer launches the app afterward. In-app auto-update still relaunches as before.

A password generator, a friendlier recovery code, and wider Linux support.

Desktop

• Password generator: a key button in the terminal toolbar makes a strong random password — pick the length and character types, it copies as you generate, and Insert types it straight into the terminal (handy when you're creating a user on a server).
• Recovery code as a phrase: recovery codes are now a phrase of words — easier to write down and read back. Existing codes keep working.
• Keys come back after auto-lock: unlocking after an inactivity lock now restores your keyless SSH keys too, not just the ones with a cached passphrase.
• Fixes and polish.

Linux

• The AppImage now starts on more distributions (Fedora among them) — it bundles the image and compression libraries they name differently.

Cabinet

• A password generator in the workspace toolbar, and recover with a code if you forget your master password.

Recovery codes for your master password, and a Linux startup fix.

Desktop

• Recovery code: when you set a master password you now get a recovery code, shown once. If you ever forget your password, the code gets you back in and you choose a new one — from the unlock screen or the lock screen. Keep it somewhere safe: it can't be reset for you. Making a new code or turning recovery off asks for your master password first, and we email you whenever a recovery code changes.
• Type into the watch grid: in the multi-session watch grid, the selected session now takes your keystrokes, like the web.
• Steadier sign-in: repeated wrong master passwords are slowed down to discourage guessing, and the app verifies the server before signing in.
• Fixes and polish.

Linux

• The AppImage now bundles the image libraries it needs, so it starts on Fedora and other distributions that name those libraries differently.

Find in the terminal, and finer control over what your AI agents can do.

Desktop

• Find in the terminal (Ctrl+F): search the whole scrollback, jump between matches with Enter or the arrows — it scrolls the match into view and highlights it — and press Esc to close. Works in SSH and local terminals.
• Per-host agent access: each host now has an access level for AI agents — full, an allowlist of commands, or blocked — set on the host. A blocked host refuses; an allowlist host only runs commands you've listed.
• Fixes and polish.

Cabinet

• Per-key command policy: an API key for the hosted MCP endpoint can now be full access, an allowlist of commands, or read-only — on top of the servers it's scoped to.

Copy on select, a smarter Ctrl+C, and sessions that come back on their own.

Desktop

• Copy on select: selecting text in a terminal copies it to the clipboard straight away — SSH and local terminals alike. Right-click still has the Copy / Paste / Clear menu.
• Smart Ctrl+C: when text is selected, Ctrl+C copies it; with nothing selected it sends the interrupt to the program as before.
• Reconnect on start: with Restore tabs turned on, your sessions now reconnect on their own wherever it can be done without asking — an SSH key, a cached passphrase, an unlocked agent key or a saved password, plus telnet, serial and local shells. Anything that still needs a password waits for a click, so startup never fills up with dialogs.
• Local terminal as a host: save a local shell like any other host (pick "Local") so it lives in your list and restores with everything else.
• Stronger master password: the master password now uses a stronger key derivation. Your existing data keeps working and moves up to it on its own — nothing to re-enter.
• Fixes and polish.

A local terminal, folder themes, and fixes.

Desktop

• Local terminal: open a shell on your own machine as a terminal tab. Add it like any host (pick "Local"), set a shell and working directory — or just type a command like `claude`, `gemini` or `codex` and it runs in a shell on open, dropping you back at a prompt when it exits. Works on Windows, macOS and Linux.
• Folder terminal themes: right-click a folder to set a default colour scheme for the hosts inside it. A terminal now picks its theme per-host, then per-folder, then your app-wide default.
• Watch grid themes: the watch grid now shows each session in its host's terminal theme.
• S3 file transfers: copying files to and from an S3 bucket in the two-pane file manager now works.

Terminal themes, tab reordering, and S3 in the file manager.

Desktop

• Terminal themes: pick a colour scheme per host, or set a default for all of them in Settings → Terminal. Ships Termalin's own palette (the default) plus Dracula, Nord, Gruvbox, Monokai, One Dark, Material and Solarized (dark & light). Your choice syncs with the host across devices.
• Reorder terminal tabs: drag a tab left or right to arrange your open sessions.
• S3 in the file manager: opening an S3 bucket now shows the two-pane file manager, like SFTP and FTP — copy objects between the bucket and your computer, or between the bucket and any SFTP/FTP host, in either direction. S3 is also a choice for the left pane.

Keyboard shortcuts and window memory.

Desktop

• Cmd+W / Cmd+Q: close the active tab and quit the app — even with live sessions open.
• Window memory: the app reopens at its last size and position.
• Web cabinet: repeated wrong master-password attempts now throttle, like the app.

Reset a forgotten password, cleaner settings, and terminal fixes.

Desktop

• Forgot your account password? The sign-in screen now has a reset link (email a code, set a new password) — you no longer need to be signed in to reach it.
• Settings open the right section: the Appearance/Terminal/Security/Sync sidebar entries jump to their section instead of the top.
• No more garbled scrollback: running a full-screen app (htop, vim…) no longer leaves garbled leftovers in restored/reopened tabs.
• Master-password guessing is throttled: repeated wrong attempts on the unlock screen now lock out for a growing delay.

macOS: SSH keys, tunnels and Touch ID.

macOS

• SSH keys & tunnels now work: the app is no longer sandboxed, so it can read your `~/.ssh` keys and open local port-forwards — these previously failed with "no accepted identity" and tunnel "permission denied".
• Touch ID: unlock with Touch ID now works and is labelled correctly (it said "Windows Hello" before).

Unlock your synced hosts on a new device.

Desktop

• Master password on a new device: signing in on a new machine (or after a reinstall) now prompts for your master password to unlock your synced hosts and keys, instead of opening with nothing visible.

Fixes sign-in on macOS and Linux.

Desktop

• Fixed sign-in on macOS & Linux: the app now loads its core library from the right place inside the app bundle. Some installs couldn't load it and got stuck at the sign-in screen — that's fixed.

A clearer message if the app can't start its core.

Desktop

• Clearer startup error: if Termalin's core library doesn't load, the app now explains it's a local install problem and to reinstall — instead of a confusing "server identity" error. Your account and the web cabinet are unaffected.

Your account, kept separate and secure — plus a Linux launch fix.

Desktop

• Sign in to Termalin: the app now uses your free Termalin account. It keeps working offline for up to 14 days between check-ins, so you're not blocked without a connection.
• Each account stays separate: signing into a different account on the same computer keeps every account's hosts and keys apart — no more mixing them up.
• Master password on sign-out: signing out now locks the vault, so signing back in asks for your master password again.

Linux

• Fixed launching on a clean system: the Linux app no longer fails to start when mpv isn't installed — the media library needed for file previews now ships inside the AppImage.

Cleaner links, a fixed About box, and a shortcut to manage your plan.

Desktop

• Fixed broken links: Security, Privacy, Terms and Help now open the right pages, and the old source-code links are gone.
• About box: shows the real app version and a tidy summary instead of a raw license dump.
• Plan & billing: a new entry in Settings opens your subscription in the browser.

Web cabinet

• Choose a plan and pay by card or crypto right in the cabinet.
• Sign up and set your master password in the browser.
• Confirm your email from the link in the verification email — no need to open the app.

Typing in the terminal is fixed, and SSH tunnels arrive.

Desktop

• Fixed typing in the terminal: on some setups typed characters stopped reaching the shell (Enter and the Ctrl keys still worked). Typing works again.
• Port forwarding (tunnels): open a forward in plain words, no `-L/-R/-D` to remember — reach a service that lives behind a server on your own computer, expose a local service on the server, or route your traffic through the server (a SOCKS proxy). Find them under the new Tunnels section, or from a host's menu; tunnels are saved and sync across devices.

Desktop & web

• Command history syncs: the commands you run, by host, now follow you between devices and show in the browser cabinet (Pro and Team). Encrypted with your master password.

Your desktop activity now reaches your account log too.

Desktop & web

• Every connection is logged: opening a host from the app — a terminal, the file browser, a serial port, or an S3 bucket — now shows up in your account activity, alongside where you were signed in and from which device. The host name is encrypted with your master password before it leaves the device, so only you can read which server it was; without your password the log shows only that a connection happened.
• Adding or removing an SSH key is recorded the same way, with the key's name kept encrypted.

Recycle bin, an activity log, and steadier sync.

Desktop & web

• Recently deleted: deleting a host now moves it to a recycle bin — restore it for up to 30 days, on desktop and in the browser.
• Activity & devices: see where your account is signed in and what each device did — sign-ins, connections and changes, with location.

Sync

• Deleting a host on one device no longer risks it coming back, and the app no longer overwrites the cloud between edits.

Downloads

• The installer keeps one stable name (Termalin-Setup.exe) with the version shown inside.

Fixes sign-in on installed builds.

Desktop

• Fixed the core module failing to load in installed builds, which blocked sign-in and left your synced hosts, keys and recordings locked. Signing in works again and your data comes back.

More sign-in diagnostics.

Desktop

• Records why the core module failed to load, when it does, to finish diagnosing a sign-in issue.

Diagnostics for a sign-in edge case.

Desktop

• When server verification fails at sign-in, the app now records exactly what it saw, so a network-specific failure can be pinned down and fixed.

Safer sign-in on a shaky connection, and cleaner CSV imports.

Desktop

• On a new device with a flaky connection, sign-in now waits until it can confirm your account's encryption settings before finishing, instead of risking the wrong key — and it re-checks them on every unlock.
• Importing a CSV that Termalin exported keeps each host's protocol and auth method; PuTTY `.reg` files with odd values import without failing.

Update prompts that always reach you, and safer API keys.

Desktop

• The “update available” prompt now shows on any screen — including before you sign in — so a fix is never hidden behind a screen you can't get past.

Web

• Creating an API key now lets you scope it to specific tunnelled servers and set an expiry (30/90/365 days or never); a key past its date stops working on its own.

Move your hosts in and out, and steadier sign-in.

Desktop

• Export your hosts to a Termalin backup, a portable SSH config, or a CSV — from the Hosts screen. Connection details only; passwords stay in the vault.
• Import saved PuTTY sessions on Windows, straight from your saved sessions or a `.reg` export.
• Import also reads a Termalin backup file, so hosts round-trip between devices.
• Sign-in no longer fails when the device clock has drifted — a valid server signature is enough.

Web

• The browser cabinet gains the same Export, plus PuTTY `.reg` import.

Reliable sign-in on a new device, and the Windows app icon is back.

Desktop

• Fixed signing in on a fresh install: the app now fetches your account's encryption settings from the server, so entering your master password on a new device unlocks your existing hosts, keys and recordings instead of starting empty.
• When you sign in on a new device, the master-password prompt now asks for your existing password (not a new one), so returning users know exactly what to type.
• Restored the Termalin app icon on Windows installs.

Settings polish, HTTPS-only sync, and a browser demo.

Desktop

• Adjustable terminal font size, applied live from Settings.
• Tidied the settings screen so every control does something, and Clear All Data now really resets the app.
• Cloud sync refuses plain HTTP — it always talks to the server over HTTPS.

Web

• A live demo of the browser cabinet at termal.in/account?demo — click around with sample data, no sign-up needed.

Cross-platform builds, more protocols, and a browser cabinet.

Cross-platform

• Native builds for Windows, macOS and Linux, from termal.in/download.
• Signed auto-updates on every platform — the app checks in and updates itself.

Files & protocols

• SFTP, FTP, Telnet, Serial and S3 as first-class hosts, on desktop and in the browser.
• A dual-pane file manager to move files straight between two servers, no local staging.

Browser cabinet

• The full client at termal.in/account — terminal, file browsers, snippets and recordings from any device, keyless to private hosts through the tunnel agent.

Under the hood

• Security response headers, per-endpoint rate limits, and other hardening.

The first public beta — a fast, agent-native SSH client.

Terminal

• Tabbed xterm terminal with a hosts sidebar, snippets, folders and session restore.
• Live status bar — CPU, RAM, disk, network and more, streamed from each host.
• Watch grid — mirror every open session at once, side by side.

Files

• SFTP browser with a built-in editor (syntax highlighting, find & replace).
• Viewers for images, PDF, SVG, Markdown, CSV and archives, and streaming for large media.

Agents

• MCP server — agents open their own SSH sessions or step into yours, with keys that never touch disk.
• Every agent command is marked in the session recording.

Recording & sync

• Session recording & replay with a scrubbable, marked timeline.
• End-to-end encrypted cloud sync and cloud recordings (Pro).
• A web cabinet to replay recordings in the browser, decrypted client-side.

Security

• SSH key agent, master password with auto-lock, lock-on-minimize and Windows Hello.
• Signed auto-updates — releases are verified against an offline key before installing.
• The app verifies the server's identity before sending account credentials.