Docs & Help

Install & first run

Grab the installer for your OS from the download page — Windows .exe, macOS .dmg or Linux .AppImage. The Windows build installs per-user (no admin prompt) into your local app folder, the same way Chrome or VS Code does, so auto-updates stay silent.

Your first connection

1. Click Add host and fill in the address, port and username.
2. Pick an auth method: password, a private key, or the built-in key agent.
3. Save, then click the host to open a terminal tab. On first connect Termalin pins the server's host key (TOFU) so future connections detect tampering.

Every open host is a browser-style tab; sessions stay alive when you switch between them, and are restored after a restart.

Hosts & folders

A host can be SSH, SFTP, FTP, Telnet, Serial/COM, a database or S3 — pick the type on the host form and it opens in the same tabbed workspace. Organise hosts into folders (drag & drop), give them tags and colours, and reach them from the sidebar inside any terminal. Reusable commands live in Snippets; run one into the focused session with a click.

Import & export. From the toolbar above the hosts list, bring hosts in from an ~/.ssh/config, a CSV, or PuTTY — read saved PuTTY sessions on Windows in one click, or paste a .reg export. Export any time to a Termalin backup (JSON), an SSH config or a CSV. No lock-in, either direction.

SSH keys & the key agent

Generate Ed25519 or RSA keys, or import existing ones (passphrase-protected keys are supported). View the public key and fingerprint any time from the Keys screen.

Termalin ships its own SSH key agent. Unlock a key once and it authenticates your sessions — and your agents — without re-typing the passphrase. Keys are never written back to disk in plaintext, and a per-key timeout re-locks them after a while.

Master password & locks

Set a master password to encrypt your vault. It's verified with PBKDF2 and used to derive the key that seals everything before sync. It can't be reset by design — if you lose it, the encrypted data is gone, so keep it safe.

• Auto-lock — lock after a period of inactivity (Settings → Security).
• Lock on minimize — lock whenever the window is hidden.
• Windows Hello — unlock the lock overlay with biometrics.
• Remember password — optional, off by default, stored with Windows DPAPI and bound to your OS user.

Locking shows an overlay over the running app — your sessions stay connected underneath, so unlocking picks up exactly where you left off.

Sync & your account

Create an account to sync across devices. Your hosts, keys, snippets and recordings are encrypted on the device with your master-password key before upload — the server only ever stores encrypted blobs. See how security works for the full model.

Manage devices, verify your email, change your account password or delete your account from Settings → Account. There's also a full browser cabinet — a real terminal on your hosts plus SFTP, FTP and S3 file browsers, snippets and recording replay, all from any device and adapting to a phone. Recordings are decrypted client-side, so the server never sees plaintext.

Recording & replay

Termalin can record sessions (asciicast format) and replay them with a scrubbable timeline. Recordings capture terminal output and event markers — never raw keystrokes — so a password typed at a hidden prompt (sudo and the like) is never echoed and never lands in a recording. Anything the terminal prints is part of the tape, so output that displays a secret still shows up.

• Toggle recording globally, or per host (Settings → Terminal, or the host form).
• The timeline is marked: green for agent commands, amber for your commands and system events. Click a marker to jump.
• Set a retention window so old recordings prune automatically.

Watch grid

Toggle the grid icon in the tab bar to mirror every open session at once, side by side, as live read-only tiles. Sessions an agent is driving are highlighted. Type into the "send to all sessions" bar to run a command across every connected host at once.

SFTP & the editor

Open the SFTP browser from any connected session to move files around. It's an all-in-one viewer:

• Built-in editor with syntax highlighting, line numbers and find & replace.
• Viewers for images, video & audio, PDF, SVG, Markdown (rendered), CSV (as a table) and archives (browse and extract).
• Large media streams over a range request instead of loading into memory.

Agents & MCP

This is what makes Termalin different: agents reach your hosts through a real MCP server, using your key agent — so agents never touch your keys — while you watch and review every move. There are two ways in. See the full MCP reference for the tool list.

1 · The local server (your machine)

Point your agent's MCP client at the bundled termalin-mcp binary. With Claude Code, for example:

claude mcp add termalin -- <path>/termalin-mcp

It reaches the hosts you pick in Settings → MCP (each written with agent-only auth — no passwords on disk), and each host carries an agent access level — full, an allowlist of commands, or blocked. The tools cover the whole workflow: list hosts, run one-off commands, open and reuse persistent SSH sessions, read and write files over SFTP, open port forwards (a local tunnel to a service behind the server, or a SOCKS proxy), and — while the app is running with the consent toggles on — open live terminal tabs or step into a session you already have open and run alongside you, the tab glowing as it acts.

2 · The hosted endpoint (no app required)

Create an API key in the web cabinet and point any agent at https://termal.in/api/v1/mcp with Authorization: Bearer tk_live_…. It runs commands and reads or writes files over SFTP on your tunnelled servers — the ones running the one-line install agent (enroll via the cabinet: Add → Tunnel, then run the copied command on the server) — even when nothing is open on your machine, authenticating with a short-lived certificate so no key is handed out. Keys can be scoped to specific servers, set to a command policy (full, an allowlist, or read-only), given an expiry (30/90/365 days), and revoked any time.

Staying in control

• Agent access is off by default; letting agents type into your live sessions is a separate toggle again.
• Every agent command is marked in the recording, visible live in the watch grid, and written to the audit log.
• Access is granular — per host on the desktop (full / allowlist / blocked) and per API key on the hosted endpoint — so an agent can be read-only on one server and run only git on another.
• Hosted runs are rate-limited and time-boxed per API key.

Updates

Termalin updates itself silently. Each release is signed with an offline key; the app verifies the signature and the installer's checksum before installing, so a compromised update server can withhold an update but never inject one. Check manually from Settings → Check for updates.

Troubleshooting

SmartScreen blocks the installer

The beta isn't signed yet — More info → Run anyway. Signing is coming.

An agent can't connect

Check that the app is running, "Agent in Terminal" (and "Let agents run commands" for injection) are on, and the host allows headless connection (no interactive passphrase needed, or the key is already unlocked in the agent).

I forgot my master password

It can't be reset — that's the security model. You can reset the app and start fresh, but locally encrypted data tied to that password is unrecoverable.

Still stuck? Open a support request or email [email protected] — we read everything.