FAQ

Termlet is an SSH client for Windows, macOS (Apple silicon) and Linux. It also handles Telnet and serial ports, and comes with SFTP file management, port forwarding and local terminals (plus WSL on Windows). Its interface and core are both written in Rust, and the whole app runs as a single process.

It comes with the termlet command-line tool, which lets AI tools such as Claude Code run commands and upload or download files on the servers you have saved, while your passwords and private keys never leave Termlet.

It is free for now, and no account is needed. You may install it on any number of computers, for personal or work use.

Termlet is licensed under its own software license agreement (not an open-source license); the agreement included with the version you download is the one that applies. Third-party components it includes (open-source libraries such as GPUI, the JetBrains Mono font and the terminal color schemes) are under their own licenses, whose texts are in the licenses folder that comes with the program (in the installation folder on Windows, in Contents/Resources inside Termlet.app on macOS, and in the extracted folder on Linux).

It is closed source for now; whether it will be open-sourced has not been decided. If it is, the code will be published in the public GitHub repository termlet/termlet, which currently holds the installers, the changelog, the license agreement and the feedback channels.

To judge whether a closed-source program is safe to use, see the questions below: where your data is kept, how credentials are encrypted, what AI tools can get, and how to check that a download really comes from Termlet’s publisher.

Most of what you use every day is there: tabs and split panes, SFTP, port forwarding, rz / sz, GBK and Big5 encodings, jump hosts and proxies, and being opened by bastion hosts such as JumpServer. Coming from those clients, you can:

• Import your sessions from Xshell, MobaXterm, FinalShell, Tabby, Termora, WindTerm and ~/.ssh/config (see “How do I import hosts from another client?”).
• Keep your shortcuts: on Windows and Linux, switch to the Xshell or MobaXterm key presets in one click under Settings → Shortcuts; on macOS, shortcuts follow Terminal.app and iTerm2 and use ⌘ (see “What are the shortcuts on macOS?”).
• Keep your habits: Xshell’s compose bar (write a command, then send it to many terminals) and duplicate sessions (sharing the connection, with no new password or verification code), MobaXterm’s MultiExec (called sync input in Termlet), and two-pane SFTP.
• Bring your colors: import terminal color schemes from Xshell (.xcs), MobaXterm, Windows Terminal, iTerm2 and more.

What Termlet adds:

• A command-line tool for AI tools: off by default, allowed host by host, asks you before dangerous commands, and records every call (see “Command-line tool and AI”).
• Light: the 0.1.0 Windows installer is about 17 MB, and a cold start took about 0.3 seconds on the author’s (Windows) computer.
• Sync that doesn’t go through Termlet’s servers: it writes to your own cloud drive folder or WebDAV, with the whole file encrypted by your sync password.
• No account, and free for work use.

Not there yet: versions for Intel Macs and ARM Linux (see “Which systems does it run on?”), RDP / VNC and plugins. Termlet itself has no built-in AI assistant and calls no AI models.

Yes. When you click “Connect” on the web page of a bastion host such as JumpServer or NSFOCUS OSMS, it starts a local client with the command-line arguments of Xshell, PuTTY, SecureCRT, MobaXterm, WinSCP or Xftp. In the bastion host’s local client settings, replace the path of one of these programs with Termlet (on Windows, by default %LOCALAPPDATA%\Programs\Termlet\Termlet.exe). This opens a temporary connection: it is not saved in the host list, the password stays only in memory, and the host key is confirmed as usual.

For old bastion hosts and switches that only offer legacy algorithms such as aes128-cbc and 3des-cbc, enable “Legacy devices” on the host’s Connection page.

Platform	Requirements	File
Windows x64	Windows 10 1809 (build 17763) or later	termlet-<version>-win-x64.exe (setup wizard)
macOS (Apple silicon)	macOS 11 or later	termlet-<version>-mac-arm64.zip (contains Termlet.app)
Linux x64	glibc 2.35 or later (Ubuntu 22.04, Debian 12 and newer), an X11 or Wayland desktop session	termlet-<version>-linux-x64.tar.gz

All three are released together with the same version. macOS is Apple silicon only; Linux is x64 only, as a tar.gz, with no deb, rpm, AppImage or Flatpak.

The macOS and Linux versions are built by CI and pass the automated tests, but haven’t been tested on real hardware yet; if you run into problems, please report them in Issues of termlet/termlet on GitHub. These two don’t install updates themselves (see “How do I update?”) and have no Windows Hello unlock or WSL.

On macOS, shortcuts follow Terminal.app and iTerm2 and use ⌘ (listed in the next question). Current limits: Option can’t act as the Meta key (Option with a letter types a special character; press Esc first to send the ESC prefix), Termlet quits when its last window closes (it doesn’t stay in the Dock), quitting from the Dock or when shutting down or logging out doesn’t first ask about open connections and unfinished transfers (⌘Q and Quit Termlet in the menu do), and the Xshell and MobaXterm shortcut presets aren’t offered.

They follow Terminal.app and iTerm2 and use ⌘:

Action	Shortcut
Copy, paste	⌘C, ⌘V
New local terminal	⌘T
Close tab	⌘W
Switch tabs	⌘1–9, ⇧⌘] / ⇧⌘[
Split	⌘D
Clear	⌘K
Search	⌘F
Command palette	⇧⌘P
Settings	⌘,
Quit, hide, minimize	⌘Q, ⌘H, ⌘M
Close window	⇧⌘W

Every Control combination goes to the terminal (⌃C, ⌃R and so on reach the shell). Option with a letter types a special character rather than acting as Meta; press Esc first to send the ESC prefix. The SFTP file list follows Finder. You can change shortcuts under Settings → Shortcuts.

No.

• Windows: the setup wizard installs for the current user only, by default in %LOCALAPPDATA%\Programs\Termlet. You can change the folder (upgrades keep the existing one), and Start menu and desktop shortcuts are created. The installation folder holds Termlet.exe and the command-line tool bin\termlet.exe. Uninstalling removes the termlet command from PATH and deletes the shortcuts and the update cache.
• macOS: unzip it and drag Termlet.app into Applications; the first time you open it, you have to allow it once (see “macOS won’t open Termlet. What should I do?”). To uninstall, delete Termlet.app.
• Linux: extract the archive and run ./Termlet; the included ./install.sh only touches your own folders (the application menu, icons and ~/.local/bin/termlet) and needs no root. To uninstall, run ./install.sh --uninstall, then delete the extracted folder.

Uninstalling never deletes your data folder (see “Where is my data stored?”).

Each release comes with SHA256SUMS (the SHA-256 of each platform’s package and of the version files latest.yml, latest-mac.yml and latest-linux.yml) and its signature SHA256SUMS.minisig, which you can download from the download page or from GitHub Releases. The signature uses the minisign format, and the current public key is:

RWRSYxplUItTcPz4ZAEBJVcK0n3Sy1xPjhO3CNJIVFxbazT7cXsPacBG

1. Install minisign (Windows: scoop install minisign or choco install minisign; macOS: brew install minisign; Linux: your distribution’s package, such as sudo apt install minisign), put SHA256SUMS, SHA256SUMS.minisig and the package you downloaded in the same folder, and run this there:

   minisign -Vm SHA256SUMS -P RWRSYxplUItTcPz4ZAEBJVcK0n3Sy1xPjhO3CNJIVFxbazT7cXsPacBG
   

   It passes only if it prints Signature and comment signature verified and the next line, Trusted comment: termlet-sha256sums <version>, names the version you downloaded.

2. Check the package against SHA256SUMS: on Linux, in Git Bash or in WSL, run sha256sum -c SHA256SUMS --ignore-missing, or on macOS shasum -a 256 -c SHA256SUMS --ignore-missing, and look for OK on the line of the file you downloaded; or in PowerShell, run Get-FileHash .\termlet-<version>-win-x64.exe and compare the hash with that file’s line in SHA256SUMS (case doesn’t matter).

A matching SHA-256 only shows the download is complete; a valid signature is what shows the file comes from Termlet’s publisher. The public keys in SECURITY.md in the termlet/termlet repository on GitHub are the ones that count; if the keys are ever rotated, it will be announced there and in the changelog. Both keys, the current one and the offline backup, are also listed with their key IDs on the download page.

The installer is not code-signed yet, so Windows SmartScreen doesn’t recognize the publisher and may show this the first time you run it; browsers such as Edge may also warn that the file isn’t commonly downloaded.

First make sure the file came from an official download location (the download page on termlet.dev, or Releases of termlet/termlet on GitHub) and passed the checks in the previous question, then click “More info” → “Run anyway”.

Once installed, Termlet downloads its own updates and verifies their signatures before installing, so you don’t need to check each release by hand.

The macOS package is only ad-hoc signed (no Apple developer certificate, not notarized), so the first time you open it, macOS blocks it and says the developer can’t be verified, or that Apple can’t check it for malicious software.

First make sure the file came from an official download location (the download page on termlet.dev, or Releases of termlet/termlet on GitHub) and passed the checks in “How do I check my download?”. Then find the message about Termlet under System Settings → Privacy & Security and click “Open Anyway”, or run this in Terminal:

xattr -dr com.apple.quarantine /Applications/Termlet.app

After that it opens normally. When you replace Termlet.app with a new version, you have to allow it once more.

Extract the archive and run ./Termlet. To add it to the application menu, run the included ./install.sh (no root needed); it also links the command-line tool as ~/.local/bin/termlet. Run it again after moving the folder.

If it won’t start, a library it needs at run time is usually missing: libxcb, libxkbcommon, libxkbcommon-x11 and a graphics driver (Vulkan; without it, it tries OpenGL ES). On Debian / Ubuntu:

sudo apt install libxcb1 libxkbcommon0 libxkbcommon-x11-0 mesa-vulkan-drivers

It also needs glibc 2.35 or later (Ubuntu 22.04, Debian 12 and newer) and an X11 or Wayland desktop session. Without a Secret Service (GNOME Keyring, KWallet and so on), Termlet has you set a master password instead and asks for it at every start.

The Linux version hasn’t been tested on real hardware yet; if you run into problems, please report them in Issues of termlet/termlet on GitHub, with the output of ./Termlet run in a terminal.

“Check for updates automatically” under Settings → About is on by default, so Termlet checks at startup; you can also click “Check for updates” at any time.

• Windows: a copy installed with the installer downloads the new version in the background, and the title bar tells you when it is ready; click it (or “Restart and install” under About) to restart and install, otherwise it installs when you quit. Copies not installed with the installer only announce the new version, and “Download” opens the download page.
• macOS and Linux: Termlet only announces the new version, and “Download” opens the download page; you replace the app by hand (Termlet.app on macOS, the extracted folder on Linux, then run install.sh again if you used it). Your data is kept.

Each platform’s version file carries a signature made at release time with an offline private key; Termlet verifies it with its built-in public keys before downloading or announcing an update, and on Windows checks the installer again before installing. If the signature is wrong, the update stops and Termlet suggests downloading manually.

If you’d rather not check automatically, turn off “Check for updates automatically”.

On your computer. The data folder is %APPDATA%\termlet on Windows, ~/Library/Application Support/termlet on macOS and ~/.config/termlet on Linux: hosts, settings and encrypted credentials are in data.db, and the logs, local snapshots and session logs are in the same folder (the session log folder can be changed). The master key that encrypts the credentials is kept in the system keychain (Windows Credential Manager, the macOS keychain, or the Secret Service on Linux, such as GNOME Keyring or KWallet); when that is unavailable (for example, Linux without a Secret Service), it is protected by a master password you set and enter at every start.

• Termlet restricts the data folder to the current user.
• Set the TERMLET_DATA_DIR environment variable to use another folder.
• Uninstalling Termlet does not delete the data folder.

Your hosts, credentials, commands, terminal content and files stay on your computer (with cloud sync on, they are encrypted and written to a location you choose); they never pass through our servers. We receive only two things: anonymous usage statistics, which are on by default and can be turned off, and crash reports, which are sent only after you turn them on.

Usage statistics are on by default; Termlet shows no prompt about them and sends them once installed. You can turn off “Send anonymous usage statistics” under Settings → About at any time, or click “View what is sent…” there to see the exact message.

For when Termlet goes online and what the statistics contain, see the privacy policy.

• Passwords, private keys, key passphrases, verification code (TOTP) secrets and other credentials are encrypted with AES-256-GCM before they go into the database, and the master key is in the system keychain (see “Where is my data stored?”). Private keys imported into the key library are encrypted in the database too, not saved as separate files.
• Passwords, private keys, verification codes and commands are never logged, and diagnostics contain no host addresses, credentials or commands.
• Command history is encrypted on this computer, is not synced, and is not visible to the command-line tool or AI tools.
• You confirm a host’s key on the first connection; if the key changes, Termlet refuses to connect and explains the risk.
• You can turn on the app lock (a lock password, or Windows Hello on Windows), so nobody else can use the open Termlet while you are away.

What it can’t do: the app lock does not defend against programs running on this computer as you, and once a host’s verification code secret is saved, two-factor authentication effectively becomes one factor.

1. Under Settings → Command-line tool, tick “Enable external CLI” (off by default).
2. Edit each host you want to hand to AI tools and tick “Allow Termlet command-line access”. A host used for the first time must be connected once in Termlet to confirm its host key.
3. Install the Agent Skill: under Settings → Command-line tool, install it with one click for Claude Code, the shared folder (read by Codex, Gemini CLI, Cursor, GitHub Copilot and others) or WorkBuddy; or run termlet skill install from the command line (termlet has to be in your PATH: on Windows, click “Add to PATH” on the same page; on macOS and Linux, link it with the command shown there, and the install.sh in the Linux package already links it as ~/.local/bin/termlet). AI tools then use termlet instead of calling ssh directly.
4. Ask your AI tool to do the work; it runs commands like these:

termlet ls                                    # list hosts that allow CLI access
termlet exec web-01 "systemctl status nginx"  # run a command; its exit code is passed through
termlet upload web-01 ./app.tar.gz /tmp/      # upload one file
termlet download web-01 /var/log/syslog .     # download one file

If Termlet isn’t running, termlet starts it in the background (no window; it quits after 10 minutes without requests); you can change this in Settings so the CLI only works while Termlet is open. Hosts that need a verification code cannot be used from the command-line tool.

AI tools can only ask Termlet, through termlet, to connect and run things for them, and what they get back is the commands’ output:

• Credentials stay in Termlet: AI tools never see passwords, private keys or verification codes.
• Off by default, allowed host by host: only hosts with “Allow Termlet command-line access” can be used. You can also give the command-line tool its own user and password or key; a low-privilege account on the server is recommended.
• Dangerous commands need your approval: 15 built-in rules (rm -rf /, mkfs, shutdown and more) plus your own regular expressions. On a match, Termlet asks you in a dialog; if you reject it or don’t answer within 60 seconds, the command doesn’t run.
• Every call is recorded: every exec, upload and download, including failed, blocked and rejected ones, goes into the audit log on this computer (command, result, exit code, duration and calling process chain), which you can search and export.

To be clear: the dangerous command rules only prevent mistakes; they can be bypassed and are not a security boundary. AI tools can run commands on the hosts you allow, and the real permission boundary is on the server, which is why a low-privilege account for the command-line tool is recommended.

Use More → Import Hosts… in the host list toolbar and choose a source:

• ~/.ssh/config (ProxyJump becomes a jump host, ProxyCommand a proxy command)
• an Xshell session folder
• a FinalShell connection folder
• MobaXterm (MobaXterm.ini, an exported .mxtsessions file, or the bookmarks the installed edition keeps in the registry)
• Tabby (config.yaml)
• Termora 2.x (the data folder ~/.termora)
• WindTerm (the program folder, a .wind data folder or the user.sessions file in it)

You get a preview first: hosts with the same address, port and user can be merged or skipped, and you can search, filter and pick what to import; anything that isn’t imported is explained host by host. Usually only host details are imported, not passwords; Termora and WindTerm imports include the saved passwords and private keys.

Termlet host files (.termlet-hosts) exported from Termlet on another computer are imported here too.

Two ways:

• Full backup: under Settings → Backup, click “Create Backup…” and set a backup password (at least 8 characters) to get a .termlet-backup file; on the new computer, click “Restore from Backup…”. The backup holds hosts, groups, credentials, keys, snippets, port forwards, workspaces, color schemes, settings, host keys and command history, and the whole file is encrypted with the backup password. It cannot be opened without the password.
• Sync: set both computers to the same sync location and sync password (see the next question), and they stay in step from then on.

Don’t just copy the data folder: the master key is in the old computer’s system keychain, so the copied passwords and private keys can’t be decrypted. The daily local snapshots can also only be restored on the computer that made them.

Under Settings → Sync, choose a sync location, set a sync password and click “Start syncing”; on the other computers, choose the same location and enter the same sync password. The sync location can be:

• A local folder: a folder synced by a cloud drive such as OneDrive, Nutstore or iCloud, which carries it between computers; or a USB drive.
• WebDAV: for example Nutstore (https://dav.jianguoyun.com/dav/<folder>/ with an app password), Nextcloud or Synology.

Hosts, groups, credentials, keys, profiles, snippets, port forwards, workspaces, color schemes and most settings are synced; command history, the audit log, host keys and settings that belong to one computer (local terminals, app lock and so on) are not.

• End-to-end encrypted: the location holds a single file, encrypted as a whole with the sync password before it is written (Argon2id + AES-256-GCM), so nothing there, not even host names or addresses, can be read, and sync doesn’t go through Termlet’s servers. The sync password cannot be recovered if forgotten.
• Merged item by item: a change made on one side is taken; when both sides changed the same item, the newer change wins and is listed under Sync, where you can switch to the other side. A local snapshot is saved before other computers’ changes are applied, so you can roll back.
• Automatic: on by default, one minute after startup, about 20 seconds after changes on this computer, and every 10 minutes.

Note: after one computer upgrades Termlet, the others must upgrade too to keep syncing; WebDAV supports Basic authentication only.

• Bug reports and feature requests: open one in Issues of the termlet/termlet repository on GitHub and fill in the template. When reporting a problem, please attach the diagnostics: click “Copy diagnostics” under Settings → About. They include the version, environment, a settings summary and the end of the logs, without host addresses, credentials, commands or the audit log.
• Questions, ideas and everything else: go to Discussions in the same repository.
• Wherever you post, never include passwords, private keys, tokens or verification code secrets; you may also want to hide host addresses and user names in logs and screenshots.

Termlet is developed and maintained by one person, so replies may take a while.

Please don’t report it in Issues, Discussions or anywhere else in public. On the Security tab of the termlet/termlet repository on GitHub, click “Report a vulnerability” to report it privately; only you and the maintainer can see it. Include the affected version and operating system, where the problem is, steps to reproduce and the impact you expect; don’t include real passwords, private keys or server addresses.

You will usually get a reply within 7 days. Fixes ship in a new version together with a security advisory, and security fixes are made for the latest release only. The dangerous command rules can be bypassed and the app lock does not defend against programs running on this computer as you; these are documented design limits, so please open a regular issue for ways around them. The full process is in SECURITY.md in the repository.