Termiyo
Cloud Login

Documentation

Termiyo, end to end

Short pages, in the order you will need them.

Getting started

Install Termiyo

Take the download for your computer from the download page — the Universal .dmg on a Mac, the installer on Windows, your distribution’s package on Linux. The download page shows how to check it and how to install it on each system.

Create your vault

The first time you open Termiyo it asks for a master password. This is the only thing protecting everything the app stores, it is never sent anywhere, and there is no recovery — use a passphrase of several unrelated words.

Add an identity

An identity is a username plus how to authenticate: a password, a private key, or an agent. Identities are separate from hosts so the same login works across a fleet without being retyped.

Add a host

Give it an address and pick an identity. Double-click it to connect. The first connection shows the server’s key fingerprint; accepting it pins the key for every reconnect after.

Jump hosts

Reaching a private host

Open the host, expand Advanced, and pick a jump host. Termiyo connects to the bastion first and opens a channel through it to the target — the target never needs to be reachable from your machine.

Chains

A jump host can have a jump host of its own. Termiyo flattens the whole path before it dials, refuses a chain that loops, and names the hop that failed when one does.

Port forwarding

Local

Listen on your machine, deliver on the server’s side. The usual case is reaching a database that only binds to localhost on the host.

Remote

The reverse: the server listens, and connections come back to a port on your machine. Useful for showing a local build to something that can only reach the server.

Dynamic (SOCKS5)

Termiyo runs a SOCKS5 proxy locally and sends every connection out through the session, with the destination resolved on the far end. Point a browser at it and you are browsing from the server.

Sharing a terminal

Creating a link

Open the share panel on a connected terminal and create a link. Anyone who follows it waits until you let them in, and joins read-only.

Letting someone type

Typing is off for the whole session until you turn it on, and then granted per person. Turning it back off takes it from everyone who already had it, immediately.

What travels where

The terminal stream goes directly between the two machines. Our service introduces the two of you and sees nothing after that. The link stops working after four hours or when you stop sharing, whichever is first.

Sync

Signing in

Settings, Sync. Use the password that already unlocks your vault — Termiyo derives two separate keys from it, one that stays here and one the server can check without ever learning the password.

A second machine

Install Termiyo, create a vault with the same password, and sign in. Your hosts, keys and snippets arrive on the first sync. Nothing is decrypted anywhere but on your own machines.

Signing out

Removes the token, not your data. What is on the machine stays on it, still encrypted under your vault password.

Asking for a command

Setting it up

Settings, AI, and an Anthropic API key. The key is stored in your vault, encrypted like every other credential.

Asking

Describe what you want. The suggestion lands on your command line for you to read; Termiyo never runs one for you. Anything that deletes, overwrites or stops a service is labelled.

What is sent

Your question, and the operating system if the login banner stated it. Recent commands are sent only if you turn that on. Hostnames, usernames, passwords and keys are never sent.

Telnet and serial

Serial consoles

Pick Serial when adding a host and Termiyo lists the ports it can see. 8-N-1 at 9600 is what most console ports use; a wrong speed does not error, it produces garbage, so check that first if the output looks wrong.

Sending a break

The break signal is how you interrupt a hung bootloader or drop a device into its recovery monitor. There is no other way to produce it from a terminal.

Telnet

Supported because network equipment often speaks nothing else. It is unencrypted — everything, including a password, travels in the clear. Use it on a management network, not across the internet.

Importing from another SSH client

Import from the client you already have

Look on this computer

The import menu is the cloud button above the host list, and its first entry is “Look on this computer”. Termiyo goes to the places the tools you already have keep their servers — ssh_config, known_hosts, PuTTY, FileZilla, WinSCP, MobaXterm, the JetBrains IDEs, Remmina, Tabby, SecureCRT, Cyberduck and the iTerm2 profiles that are really ssh commands — and lists what it found, with a count, rather than asking you to go and find a file.

What comes across

Names, addresses, ports, usernames, jump hosts and port forwards. Saved passwords too, from FileZilla, WinSCP, JuiceSSH and Remmina, into the vault where they are encrypted at rest. JetBrains and Cyberduck keep theirs in the OS keychain, MobaXterm under DPAPI and SecureCRT behind its own passphrase — those hosts still arrive, and ask once on the first connect. Anything that could not be mapped is listed with the reason rather than dropped quietly.

Termius, JuiceSSH and PuTTY need a file

Termius encrypts what it keeps on the machine field by field, so there is nothing there to read, and it removed its own export — the file has to come from a community exporter you run yourself; Termiyo reads its JSON and CSV, keys included. JuiceSSH is a phone app, so copy its backup over. PuTTY on Windows keeps sessions in the registry, so export them with regedit first; on macOS and Linux ~/.putty/sessions is read in place. Put any of these in Downloads and Termiyo offers it by name when you come back.

Nothing is written until you have read it

The preview says what would be created, what you already have, and what could not be brought across, before anything touches the vault. Importing the same file again updates the hosts you already have rather than adding a second copy.

SSH certificates

Paste the certificate

Open Settings, SSH keys, pick the key and paste the -cert.pub line your certificate authority signed into Certificate. Termiyo shows whom it lets in, until when and any command it forces, and the key list shows when it runs out. It refuses a host certificate before it is saved, and one signed for another key whenever it can tell which key this is — always for a key it holds, and for a key in your agent once you have given its public half.

Certificates in your agent

A certificate your SSH agent holds is offered on its own; there is nothing to paste. Termiyo asks the agent what it holds before it connects.

Imports bring them along

Importing an ssh_config brings each key’s CertificateFile and the -cert.pub beside it, and so does choosing a key file. A certificate that was signed for another key, is a host certificate or has expired is not attached, and the preview says why. A certificate for a key you already have is added only if you tick the box that says so.

Mosh too

A Mosh host logs in with your certificate the way an SSH host does. If the certificate forces a command, the host runs that instead of mosh-server and Mosh cannot start; Termiyo names that as the likely cause. Security-key certificates are left out of a Mosh login, because it cannot wait for a touch — use SSH for those.

Importing from AWS

What it needs

An access key with ec2:DescribeInstances, and nothing else. The credentials are used for that one call and are not stored.

What you get

Every running instance in the regions you pick, including the ones with no public address — those are the ones you reach through a bastion. Tick what you want.

Running it again

Re-importing updates the hosts you already have rather than adding a second copy, and leaves the identity you gave them alone.

Snippets

Saving a command

Snippets are commands you keep, grouped into folders. Running one types it into the terminal in front of you.

Values in a snippet

Write ${name} where a value goes, and choose in the editor how each one is filled: Ask each time (with a default answer or a list of allowed answers), Fill from the host (its address, port or login name), or Leave to the shell, for a value the shell already has, such as ${PATH}. A snippet never runs with a value missing: Run snippet stays off until each one has an answer. The desktop app offers your last answers next time; a secret is never kept.