Documentation
Vault & sync
One encrypted store on each machine, optionally carried between them — and shared with a team when you choose.
Your vault
One password protects it
Everything Termiyo stores lives in a vault encrypted under your master password. The password is never stored and never sent anywhere, and there is no recovery — a passphrase of several unrelated words is the right kind of password for it.
Sync across machines
Signing in
Settings, Sync. Use the password that already unlocks your vault — Termiyo derives two separate keys from it, one that stays on this machine and one the server can check without ever learning the password.
A second machine
Install Termiyo, create a vault with the same password, and sign in. Your hosts, keys and snippets arrive on the first sync. Nothing is decrypted anywhere but on your own machines.
Signing out
Removes the token, not your data. What is on the machine stays on it, still encrypted under your vault password.
Team vaults
A vault shared with a team
A team vault lets several people share hosts, identities and keys. Creating a team is part of the Team plan and above; joining one you are invited to needs no plan of your own.
Who can read what
Everyone with Can edit on a team vault can read what is in it, including any password or key stored there. A Read-only member can read a record only where their grant says so. A record in a team vault is usable only by hosts in that same vault. Read only limits the credentials, not everything a host carries: the notes and any environment variables saved on a shared host stay readable to a read-only member, so keep a secret out of a host’s notes.
Backup and restore
Keeping ids and timestamps
A restore writes the archive’s records back into the vault, keeping each record’s original id and timestamps so what pointed at what still does. It does not first wipe what is there.
Shared records come from the team, not the file
Records that were in a shared vault are left out of a restore: that vault lives on the server, and signing in brings back the team’s own copy rather than an older one from the file.