SSH, SFTP, Docker and Remote Desktop in one window.

bawkterm keeps your hosts, passwords and keys in an encrypted vault, and syncs them between your devices through a folder your cloud drive already shares, or a server you run.

Download Download Install Download Intel Mac Other platforms Source on GitHub

Open source

o=BB*o .o. .

B@@@@@@BX@@@X*

*@@@@@@@@@@@@@@*.

.B@@@@@@@@@@@@@@@@XB+

=@@XOBBBOX@@@@@@@@@@=

.BX*o . . .=O@@@@@@@O.

+-- web-1 -----------------+ ..XO. . . =@@@@@@B.

| | .o=OX . =OXOo +@@@X=.

| deploy@web-1:~$ uptime | o=BOXO*@* +@@@@X *@o

| 19:03:44 up 41 days | - - - - -B@@@XOOO@+. o@@@@B +oXB

| deploy@web-1:~$ _ | . .=BXO**@+ o*B*. *==@o

| | oB@@* @*BX.

+--------------------------+ =@@@B +@=OO.

+@@@@X =@*BX+..

.X@@@@@+. oo =XBo .

+@@@@@@B. OXX@@B

+@@@@@@X =+. OO ..

*X@@Bo@= . =@BOOX@

. . OO .XX*o OB o

=@o BO=. BXo*OX@+

.XBBX+BXB@= o+

*@Xo .**

.*o

Features

Open a host with CmdCtrl+Shift+P and its files with CmdCtrl+Shift+B, which follow every cd. Then split it with a second server and run one deploy on both with broadcast input.

terminal: Tabs and split panes with WebGL rendering. Broadcast input types into every pane at once. Chained jump hosts, agent auth with FIDO2 keys, agent forwarding and auto-reconnect.
local: PowerShell, Command Prompt, Git Bash, WSL or your login shell, in the same tabs and panes as your servers.
files: The server’s files open beside its terminal on the same login, and follow the folder you cd into. Drop files on them to upload.
sftp: Local and remote side by side, with drag and drop, recursive transfers and favorite folders.
docker: Containers grouped by Compose project, with CPU and memory, and a shell or live logs in a tab.
editor: Remote files open in a tab, highlighted for about 100 languages. CmdCtrl+S saves them back.
remote desktop: Opens Windows Remote Desktop, or FreeRDP 3 on macOS and Linux, already signed in. It can go through an SSH jump host.
hosts: A dot shows which hosts are up. Open a whole group at once, as tabs or as panes in one tab.
sync: Through a folder that Dropbox, OneDrive, iCloud Drive or Syncthing already shares, or a server you run. Encrypted end to end.
keychain: Generate ed25519, RSA and ECDSA keys. Import OpenSSH, PEM and PuTTY keys, including PuTTY’s newer format.
import: Bring your hosts over from ~/.ssh/config, PuTTY, KiTTY, WinSCP, FileZilla, MobaXterm or a CSV file, with their folders, keys and jump hosts.
export: Take your hosts with you as an SSH config or CSV file, or save an encrypted backup of the whole vault.
snippets: Saved commands you run from CmdCtrl+Shift+S.
logs: Save each session as a plain text file, if you want a record.
themes: 31 terminal themes. Or bring your colors, font and cursor from Windows Terminal, Alacritty, Ghostty, Kitty, WezTerm, iTerm2 or Warp.

Security

Your vault is encrypted on your device. Your sync folder or server only ever holds ciphertext.

vault: AES-256-GCM under a random 256-bit key.
password: Stretched with scrypt to wrap that key. Never stored or logged.
unlock: Windows Hello, a passkey or your system keyring, if you turn them on.
isolation: Secrets stay in the main process. The window only learns that a key exists.
host keys: Trusted on first use. A changed key blocks the connection.
forwarding: Agent forwarding is off unless you turn it on for a host. Servers never see your private keys.
updates: Installed only when the SHA-512 checksum matches.
backups: Encrypted with your master password. Restoring never deletes anything.

Read the full security model

{
  "id": "vhbQ3426D_gZPf0FG65TyHRweABBp_2Jtw64RpQ7EtE",
  "seq": 1288,
  "updatedAt": 1791390458575,
  "deleted": false,
  "blob": "Aklfu_B7fUJJUd0d6y5d6_zErBWxZXgKxJ_YFC6edqcHIC6_pf_pCh-L5wPDmztdYqfZyapdrfVQTnaym746G6QDRhkeMUM9r3EBQ5du-b1F5zEcwTEQnB0m03QfgEnWyZGCF5NKgYyNdDhcKciYoc…"
}

A saved host, as your sync folder or server stores it. The blob is 1,052 bytes of AES-256-GCM, padded to whole KiB.