VNTerm Docs

A quick guide from installation to syncing hosts across your devices.

Install the app

Download the installer for your operating system from the Download page.

macOS (11+, Apple Silicon & Intel)

1. Open VNTerm_<version>_aarch64.dmg and drag VNTerm into the Applications folder.
2. The first time you open it, if macOS says the developer can't be verified: right-click the app → Open.

Ubuntu / Debian (22.04+, x86_64)

sudo apt install ./vnterm_*_amd64.deb

Or use the AppImage, no installation needed:

chmod +x VNTerm_*_amd64.AppImage && ./VNTerm_*_amd64.AppImage

Windows 10/11 (x64)

Run VNTerm_*_x64-setup.exe (or VNTerm_*_x64_en-US.msi for deployment via GPO/Intune). If SmartScreen shows a warning, choose More info → Run anyway.

Create account

Your account is used to sync your vault across devices. You can sign up right in the app or on the sign-up page.

• Your master password (at least 8 characters) encrypts your entire vault on your device. It is never sent to the server and we cannot recover it.
• After you sign up, the app shows your recovery key exactly once — save it (see Recovery key).
• Sign in with the same account on another device to get all your hosts, keys and snippets. The device list and revoke buttons are on the Account page.

Add host

1. In the Hosts section, click New host.
2. Enter the Address (IP or hostname), a Label, and choose a Parent Group and Tags if needed.
3. Set the SSH port (default 22), Username and Password, or attach a key / Identity from Keychain.
4. Double-click a host card to connect. On the first connection, the app shows the server's fingerprint for you to confirm; the fingerprint is saved to Known Hosts and you'll be warned if it changes.

Already have a config? Choose New host → Import from ~/.ssh/config to import in bulk. A host's advanced settings include agent forwarding, startup snippets, host chaining (jump hosts), SOCKS5/HTTP proxies and a per-host terminal theme.

Keychain & Identity

• Generate a key: Keychain → Generate key, choose ed25519 (recommended), ECDSA or RSA, and set a passphrase if you like.
• Import a key: paste or select an existing private key file (OpenSSH / PEM).
• Add the public key to ~/.ssh/authorized_keys on the server, then attach the key to the host in the Credentials section.
• An Identity bundles a username + password/key into one set you can reuse across many hosts: change the password once and every host using that Identity is updated.

Quick connect: SSH, Mosh, Telnet

Type an address into the search box on the Hosts page, then press Enter or Connect. Syntax:

[ssh|mosh|telnet] [user@]host[:port]
[email protected]
mosh [email protected]
telnet 10.0.0.5:23
[2001:db8::1]:2222

If you don't specify a protocol, the app asks you to choose SSH, Mosh or Telnet, then prompts for credentials when needed.

• SSH — port 22 by default, supports password, key and agent authentication.
• Mosh — runs your system's mosh client in a tab, keeping the session alive on flaky networks or when you switch Wi-Fi. Requires mosh installed on your machine and mosh-server on the server.
• Telnet — port 23 by default, for legacy network devices. Telnet is unencrypted; use it only on trusted networks.

SFTP

Open the SFTP tab: the left pane is your machine, the right pane is a saved host. You can browse directories, upload / download from the context menu, create folders, rename, delete and change permissions (chmod). Hold ⌘/Ctrl while clicking to select multiple files.

Port forwarding

The Port Forwarding section stores rules in your vault; enable / disable each rule independently.

Databases

The Databases section connects to MySQL, MariaDB, PostgreSQL and SQLite. Connection details (passwords included) live in your vault and are end-to-end encrypted like hosts. Pick a host under Connect through an SSH host to go through an SSH tunnel — no port forwarding rule needed. Available on desktop and on your phone.

• Tree on the left — folder → connection → database → Tables, Views, Functions, Events, Queries. Each opens in a tab; right-click (or long-press on a phone) for the menu.
• Data — click a cell to edit it and move the pointer away to save; select a row by its number, then ⌘/Ctrl+C, ⌘/Ctrl+V adds a new row. Filter, sort, export CSV / JSON / SQL and import CSV.
• Table designer — fields, indexes, foreign keys, triggers, checks and options; preview the SQL before saving.
• Read-only — queries start read-only; switch it off to write.

Serial

Hosts page → Serial: choose a port (e.g. /dev/ttyUSB0, COM3) and a baud rate (300 – 921600, default 9600). The Advanced section sets data bits, parity and stop bits. On Linux, your user must be in the dialout group to open serial ports.

Remote Desktop

Control Windows machines right in a tab of the desktop app. Nothing to install or configure on Windows — Remote Desktop just needs to be on (Settings → System → Remote Desktop) and port 3389 reachable.

1. New host → choose Remote Desktop, enter the address, username (with a domain if needed, e.g. CORP\admin) and password.
2. Double-click the host to open the Windows screen. The resolution follows the size of the tab.
3. The tab toolbar: Quality (Automatic by network speed, or a fixed level), GFX (RDP 8+ graphics, on by default), a Ctrl + Alt + Del button, split screen, floating window and sharing.

• Copy / paste of text works both ways between your computer and Windows.
• Shortcuts go to Windows. On a Mac, ⌘ + C / V / X / Z / A / F / S become Ctrl, other ⌘ combinations become the Windows key; ⌘ W still closes the tab.
• Slow network: Automatic mode lowers image quality to keep things responsive, then raises it again as the network improves.

Tabs & tab groups

• Each session is a tab; multiple sessions to the same host are numbered, e.g. Onik (1), Onik (2).
• Drag a tab onto another tab to group them. A group can be ungrouped or closed all at once.
• The + button on the tab bar opens quick connect or a local terminal.

Floating window

Right-click a tab → Float on top to move a terminal (or a Remote Desktop screen) into a small always-on-top window — handy for watching logs or a build while you do something else. Closing the floating window brings the session back to its tab.

Multiplayer

Right-click a tab → Multiplayer to create a sharing link. Recipients open it in their browser, no account needed. Content is end-to-end encrypted and the key sits after the # of the link, so the server cannot read it. You turn viewers' typing (or Remote Desktop control) on and off and can stop sharing at any time.

Themes & appearance

In Settings, choose the default terminal theme, font size and interface language. Each host can have its own theme (in the host edit panel); hosts without a theme use your account's default theme. These settings sync with your vault.

Keyboard shortcuts

Sync & end-to-end encryption

VNTerm encrypts your vault on your device: the server stores only encrypted data and never receives your master password. While quick sign-in with Google / Apple / Telegram is on (the default), the server also keeps an encrypted copy of your vault key to open your vault on a new device — turn it off in the app: Settings → Account.

• Master password → PBKDF2-SHA256 (600,000 iterations) → master key. From it we derive the auth key (sent to the server to sign in, stored server-side as Argon2id) and the enc key (which stays only on your device).
• Each host, key, snippet… is encrypted with AES-256-GCM using a random vault key before syncing. The vault key is wrapped with the enc key.
• Every API request is also wrapped in an additional layer of encryption (X25519 + AES-256-GCM, bound to the endpoint and timestamp, replay-protected) inside HTTPS.
• Revision-based sync: editing the same item on two devices at once is detected as a conflict instead of being silently overwritten.

Recovery key

The recovery key is the only way to keep your vault data if you forget your master password.

1. Store the key (formatted as XXXX-XXXX-…) somewhere safe: a password manager or a printout.
2. If you forget your password: go to Forgot password, enter the 6-digit code sent to your email, set a new password and paste your recovery key — your vault is preserved.
3. Without a recovery key: your old vault is deleted and you get an empty vault and a new recovery key. All devices are signed out after the password reset.

Team vault

1. The Vaults ▾ button in the top bar → Add vault: give it a name and invite members by email.
2. Host menu → Move to vault puts the host (with its keys / identities) into a team vault.
3. In the Vaults ▾ menu, click a vault to hide / show it, or only to see just that vault. This applies to the current device only.
4. Manage vaults (Settings → Invite People) lists members and pending invitations; removing someone revokes their access at once.

New members open the app once to create their key pair; a member who holds the key then seals the vault key for them automatically.

Plans & billing

See and buy plans on the Pricing page. Pay by card (Stripe) or PayPal, monthly or yearly; discount codes are supported. Plans are prepaid and never charge you automatically — you get a reminder email before yours ends and renew on your Account page.

• Features unlock in the app a few seconds after you pay (or when you come back to the app).
• Team / Business plans are priced per seat; members of your team vault use the plan's features.
• When a plan ends, nothing is lost: your vault still downloads to every device, only the plan's features lock again.

Still have questions? Report a bug or suggest a feature.