bawkterm

Why I built bawkterm

I got tired of paying for Termius, and the other clients I tried looked ugly. I like software that looks good, so I built my own.

bawkterm is a desktop client for SSH, SFTP, Docker over SSH and Remote Desktop, with an encrypted vault for my hosts, passwords and keys. Sync between devices goes through bawksync, a small server you run yourself, so there is no account and no subscription.

The app is monospace everywhere, with a warm dark theme. Yes, my taste might not be yours. If it isn't, there are 31 terminal themes and a light mode, and bawkterm can import the look of the terminal you already use.

It is free and open source under AGPL-3.0. It is a personal project, so expect rough edges, and open an issue when you hit one.

I'm Chris Judd, a developer and systems engineer with nearly 20 years in IT. My other projects are at juddscript.dev.

Questions

Is bawkterm free?
Yes. bawkterm is free and open source under the AGPL-3.0 license. There is no account, no subscription and no paid tier.
Can bawkterm replace Termius?
For desktop work, mostly: saved hosts in folders, SSH tabs with jump hosts and agent auth, SFTP, a keychain, snippets, and sync between your devices. Sync runs through a bawksync server you host yourself, encrypted end to end. There is no mobile app.
Which platforms does it run on?
Windows, macOS (Apple silicon and Intel) and Linux x64, as a .deb, .rpm, AUR package, Flatpak or AppImage.
Where are my passwords and keys stored?
In one encrypted file on your computer: AES-256-GCM under a random 256-bit key, which your master password wraps through scrypt. Decrypted secrets stay in the app’s main process, and the window only learns that a password or key exists.
How does sync work?
bawkterm encrypts each item on your device and sends it to a bawksync server you run, in Docker or on Cloudflare Workers. The server stores opaque IDs, timestamps and ciphertext. It never sees host names, addresses, passwords or keys.
Can I import my existing hosts and keys?
Yes. bawkterm imports hosts from ~/.ssh/config and keys in OpenSSH, PEM and PuTTY formats. It can also import the colors, font and cursor of Windows Terminal, Alacritty, Ghostty, Kitty, WezTerm, iTerm2 or Warp.
Why does Windows or macOS warn me when I install it?
The builds are not code-signed yet, so Windows SmartScreen and macOS ask once on first launch. Updates install only when they match the SHA-512 checksum published with each release.

Download bawkterm or read the full security model.