Secure SSH client with an end-to-end encrypted vault
Wardterm is an SSH client with an end-to-end encrypted vault: your servers, SSH keys and passwords are encrypted on your device and open only for you.
Servers4
deploy@10.20.0.30Productiondeploy@10.20.0.11Productiondeploy@10.20.0.12Productionredis@cache-eu.internalServers4
Encrypted on your device
Everything you save in Wardterm lives in one encrypted vault.
Everything in one vault
Hosts, users, passwords, private keys, saved commands, tunnels and session history.
Opens only for you
Your vault password and your Secret Key unlock it, and both stay with you.
Encrypted sync
Your devices share the same vault, encrypted end to end.
Post-quantum
Sharing and adding a device use post-quantum encryption.
Unlock with Face ID or Touch ID
Lock Wardterm when you step away and open it again in a second.
A glance or a touch
Face ID, Touch ID or a PIN. Your vault password always works too.
Locks on its own
After a few minutes away, or when your Mac sleeps or locks.
Sessions keep running
While the app is locked, your SSH sessions stay open and out of sight.
SSH keys and server checks
Your keys stay on your devices, and you always know which server you reach.
Keys in the Secure Enclave
Create an SSH key inside the Secure Enclave of your Mac or iPhone. It never leaves the chip, and each use can ask for Touch ID or Face ID.
Server fingerprint check
Wardterm saves the fingerprint of every server you trust. If it changes, Wardterm stops and asks.
Straight to your servers
SSH sessions go directly from your device to your servers.
Shared vaults for your team
Share servers with the people you work with, and decide who keeps access.
A key for each shared vault
Each shared vault has its own key, given only to the people you add.
Check who you add
Before you give access, the other person reads you a short fingerprint to confirm.
Remove access at any time
Remove someone and the vault moves to a new key.
Questions
Is Wardterm end-to-end encrypted?
Yes. Your servers, keys and passwords are encrypted on your device before they sync. Only your devices, and the people you share a vault with, can open them.
Can Wardterm see my passwords and SSH keys?
No. They are encrypted on your device with your vault password and Secret Key, and both stay with you.
Where are my SSH keys stored?
In your vault, encrypted on your device. With sync, your other devices get an encrypted copy. A key made in the Secure Enclave stays on the device that made it.
Can I unlock Wardterm with Face ID or Touch ID?
Yes. Turn on App lock in Settings to open Wardterm with Face ID, Touch ID or a PIN.
What if I forget my vault password?
Choose a new one with the recovery kit you saved when you created the vault.
How does Wardterm check a server's fingerprint?
The first time you connect, you confirm the server's fingerprint and Wardterm saves it. If it ever changes, Wardterm stops and asks before going on.
How do I know the app is genuine?
The Mac app is signed with our Developer ID and notarized by Apple, and macOS checks it before opening it.
How do I report a security issue?
Write to us through the contact form with the steps to reproduce it.
Try Wardterm on your own servers
Download the app and add your first server.