Voltius

📢 Latest Update: Huge thanks for the 200+ stars in 24h!

A local-first SSH/SFTP/Serial client with E2EE sync, plugins, and no account required — a modern alternative to Termius.

✨ Features

No account required. Everything below is free, forever.

• Easy Import & Export — No vendor lock-in. Import your existing setup from Termius or MobaXterm in 1-click. Your data is always exportable as open JSON.
• Gist Sync — E2EE device sync via your own private GitHub Gist. No central server, bring your own token.
• SFTP — Easy file transfers and browsing, works for Host↔Host and Host↔Local with drag & drop support. Accelerated SFTP →
• Persistent Sessions & Workspace Restore — Sessions survive disconnects via tmux/screen on the host, and the whole workspace (tabs, splits, running processes, scrollback) survives full app restarts. With cloud sync, live sessions are shared across your devices — open the same terminal on a second device and both stay live, mirrored in real time. Cross-device sessions →
• Split Panes — Split terminals as much as you want, broadcast inputs to all panes.
• Local Terminal — Bash, Zsh, Fish, PowerShell, WSL, Git Bash, CMD, and more.
• Plugin System — Install plugins from the official registry or point to your own custom repo.
• Container Management — Docker and Proxmox LXC. Browse containers, open terminals, and manage resources without leaving Voltius.
• Process Manager — View and kill processes on connected hosts.
• System Monitoring — Live CPU, memory, and disk stats from connected hosts.

Full feature list at docs.voltius.app (coming soon) · Pro · Teams · Business — see voltius.app/#pricing for paid plans.

📸 Screenshots

Command palette — jump to any host, session, or snippet	Folders & tags — organize your fleet at scale
Split panes — multiplex terminals, broadcast input to all	Dual-pane SFTP — drag & drop, local ↔ remote ↔ host
Team vaults & roles — share access, control permissions	Theme editor — window colors and the full terminal palette

📦 Install

Linux — apt & dnf/yum

One command adds the signed Voltius repository and installs the app:

curl -fsSL https://repo.voltius.app/setup.sh | sudo bash

After that, Voltius updates through your normal sudo apt upgrade / sudo dnf upgrade. Packages are GPG-signed and provided for both amd64/x86_64 and arm64/aarch64.

curl -fsSL https://repo.voltius.app/voltius.gpg | sudo gpg --dearmor -o /usr/share/keyrings/voltius.gpg
echo "deb [signed-by=/usr/share/keyrings/voltius.gpg] https://repo.voltius.app/deb stable main" | sudo tee /etc/apt/sources.list.d/voltius.list
sudo apt update && sudo apt install voltius

sudo rpm --import https://repo.voltius.app/voltius.gpg
sudo curl -fsSL https://repo.voltius.app/voltius.repo -o /etc/yum.repos.d/voltius.repo
sudo dnf install voltius

macOS — Homebrew

brew install --cask voltiusapp/voltius/voltius

Voltius is ad-hoc signed but not yet notarized (no Apple Developer account yet). If macOS Gatekeeper blocks the first launch, right-click the app and choose Open, or install with --no-quarantine:

brew install --cask --no-quarantine voltiusapp/voltius/voltius

If you download the .dmg directly and macOS says "Voltius.app is damaged and cannot be opened", the download was quarantined — clear the flag and launch again:

xattr -cr /Applications/Voltius.app

Windows — winget

winget install --id Voltius.Voltius -e

Windows SmartScreen may warn that the publisher is unverified (the app is not yet code-signed) — choose More info → Run anyway.

Other downloads

Direct installers (.dmg, .msi, .exe, .AppImage) are on voltius.app/download. Voltius updates itself in-app on macOS and Windows after installation.

⚖️ Comparison (WIP)

🛡️ Architecture & Security

Voltius is built on a Local-First, Zero-Knowledge architecture. Your sensitive data (private keys, passwords, and server metadata) is encrypted on your machine before it ever touches a disk or a network.

Account & Encryption Tiers

We offer three levels of security to fit your workflow:

• OS Keychain (Local-Only): Uses your system's native secure storage (macOS Keychain, Windows Credential Manager, or Secret Service via keytar/libsecret). No master password required; maximum convenience for local-only use.

• Master Password: Encrypts your vault using a user-defined passphrase. Uses Argon2id for key derivation and XChaCha20-Poly1305 for data encryption.

• Cloud Account: Enables seamless E2EE synchronization across devices via our high-speed relay service.

Web Portal

Account registration and login at app.voltius.app are also fully E2EE. The same voltius-crypto crate is compiled to WebAssembly and runs entirely in your browser — key derivation (Argon2id + HKDF-SHA256) happens client-side before anything touches the network. The server only ever receives an auth_key, never your password or encryption key.

Zero-Knowledge Synchronization

Whether you use our professional Cloud Sync or our built-in Gist Plugin, we follow a Zero-Knowledge protocol. All data leaving the device is strictly ciphertext — the auth server, SSE server, and GitHub have zero knowledge of vault contents.

flowchart TD
    classDef cleartext fill:#ffebee,stroke:#c62828,stroke-width:2px,color:#000;
    classDef secure fill:#e8f5e9,stroke:#2e7d32,stroke-width:2px,color:#000;
    classDef local fill:#fff3e0,stroke:#e65100,stroke-width:2px,color:#000;
    classDef remote fill:#e3f2fd,stroke:#1565c0,stroke-width:2px,color:#000;
    classDef wasm fill:#f3e5f5,stroke:#6a1b9a,stroke-width:2px,color:#000;
    classDef note fill:#f9f9f9,stroke:#666,stroke-width:1px,stroke-dasharray: 5 5,color:#333;

    subgraph RegLayer ["0. Account Creation (one-time)"]
        direction LR

        subgraph PortalReg ["Web Portal — app.voltius.app"]
            PortalCreds["Email + Password"]:::cleartext
            WasmKDF["voltius-crypto-wasm\n(Argon2id + HKDF-SHA256\nsame crate · WASM target)"]:::wasm
            AuthKeyPortal(("auth_key")):::secure
            PortalCreds -->|"password + generated account_id"| WasmKDF
            WasmKDF -->|"enc_key discarded\n(no vault in portal)"| WasmKDF
            WasmKDF --> AuthKeyPortal
        end

        subgraph DesktopReg ["Desktop Client (Tauri)"]
            DesktopCreds["Email + Password"]:::cleartext
            NativeKDF["voltius-crypto · native Rust\n(Argon2id + HKDF-SHA256)"]:::secure
            AuthKeyDesktop(("auth_key")):::secure
            DesktopCreds -->|"password + generated account_id"| NativeKDF
            NativeKDF -->|"enc_key → vault unlock\n(proceeds to step 1)"| NativeKDF
            NativeKDF --> AuthKeyDesktop
        end

        RegServer[("Auth Server")]:::remote
        AuthKeyPortal -->|"email + auth_key + account_id"| RegServer
        AuthKeyDesktop -->|"email + auth_key + account_id\n+ public_key + machine_fingerprint"| RegServer
        RegServer -->|"JWT + account_id"| PortalCreds
        RegServer -->|"JWT + account_id"| DesktopCreds
    end

    subgraph AuthLayer ["1. Vault Unlock (Tauri Desktop — voltius-crypto · native Rust)"]
        direction TB
        subgraph Methods ["Vault Unlock Methods"]
            direction LR
            OS["OS Keychain"]:::local
            MP["Master Password"]:::local
            Cloud["Cloud Account\n(Email & Password)"]:::remote
        end

        KDF["Argon2id + HKDF-SHA256\n(128 MB mem · 3 iters · p=4)"]:::secure
        EncKey(("enc_key\n(XChaCha20-Poly1305 key)")):::secure
        AuthKey(("auth_key\n→ server login")):::secure

        Cloud -->|"password + account_id"| KDF
        MP -->|"password + account_id"| KDF
        OS -->|"retrieves enc_key directly\n(stored after prior login)"| EncKey
        KDF --> EncKey
        KDF --> AuthKey
        AuthKey -->|"POST /v1/auth/login"| AuthServer[("Auth Server")]:::remote
        AuthServer -->|"JWT"| Cloud
    end

    RegLayer -.->|"account created — use same\ncredentials in desktop Cloud Account"| Cloud

    subgraph VaultLayer ["2. Local Vault (Rust · chacha20poly1305 crate)"]
        XChaCha{"XChaCha20-Poly1305\n(Rust, via Tauri IPC)"}:::secure
        LocalStore[("secrets.enc\n(disk)")]:::local
        XChaCha <==>|"encrypt / decrypt"| LocalStore
    end

    EncKey -->|"enc_key passed over Tauri IPC"| XChaCha

    subgraph SyncLayer ["3. Zero-Knowledge Remote Sync"]
        direction LR

        subgraph GistSync ["Gist Sync (free · polling)"]
            direction TB
            GistKDF["derive_gist_key (Tauri cmd)\nArgon2id + HKDF-SHA256\npassphrase/PAT + manifest salt"]:::secure
            GistAead{"XChaCha20-Poly1305\n(Rust)"}:::secure
            Gist[("GitHub Gists\n(Bring-Your-Own)")]:::remote
            GistKDF -->|"gist_enc_key"| GistAead
            GistAead <==>|"Encrypted app-state blobs"| Gist
        end

        subgraph CloudSync ["Cloud Sync (Pro/Teams · SSE)"]
            direction TB
            SseAead{"XChaCha20-Poly1305\n(Rust · encrypt_payload)"}:::secure
            SSE[("Voltius SSE Server")]:::remote
            SseAead <==>|"Encrypted CRDT payloads"| SSE
        end
    end

    EncKey -->|"enc_key"| SseAead

    Note1>All data leaving the device is strictly ciphertext.\nAuth Server, SSE Server, and GitHub have zero knowledge of vault contents.]:::note
    SyncLayer --- Note1

Prerequisites

• Node.js 24+
• pnpm — npm i -g pnpm
• Rust (stable toolchain)
• Tauri prerequisites for your platform — see tauri.app/start/prerequisites

🛠️ Development & Build

Early beta — PRs and issues are welcome. See CONTRIBUTING.md to get started.

For dev, you simply need to run:

pnpm i
pnpm tauri dev

Building in Docker (recommended)

I've made a Dockerfile that allows cross-compilation to Windows ARM64/x64; Linux ARM64/x64 without needing to set up a complex toolchain on your machine:

# Build the cross-compilation image
docker build -f Dockerfile.cross-compile -t voltius-cross .

# Run the build inside the container
docker run --rm -it \
  -v "$(pwd):/project" \
  voltius-cross \
  bash -c 'pnpm tauri build --target aarch64-pc-windows-msvc --runner cargo-xwin --no-bundle'

Build artifacts are automatically handed back to your host user on exit, so nothing under the mounted project is left root-owned.

The --no-bundle flag skips NSIS installer creation (not supported in cross-compilation). The built executable is at:

target/aarch64-pc-windows-msvc/release/voltius.exe

You can replace aarch64-pc-windows-msvc with the appropriate target. Here's a quick reference for targets:

• Windows x64: x86_64-pc-windows-msvc
• Windows ARM64: aarch64-pc-windows-msvc
• Linux x64: x86_64-unknown-linux-gnu
• Linux ARM64: aarch64-unknown-linux-gnu

If you want to build for other target, see rustup target list and add with rustup target add <target>. I have not tested other targets.

Note: build will work but throw an error except if you set TAURI_SIGNING_PRIVATE_KEY and TAURI_SIGNING_KEY_PASSWORD to dummy values, which is required by the Tauri build process even if you don't do code signing in cross-compilation. You can set them to any non-empty value to bypass the error.

🐧WSL2 dev note

sudo apt install -y build-essential libssl-dev pkg-config libgtk-3-dev libwebkit2gtk-4.1-dev libsecret-1-dev
LIBGL_ALWAYS_SOFTWARE=1 && pnpm tauri dev

Build

pnpm tauri build

Output installers are placed in target/release/bundle/.

🧰 Tech Stack

📄 Licensing

Voltius is licensed under the AGPLv3 for the core application and MIT for plugins. This means you can use and modify the core app for free, but if you distribute a modified version, you must also share your changes under the same license. Plugins can be used and shared with more flexibility under the MIT license. Copyright © 2026 Killian Pavy. All rights reserved.