Voltius

A local-first SSH/SFTP/Serial client with E2EE sync, plugins, and no account required — a modern alternative to Termius.

---

✨ Features

No account required. Everything below is free, forever.

• Easy Import & Export — No vendor lock-in. Import your existing setup from Termius, MobaXterm, PuTTY/KiTTY, SecureCRT, ZOC Terminal or CSV — most in 1-click straight from the installed app. Your data is always exportable as open JSON, encrypted if you want.
• Local Network Sync — Your devices sync directly with each other, end-to-end encrypted, on the same Wi-Fi or LAN and over Tailscale or another VPN. On by default; without an account, pair two devices once by comparing a 6-digit code. No server in between, so devices sync while both are online (Android while the app is open). Team vaults are not included.
• My Devices — Browse and move files between your own devices from the SFTP host picker, over Wi-Fi, LAN or Tailscale. Needs a free Voltius account. A desktop shares only the folders you allow in Settings → Devices → File access (off by default); Android browses only.
• Gist Sync — E2EE device sync via your own private GitHub Gist. No central server, bring your own token.
• Cloudflare Sync — E2EE device sync through a Cloudflare Worker and R2 bucket you own, deployed from Settings. Same zero-knowledge model, storage you control.
• S3 Sync — E2EE device sync through any S3-compatible bucket you own — AWS, R2, B2, Wasabi, Hetzner, Scaleway, MinIO and more. No server to deploy.
• SFTP — Easy file transfers and browsing, works for Host↔Host and Host↔Local with drag & drop support. Accelerated SFTP →
• Persistent Sessions & Workspace Restore — Sessions survive disconnects via tmux/screen on the host, and the whole workspace (tabs, splits, running processes, scrollback) survives full app restarts. With cloud sync, live sessions are shared across your devices — open the same terminal on a second device and both stay live, mirrored in real time. Cross-device sessions →
• Split Panes — Split terminals as much as you want, broadcast inputs to all panes.
• Local Terminal — Bash, Zsh, Fish, PowerShell, WSL, Git Bash, CMD, and more.
• MCP Server — Let Claude Code, Claude Desktop, Cursor or VS Code drive your fleet: 94 tools covering hosts, keys, identities, sessions, panes, commands, files, transfers, port forwards, snippets, vaults, folders, team members, settings, the audit log and your plugins. Off by default, one toggle in Settings → Integrations, and it never leaves your machine. How it works → (written for 0.19.0, when the surface was 41 tools — the design and the security model still hold, the tool list has grown)
• Plugin System — Install plugins from the official registry or point to your own custom repo.
• Command Line & Machine Policy — voltius-cli sets up a machine from a terminal or Ansible: settings, plugins, server and sign-in. A machine policy file locks settings for everyone on that computer. On Mac, iPhone, iPad and Android, your MDM pushes the same policy and enrolment token. Docs →
• Container Management — Docker and Proxmox LXC. Browse containers, open terminals, and manage resources without leaving Voltius.
• Process Manager — View and kill processes on connected hosts.
• System Monitoring — Live CPU, memory, and disk stats from connected hosts.

Full feature list at docs.voltius.app · Pro · Teams · Business — see voltius.app/#pricing for paid plans.

📸 Screenshots

Command palette — jump to any host, session, or snippet	Folders & tags — organize your fleet at scale
Split panes — multiplex terminals, broadcast input to all	Dual-pane SFTP — drag & drop, local ↔ remote ↔ host
Team vaults & roles — share access, control permissions	Theme editor — window colors and the full terminal palette

📦 Install

Linux

One command installs the app on Debian/Ubuntu, Fedora/RHEL and Arch:

curl -fsSL https://repo.voltius.app/setup.sh | sudo bash

On Debian/Ubuntu and Fedora/RHEL it adds the signed Voltius repository, so updates arrive through your normal sudo apt upgrade / sudo dnf upgrade. Packages are GPG-signed and provided for both amd64/x86_64 and arm64/aarch64. On Arch it installs voltius-bin from the AUR with paru or yay.

Prebuilt Linux packages need glibc 2.39 or newer: Ubuntu 24.04+, Debian 13+, Fedora 40+, RHEL 10+ or another 2024-or-later distro. On older releases, use the Flatpak below or build from source.

Manual setup

Debian / Ubuntu

curl -fsSL https://repo.voltius.app/voltius.gpg | sudo gpg --dearmor -o /usr/share/keyrings/voltius.gpg
echo "deb [signed-by=/usr/share/keyrings/voltius.gpg] https://repo.voltius.app/deb stable main" | sudo tee /etc/apt/sources.list.d/voltius.list
sudo apt update && sudo apt install voltius

Fedora / RHEL

sudo rpm --import https://repo.voltius.app/voltius.gpg
sudo curl -fsSL https://repo.voltius.app/voltius.repo -o /etc/yum.repos.d/voltius.repo
sudo dnf install voltius

On older dnf, replace the curl line with sudo dnf config-manager --add-repo https://repo.voltius.app/voltius.repo.

Arch (AUR)

yay -S voltius-bin   # prebuilt binary, tracks releases

Community-maintained by ezhkov, not published by this repo's CI. voltius (builds from source) and voltius-git (latest main) are also available. If any of these are ever behind, a direct download is the maintained fallback.

Flatpak (FlatPark)

flatpak install https://dl.flatpark.org/app.voltius.Voltius.flatpakref

Community-maintained by jing2uo on FlatPark, not published by this repo's CI. It installs the official .deb unmodified and follows releases automatically. x86_64 only for now.

macOS — Homebrew

brew install --cask voltiusapp/voltius/voltius

Voltius is signed and notarized by Apple. After updating from an older version, macOS asks once for access to the keychain: choose Always Allow.

Windows — winget

winget install --id Voltius.Voltius -e

Windows SmartScreen may warn that the publisher is unverified (the app is not yet code-signed) — choose More info → Run anyway.

Android — Obtainium

Obtainium is the recommended way: it watches this repo's releases and installs each one as soon as it is published, the way a store would.

Tap that badge on the phone: it opens Obtainium with the source pre-filled, or offers to install Obtainium first. By hand: Add App → https://github.com/VoltiusApp/voltius.

Or get it from Google Play:

Voltius needs Android 7.0+ on an arm64-v8a phone (every current phone, but not x86_64 emulators or Chromebooks). The local terminal and serial console are desktop-only; remote SSH and SFTP are the point here. The GitHub APK and the Google Play build are signed with the same key, so one updates over the other. An APK from anywhere else, including one you built yourself, fails with INSTALL_FAILED_UPDATE_INCOMPATIBLE and has to be uninstalled first, taking its local data.

Obtainium notes

• Android asks you to allow Install unknown apps for Obtainium on the first install.
• Unauthenticated GitHub API calls are capped at 60/hour per IP address. If update checks start failing, add a personal access token in Obtainium under Settings → Source-specific → GitHub.
• Without Obtainium or Google Play: grab the Voltius_<version>_aarch64.apk asset from the latest release; updates are then manual.

iOS — App Store

iPhone, iOS 16+. Not available in France yet: the French encryption declaration is still under review.

Other downloads

Direct installers (.dmg, .msi, .exe, .AppImage) are on voltius.app/download. Voltius updates itself in-app on macOS and Windows after installation.

⚖️ Comparison

✅ yes · ❌ no · 🟡 partial or paid-tier · ? not tested · Checked against each project's source or official docs in November 2026

Feature	Voltius	Termius	Reach	Termix	Tabby
Engine	Rust + Tauri 🦀	Electron (closed-source)	Rust + Tauri 🦀	Web + Electron (React + Node.js)	Electron / Node.js
RAM Usage	~300MB	~500MB+	~300MB	?	?
Installed Size	~40MB	~1GB	~40MB	?	?
Sync	Local network + Gist + Cloudflare + S3 (Free) / Voltius Cloud (Pro)	🟡 Only Pro	🟡 Via Turso (own account)	✅ Through your self-hosted server	🟡 Tabby Web server (E2EE opt-in) or community plugins
Import/Export	✅ Import from Termius, MobaXterm, PuTTY/KiTTY, SecureCRT, ZOC, ~/.ssh/config (optional two-way sync), CSV; JSON/CSV Export	🟡 Import from ~/.ssh/config, CSV, PuTTY, MobaXterm, SecureCRT; no export	🟡 ~/.ssh/config import; own encrypted backup	🟡 ~/.ssh/config + JSON import; JSON export	🟡 ~/.ssh/config import only
Port Forwarding	✅	✅	🟡 Remote forwards only via ~/.ssh/config	✅	✅
SOCKS / HTTP proxy	✅	✅	✅	✅	✅
Port knocking	✅	❌ (dropped)	❌	✅	❌
Snippets	✅ + multi-exec	✅ + multi-exec (startup snippets Pro)	✅ (no multi-exec)	✅ + multi-exec	🟡 Broadcast built in, snippets via community plugin
Command Palette	✅	✅	✅	✅	✅
Split panes	✅	✅	✅	✅	✅
X11 Forwarding	❌	?	✅	❌	✅
MCP server (AI agents)	✅ Built in, 94 tools, off by default	?	✅	❌	🟡 (community plugin)
Docker Integration	✅	?	✅	✅	🟡 (community plugin)
Proxmox LXC Integration	✅	❌	❌	✅	❌
System Monitoring	✅	?	✅	✅	🟡 (community plugin)
Jump Hosts	✅	✅	✅	✅	✅
Team vaults	✅ Teams or self-hosted	✅ Teams plan	✅ Free, through your own Turso database	✅ Self-hosted, share with users or roles	❌
Audit logs	✅	🟡 Teams plan	❌	✅	❌
Custom Themes	✅	?	✅	✅	✅
Keyword highlighting	✅ Editable rules	✅	❌	🟡 Fixed categories	🟡 (community plugin)
Folders & Tags	✅	✅	✅	✅	🟡 Folders only
Auto-Updates	✅	🟡 Manual on desktop	✅	✅	✅
Modern UI/UX	✅	✅	🟡	✅	🟡
AI assistant	❌	✅	✅	✅ (plugin, bring your own model)	🟡 (community plugin)
Permissions	✅ Teams built-in roles / Business custom roles, per-member & per-object	🟡 Business: can edit / can view per vault	🟡 Roles not enforced	✅ Roles, per-host sharing levels	❌
Terminal sharing	✅ Pro (1 session · 1 guest) / Teams (5 · 10) / Business (20 · 50)	✅ Every plan	✅ Peer-to-peer	✅ (plugin)	🟡 (community plugin)
Security	End-to-End Encrypted	Proprietary E2EE	End-to-End Encrypted	Encrypted at rest, server holds the key	Local; optional encrypted vault
Account 2FA	✅ Authenticator app + passkeys, free	✅ Authenticator app; SAML SSO paid	— (no accounts)	✅ Authenticator app, passkeys, OIDC	— (no accounts)
App lock (biometrics)	✅ Desktop + Android	🟡 Mobile only	✅	🟡 Mobile only	🟡 Passphrase only
SFTP host<->host	✅	✅	❌	✅	❌
FTP & WebDAV	✅	❌	❌	❌	❌
Resumable transfers	✅ SFTP, FTP, WebDAV, Docker	?	❌	🟡 Host↔host only	❌
Serial Console	✅	✅	✅	✅	✅
Persistent sessions	✅ uses tmux/screen, default behavior	🟡 (via Mosh, must be installed on the host; not built-in)	❌	✅ Kept on the server, optional tmux	🟡 (community plugin)
Cross-device live resume	✅ Seamless pickup	❌	❌	✅ Sessions run on the server	❌
Local-first	✅	✅	✅	✅	✅
Plugins	✅	❌	✅	✅	✅
Platforms	Windows, Linux, MacOS, Android, IOS	Windows, Linux, MacOS, Android, IOS	Windows, Linux, MacOS, Android	Web, Windows, Linux, MacOS, Android, IOS	Windows, Linux, MacOS, Web
Languages	7	English only	9	42	24
License	AGPLv3	Commercial / Paid	MIT	Apache 2.0	MIT
OS Detection	✅	✅	✅	🟡 Text only, in metrics	❌

🛡️ Architecture & Security

Voltius is built on a Local-First, Zero-Knowledge architecture. Your sensitive data (private keys, passwords, and server metadata) is encrypted on your machine before it ever touches a disk or a network.

Account & Encryption Tiers

We offer three levels of security to fit your workflow:

• OS Keychain (No Account): Uses your system's native secure storage (macOS Keychain, Windows Credential Manager, or Secret Service via keytar/libsecret). No master password required. Devices on the same network can still be paired by comparing a 6-digit code, then sync directly.

• Master Password: Encrypts your vault using a user-defined passphrase. Uses Argon2id for key derivation and XChaCha20-Poly1305 for data encryption. By default Voltius remembers the password in the OS keychain so the vault opens at launch without asking; on Linux and Windows, other programs running as you can read it there. Turn off Remember master password in Settings › Account to be asked at every launch.

• Voltius Account: A free account pairs your devices automatically for local network sync and enables My Devices file transfer. Voltius Cloud (Pro) adds E2EE sync through the Voltius server, so your devices stay in sync even when they are never online together, plus an encrypted backup.

Web Portal

Account registration and login at app.voltius.app are also fully E2EE. The same voltius-crypto crate is compiled to WebAssembly and runs entirely in your browser — key derivation (Argon2id + HKDF-SHA256) happens client-side before anything touches the network. The server only ever receives an auth_key, never your password or encryption key.

Zero-Knowledge Synchronization

Whether your devices sync through Voltius Cloud, directly over the local network, or through a bring-your-own sync plugin (Gist, Cloudflare, S3), we follow a Zero-Knowledge protocol. All data leaving the device is strictly ciphertext — the Voltius server (one service handling both auth and sync), GitHub, Cloudflare and your storage provider have zero knowledge of vault contents.

Local network sync never goes through a server. Devices find each other over mDNS (_voltius._tcp) or at remembered and Tailscale/VPN addresses, then open a Noise_NN_25519_ChaChaPoly_BLAKE2s channel. Inside it, each side proves it holds the vault key (an HMAC-SHA256 over the handshake hash, keyed by HKDF from the vault key, or from the group secret agreed during 6-digit code pairing) and signs the handshake with its Ed25519 device key, which the other side pins. Only then do they exchange the same XChaCha20-Poly1305 blob the cloud would store. Team vaults are not included; they sync through the server only.

Sync architecture diagram

flowchart TD
    classDef cleartext fill:#ffebee,stroke:#c62828,stroke-width:2px,color:#000;
    classDef secure fill:#e8f5e9,stroke:#2e7d32,stroke-width:2px,color:#000;
    classDef local fill:#fff3e0,stroke:#e65100,stroke-width:2px,color:#000;
    classDef remote fill:#e3f2fd,stroke:#1565c0,stroke-width:2px,color:#000;
    classDef wasm fill:#f3e5f5,stroke:#6a1b9a,stroke-width:2px,color:#000;
    classDef note fill:#f9f9f9,stroke:#666,stroke-width:1px,stroke-dasharray: 5 5,color:#333;

    subgraph RegLayer ["0. Account Creation (one-time)"]
        direction LR

        subgraph PortalReg ["Web Portal — app.voltius.app"]
            PortalCreds["Email + Password"]:::cleartext
            WasmKDF["voltius-crypto-wasm\n(Argon2id + HKDF-SHA256\nsame crate · WASM target)"]:::wasm
            AuthKeyPortal(("auth_key")):::secure
            PortalCreds -->|"password + generated account_id"| WasmKDF
            WasmKDF -->|"enc_key discarded\n(no vault in portal)"| WasmKDF
            WasmKDF --> AuthKeyPortal
        end

        subgraph DesktopReg ["Desktop Client (Tauri)"]
            DesktopCreds["Email + Password"]:::cleartext
            NativeKDF["voltius-crypto · native Rust\n(Argon2id + HKDF-SHA256)"]:::secure
            AuthKeyDesktop(("auth_key")):::secure
            DesktopCreds -->|"password + generated account_id"| NativeKDF
            NativeKDF -->|"enc_key → vault unlock\n(proceeds to step 1)"| NativeKDF
            NativeKDF --> AuthKeyDesktop
        end

        RegServer[("Voltius Server\napi.voltius.app")]:::remote
        AuthKeyPortal -->|"email + auth_key + account_id"| RegServer
        AuthKeyDesktop -->|"email + auth_key + account_id\n+ public_key + machine_fingerprint"| RegServer
        RegServer -->|"JWT + account_id"| PortalCreds
        RegServer -->|"JWT + account_id"| DesktopCreds
    end

    subgraph AuthLayer ["1. Vault Unlock (Tauri Desktop — voltius-crypto · native Rust)"]
        direction TB
        subgraph Methods ["Vault Unlock Methods"]
            direction LR
            OS["OS Keychain"]:::local
            MP["Master Password"]:::local
            Cloud["Cloud Account\n(Email & Password)"]:::remote
        end

        KDF["Argon2id + HKDF-SHA256\n(128 MB mem · 3 iters · p=4)"]:::secure
        EncKey(("enc_key\n(XChaCha20-Poly1305 key)")):::secure
        AuthKey(("auth_key\n→ server login")):::secure

        Cloud -->|"password + account_id"| KDF
        MP -->|"password + account_id"| KDF
        OS -->|"retrieves enc_key directly\n(stored after prior login)"| EncKey
        KDF --> EncKey
        KDF --> AuthKey
        AuthKey -->|"POST /v1/auth/login"| AuthServer[("Voltius Server\napi.voltius.app")]:::remote
        AuthServer -->|"JWT"| Cloud
    end

    RegLayer -.->|"account created — use same\ncredentials in desktop Cloud Account"| Cloud

    subgraph VaultLayer ["2. Local Vault (Rust · chacha20poly1305 crate)"]
        XChaCha{"XChaCha20-Poly1305\n(Rust, via Tauri IPC)"}:::secure
        LocalStore[("secrets.enc\n(disk)")]:::local
        XChaCha <==>|"encrypt / decrypt"| LocalStore
    end

    EncKey -->|"enc_key passed over Tauri IPC"| XChaCha

    subgraph SyncLayer ["3. Zero-Knowledge Remote Sync"]
        direction LR

        subgraph GistSync ["Gist Sync (free · polling)"]
            direction TB
            GistKDF["derive_gist_key (Tauri cmd)\nArgon2id + HKDF-SHA256\npassphrase/PAT + manifest salt"]:::secure
            GistAead{"XChaCha20-Poly1305\n(Rust)"}:::secure
            Gist[("GitHub Gists\n(Bring-Your-Own)")]:::remote
            GistKDF -->|"gist_enc_key"| GistAead
            GistAead <==>|"Encrypted app-state blobs"| Gist
        end

        subgraph CloudSync ["Voltius Cloud (Pro/Teams · SSE)"]
            direction TB
            SseAead{"XChaCha20-Poly1305\n(Rust · encrypt_payload)"}:::secure
            SSE[("Voltius Server\napi.voltius.app · SSE")]:::remote
            SseAead <==>|"Encrypted CRDT payloads"| SSE
        end

        subgraph LanSync ["Local Network Sync (free · personal vault only)"]
            direction TB
            Discover["mDNS _voltius._tcp\n+ remembered / Tailscale addresses"]:::local
            Noise{"Noise_NN_25519_ChaChaPoly_BLAKE2s\n+ HMAC-SHA256 vault-key proof\n+ pinned Ed25519 device key"}:::secure
            Peer[("Your other device\n(no server)")]:::local
            Discover --> Noise
            Noise <==>|"Same encrypted blob"| Peer
        end
    end

    EncKey -->|"enc_key"| SseAead
    EncKey -->|"enc_key"| Noise

    Note1>All data leaving the device is strictly ciphertext.\nAuth and sync are one server — it and GitHub have zero knowledge of vault contents.\nLocal network sync talks to your own devices only.]:::note
    SyncLayer --- Note1

Loading

Prerequisites

• Node.js 24+
• pnpm — npm i -g pnpm
• Rust (stable toolchain)
• Tauri prerequisites for your platform — see tauri.app/start/prerequisites

🛠️ Development & Build

Early beta — PRs and issues are welcome. See CONTRIBUTING.md to get started.

For dev, you simply need to run:

pnpm i
pnpm tauri dev

Building in Docker (recommended)

I've made a Dockerfile that allows cross-compilation to Windows ARM64/x64; Linux ARM64/x64 without needing to set up a complex toolchain on your machine:

# Build the cross-compilation image
docker build -f Dockerfile.cross-compile -t voltius-cross .

# Run the build inside the container
docker run --rm -it \
  -v "$(pwd):/project" \
  voltius-cross \
  bash -c 'pnpm tauri build --target aarch64-pc-windows-msvc --runner cargo-xwin --no-bundle'

Build artifacts are automatically handed back to your host user on exit, so nothing under the mounted project is left root-owned.

The --no-bundle flag skips NSIS installer creation (not supported in cross-compilation). The built executable is at:

target/aarch64-pc-windows-msvc/release/voltius.exe

You can replace aarch64-pc-windows-msvc with the appropriate target. Here's a quick reference for targets:

• Windows x64: x86_64-pc-windows-msvc
• Windows ARM64: aarch64-pc-windows-msvc
• Linux x64: x86_64-unknown-linux-gnu
• Linux ARM64: aarch64-unknown-linux-gnu

If you want to build for other target, see rustup target list and add with rustup target add <target>. I have not tested other targets.

Note: build will work but throw an error except if you set TAURI_SIGNING_PRIVATE_KEY and TAURI_SIGNING_KEY_PASSWORD to dummy values, which is required by the Tauri build process even if you don't do code signing in cross-compilation. You can set them to any non-empty value to bypass the error.

🐧WSL2 dev note

sudo apt install -y build-essential libssl-dev pkg-config libgtk-3-dev libwebkit2gtk-4.1-dev libsecret-1-dev
LIBGL_ALWAYS_SOFTWARE=1 && pnpm tauri dev

Build

pnpm tauri build

Output installers are placed in target/release/bundle/.

🧰 Tech Stack

Layer	Tech
Frontend	React 19, TypeScript, Tailwind CSS
Desktop	Rust, Tauri 2
Sync Server	Rust, Axum, PostgreSQL
Terminal	xterm.js (WebGL Accelerated)
SSH/SFTP	russh
Security	Argon2id, HKDF-SHA256, XChaCha20-Poly1305 (E2EE)

📄 Licensing

Voltius is licensed under the AGPLv3 for the core application and MIT for plugins. This means you can use and modify the core app for free, but if you distribute a modified version, you must also share your changes under the same license. Plugins can be used and shared with more flexibility under the MIT license. Copyright © 2026 Killian Pavy. All rights reserved.