VoltiusApp/voltius

Voltius

A local-first SSH/SFTP/Serial client with E2EE sync, plugins, and no account required — a modern alternative to Termius.

No account required. Everything below is free, forever.

• Easy Import & Export — No vendor lock-in. Import your existing setup from Termius, MobaXterm, PuTTY/KiTTY, SecureCRT, ZOC Terminal or CSV — most in 1-click straight from the installed app. Your data is always exportable as open JSON, encrypted if you want.
• Gist Sync — E2EE device sync via your own private GitHub Gist. No central server, bring your own token.
• Cloudflare Sync — E2EE device sync through a Cloudflare Worker and R2 bucket you own, deployed from Settings. Same zero-knowledge model, storage you control.
• S3 Sync — E2EE device sync through any S3-compatible bucket you own — AWS, R2, B2, Wasabi, Hetzner, Scaleway, MinIO and more. No server to deploy.
• SFTP — Easy file transfers and browsing, works for Host↔Host and Host↔Local with drag & drop support. Accelerated SFTP →
• Persistent Sessions & Workspace Restore — Sessions survive disconnects via tmux/screen on the host, and the whole workspace (tabs, splits, running processes, scrollback) survives full app restarts. With cloud sync, live sessions are shared across your devices — open the same terminal on a second device and both stay live, mirrored in real time. Cross-device sessions →
• Split Panes — Split terminals as much as you want, broadcast inputs to all panes.
• Local Terminal — Bash, Zsh, Fish, PowerShell, WSL, Git Bash, CMD, and more.
• MCP Server — Let Claude Code, Claude Desktop, Cursor or VS Code drive your fleet: 52 tools covering hosts, keys, identities, sessions, commands, files, vaults, folders, the audit log and your installed plugins. Off by default, one toggle in Settings → Integrations, and it never leaves your machine. How it works → (written for 0.19.0, when the surface was 41 tools — the design and the security model still hold, the tool list has grown)
• Plugin System — Install plugins from the official registry or point to your own custom repo.
• Container Management — Docker and Proxmox LXC. Browse containers, open terminals, and manage resources without leaving Voltius.
• Process Manager — View and kill processes on connected hosts.
• System Monitoring — Live CPU, memory, and disk stats from connected hosts.

Full feature list at docs.voltius.app · Pro · Teams · Business — see voltius.app/#pricing for paid plans.

Command palette — jump to any host, session, or snippet	Folders & tags — organize your fleet at scale
Split panes — multiplex terminals, broadcast input to all	Dual-pane SFTP — drag & drop, local ↔ remote ↔ host
Team vaults & roles — share access, control permissions	Theme editor — window colors and the full terminal palette

One command installs the app on Debian/Ubuntu, Fedora/RHEL and Arch:

curl -fsSL https://repo.voltius.app/setup.sh | sudo bash

On Debian/Ubuntu and Fedora/RHEL it adds the signed Voltius repository, so updates arrive through your normal sudo apt upgrade / sudo dnf upgrade. Packages are GPG-signed and provided for both amd64/x86_64 and arm64/aarch64. On Arch it installs voltius-bin from the AUR with paru or yay.

Prebuilt Linux packages need glibc 2.39 or newer: Ubuntu 24.04+, Debian 13+, Fedora 40+, RHEL 10+ or another 2024-or-later distro. On older releases, use the Flatpak below or build from source.

curl -fsSL https://repo.voltius.app/voltius.gpg | sudo gpg --dearmor -o /usr/share/keyrings/voltius.gpg
echo "deb [signed-by=/usr/share/keyrings/voltius.gpg] https://repo.voltius.app/deb stable main" | sudo tee /etc/apt/sources.list.d/voltius.list
sudo apt update && sudo apt install voltius

sudo rpm --import https://repo.voltius.app/voltius.gpg
sudo curl -fsSL https://repo.voltius.app/voltius.repo -o /etc/yum.repos.d/voltius.repo
sudo dnf install voltius

yay -S voltius-bin   # prebuilt binary, tracks releases

flatpak install https://dl.flatpark.org/app.voltius.Voltius.flatpakref

brew install --cask voltiusapp/voltius/voltius

Voltius is signed with its own certificate but not notarized (no Apple Developer account yet). If macOS Gatekeeper blocks the first launch, right-click the app and choose Open. To clear the quarantine flag from an existing installation instead, run:

xattr -dr com.apple.quarantine /Applications/Voltius.app

If you download the .dmg directly and macOS says "Voltius.app is damaged and cannot be opened", the same command clears the quarantine flag after you copy Voltius to Applications.

winget install --id Voltius.Voltius -e

Windows SmartScreen may warn that the publisher is unverified (the app is not yet code-signed) — choose More info → Run anyway.

Android is an early preview: the APK is release-signed and installs cleanly, but platform-only features are gated off (no local terminal, no serial console — remote SSH is the point here). There is no Play Store listing. Obtainium watches this repo's releases and installs updates the way a store would.

Tap that badge on the phone — it opens Obtainium with the source pre-filled, or offers to install Obtainium first. By hand: Add App → https://github.com/VoltiusApp/voltius.

The APK is arm64-v8a only (every current phone, but not x86_64 emulators or Chromebooks) and needs Android 7.0+. Every release is signed with the same key, so updates install over the top; an APK from anywhere else — including one you built yourself — fails with INSTALL_FAILED_UPDATE_INCOMPATIBLE and has to be uninstalled first, taking its local data.

Direct installers (.dmg, .msi, .exe, .AppImage) are on voltius.app/download. Voltius updates itself in-app on macOS and Windows after installation.

✅ yes · ❌ no · 🟡 partial or paid-tier · ? not tested

Voltius is built on a Local-First, Zero-Knowledge architecture. Your sensitive data (private keys, passwords, and server metadata) is encrypted on your machine before it ever touches a disk or a network.

We offer three levels of security to fit your workflow:

• OS Keychain (Local-Only): Uses your system's native secure storage (macOS Keychain, Windows Credential Manager, or Secret Service via keytar/libsecret). No master password required; maximum convenience for local-only use.

• Master Password: Encrypts your vault using a user-defined passphrase. Uses Argon2id for key derivation and XChaCha20-Poly1305 for data encryption.

• Cloud Account: Enables seamless E2EE synchronization across devices via our high-speed relay service.

Account registration and login at app.voltius.app are also fully E2EE. The same voltius-crypto crate is compiled to WebAssembly and runs entirely in your browser — key derivation (Argon2id + HKDF-SHA256) happens client-side before anything touches the network. The server only ever receives an auth_key, never your password or encryption key.

Whether you use our professional Cloud Sync or a bring-your-own sync plugin (Gist, Cloudflare), we follow a Zero-Knowledge protocol. All data leaving the device is strictly ciphertext — the Voltius server (one service handling both auth and sync), GitHub and Cloudflare have zero knowledge of vault contents.

flowchart TD
    classDef cleartext fill:#ffebee,stroke:#c62828,stroke-width:2px,color:#000;
    classDef secure fill:#e8f5e9,stroke:#2e7d32,stroke-width:2px,color:#000;
    classDef local fill:#fff3e0,stroke:#e65100,stroke-width:2px,color:#000;
    classDef remote fill:#e3f2fd,stroke:#1565c0,stroke-width:2px,color:#000;
    classDef wasm fill:#f3e5f5,stroke:#6a1b9a,stroke-width:2px,color:#000;
    classDef note fill:#f9f9f9,stroke:#666,stroke-width:1px,stroke-dasharray: 5 5,color:#333;

    subgraph RegLayer ["0. Account Creation (one-time)"]
        direction LR

        subgraph PortalReg ["Web Portal — app.voltius.app"]
            PortalCreds["Email + Password"]:::cleartext
            WasmKDF["voltius-crypto-wasm\n(Argon2id + HKDF-SHA256\nsame crate · WASM target)"]:::wasm
            AuthKeyPortal(("auth_key")):::secure
            PortalCreds -->|"password + generated account_id"| WasmKDF
            WasmKDF -->|"enc_key discarded\n(no vault in portal)"| WasmKDF
            WasmKDF --> AuthKeyPortal
        end

        subgraph DesktopReg ["Desktop Client (Tauri)"]
            DesktopCreds["Email + Password"]:::cleartext
            NativeKDF["voltius-crypto · native Rust\n(Argon2id + HKDF-SHA256)"]:::secure
            AuthKeyDesktop(("auth_key")):::secure
            DesktopCreds -->|"password + generated account_id"| NativeKDF
            NativeKDF -->|"enc_key → vault unlock\n(proceeds to step 1)"| NativeKDF
            NativeKDF --> AuthKeyDesktop
        end

        RegServer[("Voltius Server\napi.voltius.app")]:::remote
        AuthKeyPortal -->|"email + auth_key + account_id"| RegServer
        AuthKeyDesktop -->|"email + auth_key + account_id\n+ public_key + machine_fingerprint"| RegServer
        RegServer -->|"JWT + account_id"| PortalCreds
        RegServer -->|"JWT + account_id"| DesktopCreds
    end

    subgraph AuthLayer ["1. Vault Unlock (Tauri Desktop — voltius-crypto · native Rust)"]
        direction TB
        subgraph Methods ["Vault Unlock Methods"]
            direction LR
            OS["OS Keychain"]:::local
            MP["Master Password"]:::local
            Cloud["Cloud Account\n(Email & Password)"]:::remote
        end

        KDF["Argon2id + HKDF-SHA256\n(128 MB mem · 3 iters · p=4)"]:::secure
        EncKey(("enc_key\n(XChaCha20-Poly1305 key)")):::secure
        AuthKey(("auth_key\n→ server login")):::secure

        Cloud -->|"password + account_id"| KDF
        MP -->|"password + account_id"| KDF
        OS -->|"retrieves enc_key directly\n(stored after prior login)"| EncKey
        KDF --> EncKey
        KDF --> AuthKey
        AuthKey -->|"POST /v1/auth/login"| AuthServer[("Voltius Server\napi.voltius.app")]:::remote
        AuthServer -->|"JWT"| Cloud
    end

    RegLayer -.->|"account created — use same\ncredentials in desktop Cloud Account"| Cloud

    subgraph VaultLayer ["2. Local Vault (Rust · chacha20poly1305 crate)"]
        XChaCha{"XChaCha20-Poly1305\n(Rust, via Tauri IPC)"}:::secure
        LocalStore[("secrets.enc\n(disk)")]:::local
        XChaCha <==>|"encrypt / decrypt"| LocalStore
    end

    EncKey -->|"enc_key passed over Tauri IPC"| XChaCha

    subgraph SyncLayer ["3. Zero-Knowledge Remote Sync"]
        direction LR

        subgraph GistSync ["Gist Sync (free · polling)"]
            direction TB
            GistKDF["derive_gist_key (Tauri cmd)\nArgon2id + HKDF-SHA256\npassphrase/PAT + manifest salt"]:::secure
            GistAead{"XChaCha20-Poly1305\n(Rust)"}:::secure
            Gist[("GitHub Gists\n(Bring-Your-Own)")]:::remote
            GistKDF -->|"gist_enc_key"| GistAead
            GistAead <==>|"Encrypted app-state blobs"| Gist
        end

        subgraph CloudSync ["Cloud Sync (Pro/Teams · SSE)"]
            direction TB
            SseAead{"XChaCha20-Poly1305\n(Rust · encrypt_payload)"}:::secure
            SSE[("Voltius Server\napi.voltius.app · SSE")]:::remote
            SseAead <==>|"Encrypted CRDT payloads"| SSE
        end
    end

    EncKey -->|"enc_key"| SseAead

    Note1>All data leaving the device is strictly ciphertext.\nAuth and sync are one server — it and GitHub have zero knowledge of vault contents.]:::note
    SyncLayer --- Note1

• Node.js 24+
• pnpm — npm i -g pnpm
• Rust (stable toolchain)
• Tauri prerequisites for your platform — see tauri.app/start/prerequisites

Early beta — PRs and issues are welcome. See CONTRIBUTING.md to get started.

For dev, you simply need to run:

pnpm i
pnpm tauri dev

I've made a Dockerfile that allows cross-compilation to Windows ARM64/x64; Linux ARM64/x64 without needing to set up a complex toolchain on your machine:

# Build the cross-compilation image
docker build -f Dockerfile.cross-compile -t voltius-cross .

# Run the build inside the container
docker run --rm -it \
  -v "$(pwd):/project" \
  voltius-cross \
  bash -c 'pnpm tauri build --target aarch64-pc-windows-msvc --runner cargo-xwin --no-bundle'

Build artifacts are automatically handed back to your host user on exit, so nothing under the mounted project is left root-owned.

The --no-bundle flag skips NSIS installer creation (not supported in cross-compilation). The built executable is at:

target/aarch64-pc-windows-msvc/release/voltius.exe

You can replace aarch64-pc-windows-msvc with the appropriate target. Here's a quick reference for targets:

• Windows x64: x86_64-pc-windows-msvc
• Windows ARM64: aarch64-pc-windows-msvc
• Linux x64: x86_64-unknown-linux-gnu
• Linux ARM64: aarch64-unknown-linux-gnu

If you want to build for other target, see rustup target list and add with rustup target add <target>. I have not tested other targets.

Note: build will work but throw an error except if you set TAURI_SIGNING_PRIVATE_KEY and TAURI_SIGNING_KEY_PASSWORD to dummy values, which is required by the Tauri build process even if you don't do code signing in cross-compilation. You can set them to any non-empty value to bypass the error.

sudo apt install -y build-essential libssl-dev pkg-config libgtk-3-dev libwebkit2gtk-4.1-dev libsecret-1-dev
LIBGL_ALWAYS_SOFTWARE=1 && pnpm tauri dev

pnpm tauri build

Output installers are placed in target/release/bundle/.

Voltius is licensed under the AGPLv3 for the core application and MIT for plugins. This means you can use and modify the core app for free, but if you distribute a modified version, you must also share your changes under the same license. Plugins can be used and shared with more flexibility under the MIT license. Copyright © 2026 Killian Pavy. All rights reserved.