Security

Secrets

Passwords and key passphrases live in your operating system's credential store: Keychain on macOS, Credential Manager on Windows. Where no system store exists, the app keeps its own age-encrypted file.

Inventory

Hosts and folders are YAML files on disk. They're plain text: read them, edit them in any editor, keep it under version control. No secrets are stored in those files.

Connections

SSH verifies the host key and maintains its own known_hosts. When a key changes, the app shows a separate warning dialog instead of silently accepting it. With ProxyJump, hosts can be reached only through a bastion.

What the app doesn't do

• It has no accounts and syncs nothing over the network.
• It doesn't encrypt VNC itself. The protocol has no encryption, so run the connection through an SSH tunnel.
• It doesn't carry saved passwords over when you import from other managers.