Vault
Vault Overview
AES-256-GCM encrypted storage for SSH passwords and sensitive credentials.
The Vault is an encrypted credential store built into Ternux. It protects SSH passwords, passphrases, and other secrets using AES-256-GCM encryption — the same standard used by password managers.
How it works
- You set a vault password the first time you use the Vault.
- Ternux derives an encryption key from that password (using a key derivation function).
- Secrets are stored encrypted inside
config.yaml— no plain-text credentials are ever written to disk. - When Ternux starts (or when you open an SSH connection that needs a vault secret), it auto-unlocks the vault using a session key held in memory.
Setting up the Vault
- Open Settings → Vault.
- Click Set Vault Password.
- Enter and confirm a strong password.
- The vault is now active. Any connection using "Vault secret" as the auth method will be protected.
Locking and unlocking
The vault auto-unlocks at startup if a session key is cached. You can manually lock it from Settings → Vault → Lock Vault. Re-entering your vault password unlocks it.
If you forget your vault password, there is no recovery. All secrets stored in the vault will be permanently inaccessible. Store your vault password safely.
Changing the vault password
Go to Settings → Vault → Change Password. You must enter the current password. All stored secrets are re-encrypted with the new key automatically.