Storing Credentials

Adding a credential to the vault

When creating or editing a connection:

1. Set Auth method to Vault secret.
2. A password input appears — enter the SSH password or passphrase.
3. Save the connection.

Ternux encrypts the credential and stores it alongside the connection entry in config.yaml. The plain-text password is discarded from memory once encrypted.

Using a vault credential

When you connect to a host whose auth method is Vault secret, Ternux automatically:

1. Unlocks the vault (prompts for vault password if not already unlocked).
2. Decrypts the stored credential.
3. Passes the credential to the SSH auth exchange.
4. Discards the plain-text credential from memory.

You never see the password again — Ternux handles the entire flow.

Editing a stored credential

Open the Edit Connection dialog → change the password field → Save. The old encrypted value is replaced with the new one.

Removing a credential from the vault

Set the connection's auth method to Password (plain) or SSH Key. The vault entry is cleared automatically on save.

Vault security model