bawkterm: an open-source SSH/sFTP client

Product Introduction

1. Definition: bawkterm is a free and open-source, cross-platform desktop application that functions as a unified remote access client. Its technical category is a secure shell (SSH) and file transfer protocol (SFTP) client with integrated Docker management and Remote Desktop Protocol (RDP) capabilities.
2. Core Value Proposition: bawkterm exists to consolidate multiple remote administration tools into a single, secure, and user-friendly desktop client. It solves the problem of context switching between disparate terminal emulators, SFTP file managers, and remote desktop applications by providing an all-in-one solution for system administrators, DevOps engineers, and developers. Its primary value is a unified, encrypted vault for managing all remote connections and credentials across Windows, macOS, and Linux platforms.

Main Features

1. Unified Encrypted Vault: All sensitive data—including SSH host configurations, passwords, private keys, identities, and snippets—is stored in a single file encrypted with AES-256-GCM. The master password is never stored; it is processed through the scrypt key derivation function (N=2^17, r=8, p=1) to wrap a random 256-bit vault key. Additional unlock methods like Windows Hello, passkeys (WebAuthn PRF), and platform-specific keyrings (Windows DPAPI, macOS Keychain, Linux Secret Service) provide secure, convenient access.
2. Multi-Protocol Terminal & File Management: The client features a WebGL-rendered SSH terminal with tab support, jump host chaining, and support for multiple authentication methods (agent, keyboard-interactive, key-based). Its integrated SFTP client offers a dual-pane interface for local and remote file management with recursive transfer options, drag-and-drop, and folder favoriting. It uses the established ssh2 library for robust protocol implementation.
3. Extended Remote Management Capabilities: bawkterm extends beyond basic SSH by integrating Docker management over SSH, allowing users to view, start, stop, and access logs for containers grouped by Compose project. It also launches Remote Desktop sessions (using Windows mstsc or FreeRDP 3 on macOS/Linux) directly, optionally tunneling through an SSH jump host for secure access to graphical desktops.
4. Built-in Code Editor & Snippets: Remote files can be opened in a built-in editor tab with syntax highlighting for approximately 100 programming languages. Users can also configure external editors like VS Code. The snippets feature allows saving and quickly executing frequently used commands via a keyboard shortcut (Ctrl+Shift+S), streamlining repetitive administrative tasks.

Problems Solved

1. Pain Point: Fragmented remote access workflows requiring separate, often unsecured, tools for terminal access, file transfer, container management, and GUI desktop control.
2. Target Audience: System Administrators, DevOps Engineers, Software Developers, Site Reliability Engineers (SREs), and IT professionals who regularly manage Linux servers, cloud instances, Docker containers, and Windows servers remotely.
3. Use Cases: Securely managing a fleet of cloud servers via SSH and SFTP; developing and debugging applications within remote Docker containers; performing secure, audited file transfers between local and production environments; accessing internal graphical desktops (e.g., Windows servers) through a secure SSH tunnel; maintaining a centralized, encrypted database of all server credentials and connection details.

Unique Advantages

1. Differentiation: Unlike basic terminal emulators like PuTTY or standalone SFTP clients, bawkterm combines these core functions with Docker and RDP management. Compared to ecosystem-specific tools (e.g., Docker Desktop's remote context), it is platform-agnostic and centered on SSH as the primary secure transport. It differs from other Electron-based terminals by offering a deeply integrated, security-first vault and a wider range of remote management protocols in one package.
2. Key Innovation: Its security architecture is a key innovation. The application strictly separates the main process (holding decrypted secrets) from the renderer process (sandboxed UI), employs a robust challenge-response model for additional unlock methods (Windows Hello, passkeys), and implements atomic, encrypted writes with backups. The optional, self-hosted end-to-end encrypted sync via bawksync provides a unique private cloud synchronization solution not commonly found in desktop SSH clients.

Frequently Asked Questions (FAQ)

1. Is bawkterm safe to use for storing SSH keys and passwords? Yes, bawkterm employs a strong security model where all credentials are encrypted locally using AES-256-GCM before any network transmission or disk storage. The master password is never stored; it derives a key to encrypt a random vault key. The sandboxed Electron renderer process cannot directly access decrypted secrets.
2. How does bawkterm compare to Termius or Tabby? bawkterm differentiates itself with its integrated, secure credential vault, built-in Docker-over-SSH management, and direct Remote Desktop launching. While Termius and Tabby are excellent terminal emulators, bawkterm positions itself as a more comprehensive "remote access suite" with a stronger focus on consolidating workflows and offering optional, private end-to-end encrypted sync via a self-hosted server.
3. Can I use bawkterm to sync my connections between multiple computers? Yes, but not through a public cloud service. bawkterm supports synchronization through bawksync, a separate, self-hosted server application. This allows you to sync your encrypted vault between your own devices while maintaining full end-to-end encryption, giving you control over your data.
4. Does the SFTP client support recursive folder transfers and synchronization? Yes, the bawkterm SFTP client supports recursive file and folder transfers. During transfers, it provides conflict resolution options such as Replace, Keep Both, or Skip, which is essential for reliable file management between local and remote systems.
5. What are the system requirements for running bawkterm? bawkterm runs on Windows (7+), macOS (Intel & Apple Silicon), and Linux (x86_64). It requires FreeRDP 3 for Remote Desktop functionality on macOS and Linux. For Linux AppImages on Ubuntu 24.04+, additional AppArmor configuration is recommended for full sandboxing.