A cross-platform credential manager and terminal. Your hosts, keys, and passwords live in one encrypted vault on your machine - never on a server, never in plaintext.
A full terminal, file transfer, tunnels, and a credential vault - in a single native binary.
Minimising sends Kino to the notification area instead of the taskbar, and closing the window leaves it running. When a host that was up goes down you get a desktop notification - add an ntfy topic and the alert reaches your phone.
Pulls the shell history of the account you connect as into an encrypted archive per host. It accumulates - the commands HISTSIZE has already trimmed off the server survive here. Never part of an exported profile.
Recovery codes, licence keys and API tokens, kept beside the vault under the same master password and synced with it. Bodies stay blurred until you click to reveal.
Processes group under their parents and branches fold; filtering keeps a match's ancestors so a hit never floats without the chain that spawned it. Signal any of them with SIGTERM, SIGINT, SIGHUP, SIGSTOP, SIGCONT or SIGKILL.
Reads the host's crontab and writes every schedule out in plain English - "At 04:00 on Tuesday" - with the next times each job will fire, in the host's clock. Only the lines you change are rewritten, so comments and PATH= survive untouched.
Checks every stored key for weak algorithms, reuse across hosts and age - entirely on your machine. One click rotates a host to a fresh ed25519 key: install, prove it authenticates on a second connection, then remove the old one.
Select terminal output and get a PNG with its colours, bold and highlighting intact, captioned with the host and time. The buffer cells are re-rendered rather than screenshotted, so it's sharp and trimmed to the content.
Argon2 key derivation and AES-256-GCM. One master password unlocks every host, key, and snippet.
A full xterm.js terminal per host, with split panes, broadcast input, adjustable font size, and scrollback configurable up to 200,000 lines.
Password and/or SSH key per host. Import .pem, .key, .ppk - or generate ed25519 keypairs on the spot.
Local (-L), remote (-R) and dynamic SOCKS5 (-D) tunnels, started and stopped per session - each drawn as a diagram showing which end opens the port and which way traffic flows.
Browse, upload and download with progress, rename, delete, mkdir, and chmod - built in.
A reusable command library. Selected snippets auto-run on connect, configurable per host.
Sync the encrypted vault to a private GitHub repo, with sha-based conflict detection.
Timestamps, severities, IP addresses, URLs and file paths are coloured from the active theme, in the spirit of MobaXterm. Never inside vim, htop or less, and never over output the host already coloured.
Search reports how many matches there are and which one you're on, highlights every hit, and marks them on the scrollbar. Case-sensitive, whole-word and regular-expression toggles.
Six bundled monospace faces for the terminal, an optional background override, and a choice of interface font including Atkinson Hyperlegible. A reduced-motion switch stops all animation and drops the decorative paint.
TOFU SHA256 fingerprint store. Trust on first use, then refuse on any mismatch.
Idle auto-lock, host search, per-host accent colors, 15 themes, split-pane naming, connection history, and session logging.
Open a remote file from the SFTP browser and edit it in a built-in Monaco editor, saving straight back over SFTP - no download round trip.
Record any SSH or local session to an asciicast file, then replay it in-app with a built-in player - great for audits and demos.
List and control containers, images, volumes and networks over the SSH connection - with live log streaming and one-click container shells.
Optionally reach hosts with no inbound port - behind NAT, CGNAT or a firewall - through a relay. The agent dials out; nothing is exposed. Use Kino Cloud's relays or run your own. Off by default.
Export a host as a password-encrypted file (Argon2 + AES-256-GCM). Share it safely - the recipient needs only the password to import it.
A streaming dashboard - CPU, memory, disk, load average, uptime and network throughput - sampled once a second, for remote hosts and your own machine.
Reach private hosts through a bastion, just like ssh -J. Pick any saved host as the jump; kino tunnels the session over it. Every hop's host key is verified independently, and bastions can chain.
An opt-in, bring-your-own-key assistant in the terminal, powered by OpenRouter. Ask about a host, explain an error, or select output and send it straight to the copilot. Your key stays encrypted in the vault.
Rebind the command palette, terminal find, copy, paste and font shortcuts to whatever fits your muscle memory - with live conflict detection and per-action reset.
Optionally remember your open tabs and pane layout and rebuild them on unlock, reconnecting each host into its original pane - pick up right where you left off.
Pin the hosts you use most to a home panel of one-click connect cards, shown whenever a pane is empty. Star a host in the sidebar to add it.
An optional background probe shows a live reachability dot and round-trip latency next to each host, so you can see what's up before you connect. Off by default.
Install a new release from inside the app - the signed package downloads and applies in place, then offers a relaunch. Every update is verified against a bundled public key.
Agent mode with no infrastructure to run. Paste an account key once, add a machine, run the one-line installer it prints - then connect. Relays, tokens and rotation are handled for you, and the vault stores only the machine's id.
Self-hosting? Point a host at kino-control instead of a fixed relay and the app asks where the agent is parked at connect time. Your saved relay URL stays as a fallback, so a control-plane outage degrades instead of locking you out.
A Rust backend behind a React interface, packaged as a lightweight Tauri 2 desktop app.
Free and open source under the GPL-3.0 license. Download a build, or compile it yourself in minutes.