Your fleet,
one terminal

An SSH manager that lives in your terminal. Hosts, keys and projects — synced across devices, shared with your team, and readable by no one but you.

$npm i -g wharf-tui
macOS · Linux · Windows · single binary, no root
wharf — deniz@wharf.sh
❯_ wharf1:hosts2:projects3:keys● synced
prod-api-01deploy@10.4.1.12:22online
db-primarypostgres@10.4.2.5:5522online
staging-webdeploy@staging.acme.io:22unknown
edge-lb-euw1root@edge-euw1.acme.io:22online
homelabdeniz@homelab.local:22online
j/k move/ filterenter connect? help
vault

Hosts & keys, everywhere

Store connections, tags and identities once. Every device you sign in on gets the same vault — laptop, desktop, phone.

projects

Share hosts, not secrets

Invite teammates into a project to share its hosts. Membership decides who sees which hosts. Private keys always stay yours.

sign-in

Browser once, terminal forever

Authenticate in the browser, pair your terminal with a short device code. Your account password never goes near the terminal.

security model

We store your vault.
We can't read it.

Everything on our servers is encrypted with a key derived from your password — on your device, before it leaves. Your password is never sent to us, so there is nothing for us (or anyone who breaches us) to decrypt.

Forgot your password? The only way back in is the 40-character recovery code shown once when you created your account. No code, no vault — that's the point.

password → key derivation (argon2id) happens client-side
vault blobs encrypted with XChaCha20-Poly1305 before upload
recovery code shown exactly once, never stored by us in plaintext
no password reset by email · no support-desk backdoor