// security
The secret stays on the device.
Konsolity is built so the server cannot betray you, even if compromised.
Zero-knowledge vault
Your master password goes through Argon2id on the device. Two keys come out: one to prove who you are to the server, one to encrypt the vault (XChaCha20-Poly1305). The server receives the first one hashed and never the second. It can neither read your hosts nor reset your password.
Recovery key
Generated on the device, shown once. It alone recovers the vault when the password is lost. Without it the data is lost: the app says so before, not after.
Pinned host keys
The first connection asks for your consent and pins the key. A different key later blocks the connection, shows the date of the previous one and accepts no automatic bypass, even on reconnection.
SSH keys
Private keys are encrypted in the vault and served to sessions by an internal agent that signs without ever handing the key over. Links between servers use ephemeral keys, revoked on close.
Two-factor authentication
TOTP with backup codes. Required to add a second device, for a terminal from outside and to authorise Claude.
Remote terminal
The relay only sees SSH-encrypted bytes between two devices of the same account, with short-lived signed tickets. Each device is identified by its own key, removed when it is revoked.
Claude connector
OAuth 2.1 with PKCE, consent by a code confirmed in the app, no password on the web. Every command waits for your approval; arguments and results are encrypted at rest and purged after an hour.
Server
HTTPS required, HSTS, rate limiting, progressive lockout, secrets encrypted at rest, per-account audit log without sensitive data, e-mail on every new device.
What we never log
Never a password, a key, a passphrase, a token or the text of a command. Even in the app, logs are redacted before being written.
// faq
Frequently asked questions
Can Konsolity recover my vault if I lost my master password and my recovery key?
No, by design. The server never has the encryption key. A new vault has to be created.
Can the remote terminal relay read my terminal?
No: it relays SSH bytes already encrypted between your two devices. It only knows the account and the duration.
Can Claude run a command without me?
Only if you ticked “Always allow” for that client; otherwise every command waits for “Allow once” in the app and is refused after 60 seconds.
// security.txt
Report a vulnerability
Write to security@konsolity.com. We answer within 48 hours and credit responsible reports.