FerryTermHow FerryTerm Sync keeps your data private
Sync is a free preview and works today; this page describes how it is built. Without Sync, FerryTerm stores nothing on our servers.
Encrypted on your Mac
Every synced item is encrypted on your Mac before it leaves it. A random data key encrypts each record with XChaCha20-Poly1305, and the record’s id is bound into the encryption so a record cannot be moved to another one. The server never sees your data, your passphrase or your recovery key.
What the server stores
The server stores your account, and for each record a random-looking record id, a revision number, the encrypted bytes and the times of writes. It also stores your data key in wrapped form (see below), including the Argon2id cost and salt. It cannot read, search or merge the content.
- It can see: that a record exists, its id, its size (not padded), when it was written, how many records and bytes you have, and which account they belong to.
- It cannot see: names, destinations, colours, settings, tab titles, or your passphrase or recovery key. Even a setting’s name is not visible, and a deleted item looks like an edit.
Passphrase and recovery key
- Your data key is stored on the server only in wrapped form: once wrapped by a key derived from your sync passphrase (Argon2id, 64 MiB memory, three passes), and separately wrapped by a recovery key that is shown to you once, at setup. FerryTerm never stores the recovery key.
- On a Mac you have unlocked, the data key is kept in the macOS Keychain, never in a file. Signing out or locking sync on that Mac removes it.
- New Mac: sign in and enter your passphrase to restore everything.
- Forgot the passphrase: use the recovery key to restore your data and set a new passphrase.
- Lost both the passphrase and the recovery key: your data cannot be recovered, by you or by us. This is the cost of the server being unable to read it, and the app says so at setup.
What syncs
| Data | Synced? |
|---|---|
| Favourite hosts: destination, port, display name, colour, group label | Yes |
| The theme setting. Other settings are added only after a review. | Yes |
| Your tab groups and tabs, published per Mac: names, colours, order, SSH destination and port, and the name of the tmux session an SSH tab runs in. You can hide a window or a tab. | Yes, unless you hide it |
| SSH private keys | No. The sync format has no place for them. |
| Passwords you type into ssh | Never; a destination containing a password is refused |
Your ~/.ssh/config | Never; it is only read |
| Terminal content and shell history | Never |
| The local cache of files you edit | Never |
| Transfer history | Never |
Delete your data
Settings has “Delete my sync data”, which removes every record from the server for every Mac. It touches nothing on any Mac.
Copying from a remote server
Text you copy inside tmux on a server reaches your Mac clipboard. This works only in that direction: a program on the server cannot read your clipboard.