Hatoba

Open-source desktop SSH client with an AI assistant and end-to-end encrypted sync through your own Cloudflare account

Watch the demo with sound (MP4)

Hatoba keeps your hosts, keys, and terminal sessions in one place, syncs them between your devices, and puts an AI assistant beside each terminal. The sync backend is a Worker and a D1 database that you deploy to your own Cloudflare account.

• No Hatoba server. Sync runs entirely in your Cloudflare account, so nobody else holds your data.
• End-to-end encrypted. Everything is encrypted on your device before it leaves, so a leaked Worker, D1 database, or even the whole Cloudflare account exposes only ciphertext.
• Local first. Everything works offline, and sync is optional.
• Windows first. A custom title bar with Snap Layouts, Mica, Segoe UI and Cascadia fonts, and Windows input methods. Each release also has Linux packages and an experimental macOS build.

Features

• Hosts: groups, tags, favorites, fuzzy search, recent connections, online status, ~/.ssh/config import, ProxyJump, and SOCKS5 and HTTP proxies. Type ssh user@host in the search box to connect without saving a host.
• Terminal: tabs, 256 colors and truecolor, CJK wide characters and input methods, confirmation before multi-line paste, search, clickable links, and the CPU, memory, and network usage of Linux servers in the status bar.
• Authentication: passwords, Ed25519, ECDSA, and RSA keys with or without a passphrase, ask on every connection, ssh-agent, and keyboard-interactive (2FA).
• Security: host key confirmation on first connect, a blocked connection when the key changes, a master password with a recovery code, and auto-lock on idle, on sleep, or on demand.
• SFTP: a file panel beside the terminal with drag-and-drop upload, download with progress and cancel, rename, delete, and new folder.
• Key vault: import OpenSSH, PEM, and PuTTY .ppk keys, generate Ed25519 or RSA 4096 keys, and copy or deploy public keys.
• Port forwarding: local forwards that can start with the connection.
• Cloud sync: through your Worker or directly to D1, with incremental sync, automatic conflict resolution you can review item by item, and a device list with revocation.
• AI assistant: a panel beside each terminal that reads the screen, runs commands, and types into the shell with your approval (or without it, in bypass mode), and can search the web and read pages. It uses your own OpenAI-compatible or Anthropic API key, supports skills and MCP servers, and takes terminal selections, connection errors, long pastes, and text files as attachments. Conversations sync with the rest of the vault.

Download

Download from Releases:

• Windows: Hatoba_<version>_windows-x64-setup.exe installs for the current user without administrator rights.
• Linux (x86_64): Hatoba_<version>_linux-x64.deb for Debian, Ubuntu, and distributions based on them, or Hatoba_<version>_linux-x64.AppImage for the others. Sync keeps its credentials in the Secret Service, so it needs GNOME Keyring, KWallet, or another Secret Service provider.
• macOS (Apple Silicon, experimental): Hatoba_<version>_macos-apple-silicon.dmg for macOS 13 or later. The app is not signed with an Apple Developer ID or notarized, so macOS blocks it the first time you open it. Within the next hour, go to System Settings → Privacy & Security, choose Open Anyway under Security, and enter your login password. After an update, macOS may ask whether Hatoba can use its keychain items: enter your login password and choose Always Allow, because sync fails if you deny it.

The maintainer uses Windows, so the Linux and macOS builds get little testing on real machines. If something doesn't work on them, please open an issue.

Each release's notes cover what changed and how to install it.

Screenshots

AI assistant

The assistant reads the terminal, finds the cause, and fixes it. Each command waits for your approval, and you can edit it before it runs.

Cloud sync

Hatoba deploys the sync Worker and its D1 database to your Cloudflare account, then keeps every device in sync.

Security

Keys are derived from your master password with Argon2id, and every item is encrypted with AES-256-GCM before it is stored or synced. The Worker stores ciphertext and the hashes it needs to sign you in, never your master password or any plaintext. If you forget the master password and lose the recovery code, your data cannot be recovered. The security model describes the key hierarchy and the threat model.

The AI assistant sends the model provider your messages, their attachments, and what its tools read. Host addresses, passwords, and keys reach the provider only when they appear on the screen, in a tool result, or in an attachment you send.

Build from source

You need Rust stable, Node.js 22 or later, and pnpm. Windows also needs WebView2, which Windows 11 includes, macOS needs the Xcode Command Line Tools, and Linux needs the Tauri system dependencies such as libwebkit2gtk-4.1-dev.

pnpm install
pnpm tauri dev

pnpm tauri build --no-sign produces the NSIS installer on Windows, and the deb package and the AppImage on Linux, without the update signatures that only release builds carry. On macOS, don't pass --no-sign: it also drops the ad-hoc code signature, and Apple Silicon Macs report an app without one as damaged once it is downloaded or copied from another Mac. Turn off the update artifacts instead, and the build produces the app bundle and the DMG:

pnpm tauri build --config '{"bundle":{"createUpdaterArtifacts":false}}'

The development guide covers the browser-only frontend, tests, and the generated TypeScript bindings.

Set up sync

Sync is optional. It runs on a Worker and a D1 database that you deploy once to your Cloudflare account, and the free plan usually covers personal use. Hatoba can deploy them for you with a Cloudflare API token; otherwise deploy them with one click from the browser or with wrangler, then connect the first device with the Worker URL and a setup token you generate during deployment. Other devices need only the Worker URL and the master password.

Deploy the sync Worker walks through each way and connecting Hatoba, and covers upgrades, resets, and backups.

Documentation

• Architecture and requirements: architecture, security model, data formats, the sync protocol and Worker API, and requirements
• Implementation status: progress on each requirement, milestones, and open questions
• Development guide: building, running, and testing
• Release Hatoba: versions, release notes, and publishing
• Deploy the sync Worker: deployment, upgrades, resets, and backups
• End-to-end smoke test: driving the real app against a real OpenSSH server
• Design: design files, porting conventions, and deviations from the design
• Contributing: issues, branches, commits, and pull requests
• Security policy: reporting a vulnerability privately

License

Hatoba is licensed under MIT.