Documentation

Features

Every network protocol can be reached through an SSH jump host / gateway (chains up to 4 hops; FTP excluded because of its separate data connections).

Organisation:

• Nested folders (with colours), names, tags (coloured, renamed or deleted for all connections at once), colour coding, favourites, recently used
• Notes per connection; search across names, hosts, users, tags and notes
• Tabs for multiple simultaneous sessions, reconnect, close confirmation
• Multi-select (Ctrl/Shift+click) with bulk actions and a bulk edit dialog; drag & drop in the tree
• Command palette (Ctrl+K / Ctrl+Shift+P): fuzzy search over connections, folders, open tabs and actions
• Quick connect: type user@host, ssh://…, rdp://…, vnc://…, sftp://…, https://… (WebDAV), COM3, … in the search bar and press Enter
• Host status dots with latency, Wake-on-LAN (optionally before connecting)
• English and German UI; pastel light / blue-grey dark / system theme; Skia rendering for sharp text and vector icons at any scale (4K / 8K)

Terminal productivity:

• Split panes (right / down) with a second connection in the same tab: the tab names both servers, each pane has its own toolbar (files, server tools, scrollback, separate into two tabs, close); an open tab can be moved into the split; copy files directly between the two servers (streamed, no local copy)
• Broadcast input to all panes of a tab or to all terminals (red outline + banner while active)
• Snippets side sheet with variables ${host} ${user} ${port} ${name} ${date} ${time} ${clipboard}
• SFTP side panel in SSH tabs (separate SFTP session to the same host, no extra setup)
• Session logging to files, save scrollback as text
• ZMODEM (sz / rz) over SSH, Telnet and serial, files up to 4 GB (tested against lrzsz)
• OSC 52: tmux / vim yanks reach the local clipboard (can be turned off)
• Paste confirmation for multi-line or large pastes, bracketed paste, copy-on-select (optional), Ctrl+Shift+C / Ctrl+Shift+V, Ctrl+V and Shift+Insert paste, right-click copy/paste

Server tools (SSH; Debian/Ubuntu, RHEL/Fedora/Alma/Rocky, openSUSE, Arch, Alpine, Proxmox VE):

• Overview: CPU, memory, swap (live), CPU history, load, uptime, kernel, network rates, file systems
• Disk usage map (treemap like WizTree, drill-down, largest files, delete) and Free up space (package cache, unused packages / old kernels, journal, rotated logs, old temp files, crash dumps, Docker data, trash)
• Processes (end / kill, run commands as user or root), services (systemd, OpenRC, SysV: start, stop, restart, boot, status, logs), cron jobs (add, turn on/off, run now, delete), users (add, password, lock, admin rights, delete), updates & packages (apt, dnf, yum, zypper, pacman, apk), logs (journal / syslog with unit, level and text filter)
• Firewall (ufw, firewalld, iptables; nftables read-only), Fail2ban (jails, ban / unban), Docker / Podman (start, stop, restart, logs, stats, shell, clean up), Proxmox VE VMs and LXC containers (start, shut down, reboot, stop, snapshot, console) or libvirt VMs
• Network & diagnostics: interfaces, listening ports, routes and DNS; ping, trace route and DNS lookup from the server; ping and port probes from this PC
• Privileged commands run as root, with passwordless sudo or sudo with the connection's password; dangerous actions ask first

File transfers (SFTP, FTP/FTPS, WebDAV):

• Streaming with constant memory, 64-bit sizes: files of 10 GB and more
• SFTP pipelining (32 × 256 KiB reads, 64 × 128 KiB writes in flight)
• Resume after cancel, error or restart (.okpart file + sidecar with remote size / mtime), automatic rename into place
• SHA-256 verification (remote sha256sum over SSH), keep modification times, bandwidth limit, overwrite policy (resume / overwrite / skip / keep both), free disk space check
• Recursive folder upload and download, transfer drawer with progress, speed, ETA, cancel and retry, drag & drop files from the desktop into a file browser

Measured against a local OpenSSH server (Docker): a 10 GiB file downloads at ~93 MB/s, including a cancel at 40 % and a resume, and uploads at ~126 MB/s, both SHA-256 verified.

Credentials and security:

• Credential manager: reusable credentials linked from many connections
• Password generator (characters or EFF-wordlist passphrases, entropy meter) and SSH key generator (Ed25519 / RSA, optional passphrase, one-click install of the public key on the server)
• TOTP per connection (Base32 or otpauth://), shown with a countdown and used for SSH one-time-code prompts
• KeePass (kdbx 3/4) and Bitwarden (bw CLI) as password sources
• Unlock code: while locked, hosts, usernames, credentials and notes are hidden; editing, deleting, revealing secrets and import/export ask for the code. Stored only as an Argon2id hash.
• The vault (vault.okv) is encrypted with AES-256-GCM; its key lives in the OS credential store (or a local key file in portable mode)
• SSH host keys, RDP and VeNCrypt certificates use trust-on-first-use; a changed key or certificate blocks the connection
• Optional clipboard clearing after copying secrets, optional audit log

Import, export and sync:

• Okeanos exports (.okeanos, optionally encrypted with Argon2id → AES-256-GCM)
• Import from OpenSSH config (incl. Include, ProxyJump, forwards), PuTTY (registry, ~/.putty or a .reg export), mRemoteNG (confCons.xml incl. passwords and full-file encryption, master password prompt), FileZilla (sitemanager.xml), Remote Desktop Manager XML exports (without passwords) and CSV — always with a preview (choose items, target folder, duplicate handling)
• CSV export (name,protocol,host,port,username,folder,tags,notes, no secrets)
• Sync through a shared folder (Nextcloud, OneDrive, Dropbox, Syncthing, a network share) or a Git repository: an encrypted okeanos-sync.okv per folder, per-record last-writer-wins merge, deletions via tombstones (kept 90 days), conflict copies of sync clients are merged automatically

Keyboard shortcuts:

Inside terminal, VNC and RDP sessions only the Ctrl+Shift shortcuts and tab switching are taken.

Plugins

Plugins are separate programs installed from a .okplugin package in Settings → Plugins.

• Checks: packages are checked against their file hashes, and signed packages show as "signed".
• Permissions: a plugin only gets the permissions you grant: see connections, open tabs, read or type into terminals, run commands over SSH, change connections. Every command, terminal input and connection change shows an Allow / Always allow / Deny card first.
• Secrets: a plugin never sees passwords or keys.
• Visibility: nothing plugin-related appears outside Settings → Plugins until a plugin is installed.

The Okeanos AI plugin (repository okeanos-plugins/okeanos-ai) puts an AI assistant in a sidebar.

• Providers: Claude, OpenAI, DeepSeek, Google Gemini, Mistral, xAI Grok, Groq, OpenRouter, local models (Ollama, LM Studio, llama.cpp, vLLM, LocalAI, Jan) or any OpenAI-compatible server.
• MCP apps: Claude Desktop, Claude Code, Cursor, VS Code, LM Studio and other MCP apps can use Okeanos too: "Add to Claude Desktop", "Copy command for Claude Code" or "Copy MCP configuration". Their requests appear in the Okeanos sidebar, and you approve them there.
• Claude plans: a Claude plan (Pro / Max / Team) works only this way. Anthropic doesn't allow third-party apps to use plan credentials, so the sidebar chat with Claude needs an API key.

The protocol is described in docs/plugin-protocol.md.

Licensing and updates

Okeanos is commercial software: it needs a licence key or a 30-day trial.

• Models: perpetual (includes 12 months of updates; versions released in that period keep working forever) or subscription.
• Editions: Standard, Pro, Team.
• Activation:
  • Enter the key on the licence screen; it is bound to this computer (a salted hash of the OS machine id) and uses one seat.
  • Computers without internet access use offline activation: request code → customer portal on another PC → paste the answer.
  • Settings → About shows the licence and can deactivate this PC (freeing the seat).
• Updates:
  • Okeanos checks once a day (off / notify / download automatically, stable or beta channel). The update feed is signed, and the download's size and SHA-256 are checked.
  • The installer updates silently and restarts the app, the portable ZIP swaps its exe, Linux packages are installed with pkexec (apt-get, dnf / zypper, pacman), and an AppImage or tarball install replaces itself.
• Online contact: only the licence id, the machine hash and the app version are sent to the licence server; no connection or vault data.

The protocol between the app and the licence server is described in docs/licensing-protocol.md.

For development, these tools sign with the development keys:

• cargo run --example mock-licence-api -- <dev-keys dir> starts a local stand-in for the licence/update API.
• cargo run --example okeanos-keys -- <dir> creates new key pairs.

Release builds must embed the production public keys: packaging/release.ps1 refuses to build without OKEANOS_LICENCE_PUBKEY and OKEANOS_RELEASE_PUBKEY. The website is https://okeanos.tools (licence and update API https://okeanos.tools/api); OKEANOS_SITE_URL / OKEANOS_API_BASE override it.

Notes and limitations

• Embedded RDP: "resize to window" uses the Display Control channel; servers without it (e.g. some xrdp builds) keep their size. No audio, smart cards or RemoteApp. The RDP file panel needs SFTP on the server (Windows: the "OpenSSH Server" optional feature) or another SSH / SFTP connection that reaches the same files.
• VNC file transfer is not standardised and not supported (use SFTP through the SSH gateway). VNC clipboard is text only. VeNCrypt anonymous-TLS sub-types (TLSNone/TLSVnc/TLSPlain) are not supported by the TLS stacks used.
• The transfer queue runs one transfer at a time per file browser; WebDAV uploads restart instead of resuming (no Nextcloud chunked upload yet).
• Split view has two panes; snippets have no interactive ${prompt:…} variable yet; no find-in-terminal yet.
• RDM imports names, groups, hosts, ports and users only (RDM encrypts passwords with its own scheme); the mapping was written without a large set of sample files, so check the preview.
• External RDP: the password is handed to mstsc through a temporary Windows credential (cmdkey), removed 30 s later.

Third-party licenses

Okeanos uses only permissively licensed components (MIT, Apache-2.0, BSD, ISC, Zlib, Unicode, BSL-1.0, MPL-2.0 for two unmodified crates) plus Slint under its Royalty-free Desktop, Mobile, and Web Applications License 2.0. That license allows closed-source, commercial desktop apps on the condition that the AboutSlint widget is shown in an About screen (Settings → About) or a "Made with Slint" badge is shown on the download page; it does not cover embedded devices.

packaging/THIRD-PARTY-NOTICES.txt lists every crate with its license texts. It is compiled into the app (Settings → About → Third-party licenses) and installed next to it. Regenerate it after changing dependencies:

python packaging/third_party_notices.py packaging/THIRD-PARTY-NOTICES.txt

The licence terms (packaging/EULA-de.txt, EULA-en.txt) are the same text as on the website. The source is okeanos-website/legal/, and packaging/release.ps1 copies it before every build. They are shown in the Windows installer and installed with every package, and Settings → About → Licence terms opens them.

Dependencies are checked with cargo deny check and cargo audit before every release; see docs/security-audit.md.