oryxis for Mac

A modern SSH client built entirely in Rust. Fast, encrypted, native.

What is Oryxis?

Oryxis is an open-source alternative to Termius: a desktop SSH client with a modern UI, an encrypted local vault for credentials, and no cloud account anywhere in the loop. No Electron, no webview, no vendor servers. Just a single native binary.

Most SSH clients make you pick two out of three: powerful but dated (PuTTY), pretty but Electron-heavy (Termius, Tabby), or minimal and terminal-only (OpenSSH). Oryxis aims at all three: beautiful, fast, and native.

Install

Windows

or, from a terminal:

Arch Linux (AUR)

Direct downloads from the latest release:

Which Windows installer? (system vs per-user, VSCode-style) System (oryxis-setup-.exe): installs to Program Files, registers under HKLM, requires UAC. Use this for shared machines or when all Windows users should share the install. This is the build winget install targets. Per-user (oryxis-user-setup-.exe): installs to %LOCALAPPDATA%ProgramsOryxis, registers under HKCU, no admin rights. Use this on locked-down machines or when you don't want UAC prompts on every update.

Both register oryxis and oryxis-mcp on PATH so they resolve from any shell. The auto-updater detects the install scope and downloads the matching installer. Windows binaries are Authenticode-signed (see Code signing policy). Portable (oryxis-windows-*.zip): unzip anywhere (a USB key) and run oryxis.exe; the auto-updater replaces the exe in place. A new copy keeps everything (device settings, the vault list, the vaults, plugins, logs) in a data folder it creates next to oryxis.exe, so the folder travels with it. On a computer where Oryxis already keeps its data in %USERPROFILE%.oryxis, the copy keeps using that: create the data folder yourself to switch, and copy the contents of %USERPROFILE%.oryxis into it to bring the setup along (nothing is moved for you). A vault opened from another drive (a VeraCrypt volume) stays where it is; vaults and folders on the USB key itself are remembered relative to the data folder, so another drive letter does not break them. Biometric unlock, the MCP client configs and the oryxis:// link registration belong to each computer. On Linux and macOS the same works by creating an oryxis-data folder next to the binary, the .AppImage file or Oryxis.app (named after the app because those usually sit in a shared folder).

Highlights Native and fast. Pure Rust, GPU-accelerated iced UI, single binary. No Electron, no webview. Encrypted local vault. Argon2id + ChaCha20-Poly1305 per field, optional master password, biometric unlock (Windows Hello / Touch ID / Linux keyring), idle auto-lock, TOTP autofill for 2FA hosts, and stored passwords offered at sudo prompts (never sent on their own). Several vaults. Keep Work and Personal in separate encrypted files, each with its own master password, settings, sync and MCP exposure, open at once: every window works on one vault and switches