SSH · RDP · VNC · Telnet · Serial
Duo22 is a desktop client for SSH, remote desktops, Telnet and serial consoles. Your hosts, keys and snippets sync across your devices and share with your team, end-to-end encrypted. The server only ever sees ciphertext.
macOS (Apple Silicon) Windows Linux
Features
From a jump host to a Raspberry Pi on a serial cable: connect, transfer, tunnel and manage containers without switching tools.
Fast WebGL terminals with search, split panes and ProxyJump through jump hosts. Tabs take their host's tag colour, so production stands out.
Windows desktops over RDP with Network Level Authentication, Linux desktops over VNC, optionally tunnelled through SSH.
Telnet with window size negotiation, and serial consoles on this computer's ports with baud rate, parity and flow control.
Drag between panes or drop files from Finder and Explorer. Recursive transfers with progress, rename, delete and chmod.
Local (-L), remote (-R) and dynamic SOCKS5 (-D) tunnels with live status, and auto-start on the devices you choose.
Containers grouped by Compose project: start, stop, logs and a shell inside. Nothing to install on the server.
Save the commands you keep typing. Run one in a terminal, or broadcast it to every terminal you have open.
Finds SSH, RDP, VNC and Telnet devices on your network and tailnet, to save to a vault or connect to once.
Owner, editor and viewer roles. Invitations must be accepted, and removing a member rotates the vault's key.
A local encrypted cache keeps everything at hand. Edits made offline sync when you're back.
Press ⌘K and type: any host over SSH, SFTP, Docker or Kubernetes, a saved workspace, or any page in the app.
Locks itself after inactivity. On a Mac, optionally unlock with Touch ID until the end of the day.
Tour
Real screens from the app, filled with made-up demo data.
Organise
Groups, tags and identities keep a few hundred hosts manageable. The hosts page shows which ones answer and how fast, including those behind a jump host.
Connect
Split a tab into up to four terminals, each with its host's CPU, memory and disk at a glance. Save a set of tabs as a workspace and open it again in one go.
⌘K
Quick connect finds any host and opens it the way you want: a terminal, SFTP, Docker, Kubernetes or its systemd services.
Transfer
This computer on the left, the server on the right. Drag between them, or drop files in from Finder or Explorer, and edit remote text files in place.
Containers
Duo22 runs the host's own docker (or podman) over your SSH connection. Start, stop, restart and remove containers, follow their logs, or open a shell inside.
Clusters
Pods, workloads, services and nodes from a host's own kubectl, k3s or microk8s. Describe, view YAML, restart, scale, or open logs and a shell in a pod.
Tunnel
Local, remote and dynamic SOCKS5 forwards, each with its live state and open connections. Route this device's traffic through a SOCKS rule with one click.
Automate
Snippets live in the vault next to your hosts, so the team shares them too. Send one to a single terminal or broadcast it to all of them.
Discover
Bonjour, a port sweep of your subnet and your Tailscale tailnet turn up SSH, RDP, VNC and Telnet devices. Add them to a vault in bulk, or connect once without saving.
Monitor
See which hosts answer, how quickly, and how busy the ones you're connected to are. Background checks notify you when a host stops answering or its disk fills up.
Share
Give your team a vault of hosts, identities and snippets with owner, editor or viewer roles, for good or until a date. Every connection is recorded in the vault's history.
Protect
Every account uses an authenticator app, and can add YubiKeys or other FIDO2 security keys to sign in and unlock with a touch.
Security model
Your master password is the only thing that opens your data, and it never leaves your device. Not even the people who run the sync server can see what's inside.
The server stores ciphertext, ids and revision numbers. It can't read your hostnames, usernames, passwords, keys, snippets, or even your vault names.
A vault key is shared by sealing it to each member's X25519 public key. You compare their key fingerprint before sharing, and every device refuses a key that changed.
Every account needs an authenticator app, checked by the server. Add a YubiKey or other FIDO2 security key and sign in with a touch.
Passwords, keys and every network connection live in the app's Rust core. The interface only ever sees redacted metadata, terminal output and pixels.
Download
Pick the file for your computer from the latest release. Duo22 updates itself after that: each download is checked against the app's signing key before it's installed.
Apple Silicon (M1 or later), macOS 11+
Duo22_<version>_aarch64.dmgDownloadWindows 10 or 11, 64-bit
Duo22_<version>_x64-setup.exeDownloadx86_64 AppImage (updates itself) or .deb
Duo22_<version>_amd64.AppImageDownloadIntel Macs aren't supported.
The builds aren't signed by Apple or Microsoft yet, so your computer asks you to confirm the first time you open Duo22. You only do this once: updates open without asking.
.dmg and drag Duo22 into Applications.Or remove the quarantine flag from Terminal:
xattr -dr com.apple.quarantine /Applications/Duo22.appDuo22_<version>_x64-setup.exe.AppImage (recommended; it updates itself):
chmod +x Duo22_*_amd64.AppImage
./Duo22_*_amd64.AppImageDebian / Ubuntu (install each new .deb the same way):
sudo apt install ./Duo22_*_amd64.debRemember this device needs a running keyring (GNOME Keyring, KWallet). Security keys need the usual FIDO udev rules, which most distributions ship.
Duo22 syncs through api.duo22.app by default. Running your own sync server? Change Sync server on the sign-in screen; only https://servers are accepted (plain http:// only on your own machine).