v1.0 · Tauri 2 · React 19 · Rust

Your entire infrastructure.
One encrypted vault.

NexoRC is the desktop command center for sysadmins and DevOps engineers — SSH, RDP, VNC, SFTP, Proxmox and Docker, all behind a single AES‑256‑GCM master password.

Free & open source · Windows · macOS · Linux · MIT licensed
NexoRC — Remote Connection Manager
MULTI
Quick Connect: [ssh://][user@]host[:port]
AD-HOC SESSION

Active Monitoring

Real-time health status of your infrastructure

Pinging…
vd
10.129.43.43:3389
Wait…
LATENCY
edge-prod-01
10.0.4.12:22
12 ms
LATENCY
pve-cluster-01
10.0.2.4:8006
84 ms
LATENCY
3 connections monitored · auto-refresh every 5s
Features

Built for the way
infrastructure actually runs.

Stop juggling PuTTY windows, sticky-note passwords and three different file managers. NexoRC is the single, encrypted workspace your fleet has been missing.

Encrypted vault

AES‑256‑GCM at rest with PBKDF2‑HMAC‑SHA256 (100k iterations) and configurable auto-lock. Your master password never leaves the device.

AES-256-GCM PBKDF2 · 100k

Every protocol, one window

SSH, RDP, VNC, SFTP, FTP, Proxmox and Docker — opened, tabbed and arranged in one window. No more alt-tab archeology.

SSH RDP VNC SFTP FTP PVE Docker

Credential profiles

Define a credential once — username, key, jump host, port forwards — then bind it to as many hosts as you like. Rotation is a one-line edit.

prod-deploy → 142 hosts

SSH power tools

Vault-managed keys, ProxyJump chains, port-forwarding tunnels, agent forwarding and broadcast/multi-exec across selected sessions.

ProxyJump Tunnels -L/-R Agent fwd Multi-exec

Health dashboard

A live grid of every host — reachability, latency, load, free disk and last login. Spot the failing node before the on-call page arrives.

edge-01
12ms
db-04
41ms
k8s-m
19ms

Network & port scanner

Async scanner with real-time progress events and cancellation. Discover hosts and open ports on a subnet without leaving the app.

scan 10.0.0.0/24 · ports 22,80,443
▸ 47 / 256 hosts · cancelable
Security

Zero plaintext.
Zero cloud.
Zero compromise.

Your credentials never leave the machine. The vault is sealed with AES‑256‑GCM, derived from a master password through PBKDF2‑HMAC‑SHA256 with 100,000 iterations — and unsealed only in process memory, only for as long as you need it.

  • Local-first storage. The vault lives on your disk — nothing is synced, uploaded or telemetered without an explicit toggle.
  • Auto-lock & idle timeout. Step away and the keys are wiped from memory in under 60 seconds (configurable).
  • Host-key TOFU verification. SFTP/FTP transfers pin server fingerprints on first use and refuse silent swaps.
  • Open, auditable format. The vault is a documented binary container — inspect it, back it up, rotate it.
~/Library/Application Support/nexorc/vault.bin
// nexorc vault — sealed container
{
  "magic":     "NXV1",
  "kdf": {
    "algo":   "PBKDF2-HMAC-SHA256",
    "iter":   100000,
    "salt":   "9f a2 4b 7c d0 …"     // 16 B random
  },
  "cipher": {
    "algo":   "AES-256-GCM",
    "nonce":  "01 c4 8e …"           // 12 B per write
    "tag":    "b7 5c …"              // 16 B auth
  },
  "payload":  <encrypted blob>
}
Broadcast mode

Run one command
across every server.

Select a fleet, hit broadcast, and NexoRC mirrors your input to every selected session in real time — with per-host output streams side by side and a unified scrollback you can grep.

broadcast — 3 sessions
LIVE
edge-01.prod eu-west-1
$ uptime
14:23:11 up 41 days, 2:14
load: 0.42, 0.38, 0.31
$ df -h /
/dev/sda1 240G 91G 138G 40%
$
db-replica-04 us-east-1
$ uptime
14:23:11 up 92 days, 8:01
load: 1.12, 1.04, 0.97
$ df -h /
/dev/nvme0 1.8T 1.2T 600G 68%
$
kube-master ap-south-1
$ uptime
14:23:11 up 14 days, 4:48
load: 0.21, 0.19, 0.18
$ df -h /
/dev/sda1 120G 48G 72G 41%
$
BROADCAST df -h / 3 sessions · ⏎ to dispatch
Protocols

Seven protocols. One toolbar.

Switch contexts without switching apps. Every connection lives in the same vault, the same sidebar, the same audit trail.

SSH Secure Shell · port 22 RDP Remote Desktop · Windows hosts VNC Virtual Network Computing · GUI SFTP SSH File Transfer · TOFU pinned FTP File Transfer Protocol · legacy Proxmox VE cluster · API + console Docker Containers · exec · logs · compose
Themes

Five looks. Pick your
working mood.

Switch the entire UI with one click — from the calm Catppuccin default to a pure-black war-room mode. Every theme is a single CSS variable swap, so the app stays fast at any density.

vault
ENCRYPTED
Catppuccin
default
vault
ENCRYPTED
Stealth
pure black
vault
ENCRYPTED
Matrix
terminal green
vault
ENCRYPTED
Cyberpunk
neon
vault
ENCRYPTED
Light
daylight
v1.0 · MIT · open source

Your entire infrastructure.
One vault.

Free. Open source. Local-first. Built with Tauri so it stays light on your laptop and fast on your fleet.

MIT licensed · Build from source