Your workspace. Your machine.

Your workspace, stored locally

Netrix runs without a Netrix cloud account or a hosted workspace. Its local SQLite database uses SQLCipher encryption for saved hosts, snippets, network maps, and other database records, including write-ahead log payloads. At startup, your master password must be verified before the workspace database opens.

This protects database contents at rest. Interface preferences, SSH known-host records, diagnostic logs, and exported files have separate storage rules. Database encryption does not automatically encrypt those files or erase old plaintext copies.

A separate layer for saved credentials

Saved passwords, private keys, and passphrases have an additional credential-vault layer inside the database. The vault derives a key from your master password with Argon2id and encrypts secret records with AES-256-GCM. SQLCipher database encryption and vault encryption are separate mechanisms.

The Rust backend manages vault key material while the vault is unlocked. Normal host-list responses expose credential-presence flags instead of plaintext secrets. New workspaces require a confirmed master password of at least 10 characters; incorrect unlock attempts are rate-limited.

Rust at the core

The backend is written in Rust and handles connections, database access, credential-vault operations, and network tools. A separate Tauri desktop shell, also written in Rust, owns the backend process and native desktop permissions. The interface is React and TypeScript running in a webview; the database stack includes native SQLite and SQLCipher components.

The backend listens only on 127.0.0.1. The shell creates a fresh session token for authenticated communication with the interface. Desktop capabilities are restricted by window role. Quick Connect exchanges short-lived, one-time tickets so credentials do not appear in connection URLs. These boundaries are part of the design; Rust alone is not a guarantee against security defects.

Connection security depends on the protocol

SSH encrypts the connection. By default, Netrix uses trust on first use: it records the first server key it sees and rejects later mismatches. First use does not independently prove a server's identity. Compare the saved key shown in Known Hosts with a trusted source, and verify a legitimate key change before removing an old trust record.

SFTP uses separate SSH connections with the same host-key checks, so file activity does not replace an active terminal connection. Telnet sends data without transport encryption; choose SSH when the device supports it. Serial communication does not acquire SSH encryption by being opened in Netrix.

What locking does

Vault lock prevents new use of saved credentials while existing terminal sessions can remain usable. Application lock also hides protected content across Netrix windows, blocks new protected operations, and rejects terminal input until you verify your master password. Inactivity timeouts are configurable in Settings.

Locking leaves the running workspace in memory. Existing connections, accepted operations, transfers, and tunnels may continue, and database keys and session data remain in the process. Close Netrix to end that running workspace. At-rest encryption and the application lock do not protect an open workspace from a compromised trusted interface, local administrator, or memory inspection.

Keep a recovery copy you can unlock

The master password protects your local workspace; it is not a cloud sign-in. There is no online password-reset service. Keep encrypted portable backups and their archive passwords somewhere safe. Existing backups retain their original passwords when you change the password of the live workspace.

Resetting saved credentials deletes those credentials and preserves the workspace password requirement. It does not recover a forgotten master password. See the backup and restore guide for normal usage and development notes for recent changes.

Changing the master password updates the live key wrapping; it does not revoke an old copied key file and its matching password. If both were exposed, a password change alone is not a complete response to that compromise.

This website and your privacy

This product website does not connect to your hosts, collect credentials, or run terminal commands. The interactive workspace and network animations use demonstration data. Website analytics is separate from the Netrix desktop application and cannot access its hosts, credentials, files, or terminal sessions. Fonts are hosted locally.

If you allow analytics, this website loads Google Analytics 4 to measure page visits, referring websites, browser and device information, and approximate location. Google receives these measurements and uses first-party cookies to distinguish visits. Analytics is optional: before a choice, or after you decline, our Google tag does not load. Advertising personalization and Google signals are disabled in our tag.

Your analytics choice is stored in this browser for up to 180 days. Analytics cookies also expire after 180 days. Use Analytics settings at the bottom of any page to change your choice. Withdrawing permission removes our Google Analytics cookies and reloads the page to stop collection. It does not erase data already sent. If browser storage is blocked, your choice applies only to the current page.

We send only known public page paths and the referring website's origin, excluding URL query strings and fragments. We do not send names, email addresses, support payment details, or desktop workspace data. See Google's privacy policy and how Google uses information from partner sites.

Your motion preference is saved in this browser when local storage is available. Cloudflare hosts this website and may process access logs and performance measurements separately from optional Google Analytics. PayPal and Ko-fi have their own privacy practices when you follow a support link. The crypto dialog generates no transaction and sends no wallet data; copying an address uses your device's clipboard.