termius-local-export

Export locally stored Termius hosts into portable SSH manager formats.

The tool is intended for account owners migrating their own Termius desktop data. It reads Termius' local Electron IndexedDB, decrypts fields with the local Termius key, and writes OpenSSH-style config plus JSON/CSV files.

It does not bundle Termius code or upload exported data. At runtime it loads the native crypto/keychain modules from the Termius app already installed on the user's machine.

Status

Experimental. Tested against Termius for macOS 9.38.x.

Termius is not affiliated with this project. Termius storage internals can change without notice.

Requirements

• macOS
• Node.js 22+
• Termius desktop app installed and already logged in
• Access to the local Termius Keychain item, or a local key supplied with TERMIUS_LOCAL_KEY / --local-key-file

Install

Run without installing:

npx termius-local-export --launch --out termius-local-export

Or install the CLI globally:

npm install -g termius-local-export
termius-local-export --help

From a source checkout:

npm link

The npm package and installed command are both named termius-local-export.

Usage

Quit Termius first, then run:

termius-local-export --launch --out termius-local-export

Include passwords and private keys only when you need them:

termius-local-export --launch --include-secrets --out termius-local-export

If Termius is already running with a DevTools port, skip --launch:

termius-local-export --port 9222 --include-secrets

If you already have an encrypted IndexedDB dump:

termius-local-export --input termius-local-export/encrypted-indexeddb.json --include-secrets

Show all options:

termius-local-export --help

Exit Status

The command exits with code 0 after a successful export or informational command such as --help / --version. It exits with code 1 when argument parsing, Termius access, export, decryption, or file writing fails.

Outputs

The output directory is created with mode 700. Files are written with mode 600.

termius-local-export/
  encrypted-indexeddb.json   # encrypted raw IndexedDB dump, only with --keep-encrypted
  hosts.json                 # normalized host list
  credentials.json           # same normalized host list, JSON
  credentials.csv            # CSV for SSH managers
  sshconfig                  # OpenSSH-style Host entries
  keys/                      # private keys, only with --include-secrets

The encrypted IndexedDB dump is removed after a successful live export by default. Use --keep-encrypted only if you need to inspect or reuse it.

Use --write-raw-decrypted only for debugging. It writes decrypted-indexeddb.json, which can contain passwords, private keys, tokens, hostnames, and other sensitive data.

Security Notes

This tool can export secrets. Treat the output directory as sensitive, even when the raw IndexedDB file is still encrypted.

--launch starts Termius with --remote-debugging-port=<port> and --remote-debugging-address=127.0.0.1 so the tool can ask Chromium to read IndexedDB through the normal browser API. Do not expose that port to the network. Quit Termius after export if you launched it manually.

The decryption step runs through:

ELECTRON_RUN_AS_NODE=1 /Applications/Termius.app/Contents/MacOS/Termius

That is necessary because Termius ships native modules built for its Electron runtime, not for arbitrary system Node versions.

Local Key

Normally the tool reads the localKey from macOS Keychain through Termius' own @termius/keytar module.

Fallbacks:

TERMIUS_LOCAL_KEY='base64...' termius-local-export --input encrypted-indexeddb.json
termius-local-export --input encrypted-indexeddb.json --local-key-file ./local-key.txt

Passing secrets through shell history is risky. Prefer Keychain access.

Troubleshooting

If the tool says Termius is not reachable, quit Termius and rerun with --launch, or start Termius manually with --remote-debugging-port=9222.

If the tool cannot find localKey, grant Keychain access when macOS prompts for it, or provide TERMIUS_LOCAL_KEY / --local-key-file.

Limitations

• macOS only for now.
• Requires Termius local storage to use the local crypto system used by current Termius desktop builds.
• Host extraction is best-effort. The raw decrypted JSON can be written for debugging with --write-raw-decrypted.
• Shared/team vault behavior has not been exhaustively tested.

Development

node ./bin/termius-local-export.js --help
npm test
npm pack --dry-run

The tests use synthetic decrypted data and do not require Termius.