The terminal and opsof the AI era.
Continuously crafting the finest terminal and ops experience of our time.
Swipe horizontally — Hux's multi-pane workflow
/ Feature Overview
8 capabilities, one app, AI-driven.
Privacy and security first.
Data sync is end-to-end encrypted, relay server is open-source (self-host as needed).
Terminal
GPU rendering · full modern terminal · horizontal multi-pane layout
Hosts
Groups · multi-cloud import · SFTP · monitoring · port forwarding
Notes
Note / Snippet / Manifest built for ops
Containers
Docker · Podman · Colima multi-runtime
Kubernetes
Multi-cluster · exec / cp / logs · CRD · Events
Database
MySQL · PG · smart completion · direct over SSH tunnel
MFA
TOTP / HOTP · QR import · SSH autofill
Security
Local encryption · E2E sync · zero-knowledge server
/ 01 · Terminal
More than GPU rendering — AI pairs with you in the terminal.
Cross-platform GPU rendering, on par with Ghostty/Kitty. Smooth scrolling out of the box, every setting visual. AI is built in as a native capability — every step is visible, controllable and replayable.
Terminal deep dive/ 02 · Hosts
Every connection, managed in one place.
Group ownership, multi-field search, five clouds with a single click. Password or public key (ED25519 / RSA / ECDSA), credentials encrypted locally.
Hosts documentation
/ 03 · Notes
An executable knowledge base built for engineering ops.
Four content kinds, each in its own lane — Markdown for runbooks and post-mortems, Snippet for reusable commands, docker-compose / k8s YAML auto-detected as Manifest, Secret for credentials and API keys kept encrypted on-device. Edit a snippet once and every backlinked runbook updates; Workspace / Notebook / Section lets personal drafts grow into team knowledge; version history keeps every iteration safe.
Notes documentationNote
Markdown writing + live preview
Snippet
Reusable code / command fragments
Manifest
Config files · format auto-detected
Secret
Encrypted credentials · API keys / tokens
/ 04 · Containers
Local Containers, remote containers — one place.
Five engines (Docker · OrbStack · Podman · Colima · Rancher Desktop) auto-detected locally, remote SSH hosts collected through tunnels. Container lifecycle — list / start-stop / new / logs follow / exec PTY / inspect, plus three resource kinds (images · networks · volumes) with full-dimension Prune.
Containers documentation/ 05 · Kubernetes
Full power of Lens / k9s / Headlamp.
40+ resource kinds covered — workloads / network / storage / RBAC / CRD. Cluster Overview surfaces health in 6 panels; full pod ops — logs follow · exec PTY · cp · port-forward · scale. Create any resource via YAML apply, with one-click rollback in Rollout history. Private clusters reached over SSH tunnel — no public API exposure needed.
Kubernetes documentation/ 06 · Database
MySQL / PostgreSQL / SQLite, a Full SQL Workbench.
On par with Sequel Ace / TablePlus: schema-aware completion, double-click cell edit with marked-row deletion in the result grid, full schema tree (databases / tables / views / indexes), CSV export. Multiple connections + SSL/TLS; remote instances can be attached over SSH tunnels.
Database documentation
/ 07 · MFA
Built-in TOTP / HOTP — no Authenticator needed.
Full RFC 6238 / RFC 4226, SHA-1/256/512 + custom digits/period. otpauth:// URI one-tap import, countdown progress + next-code preview. Secrets field-level encrypted with AES-256-GCM, Master Key sealed in Apple Keychain, synced across devices over E2EE.
MFA documentation
/ 08 · Security
Cryptographic guarantees, not lip service.
Field-level encryption, Master Key sealed in hardware Keychain / HUKS, Zero-knowledge cross-device sync, SSH host-fingerprint verification, log redaction, mandatory read-only cloud credentials, and SSH/SFTP/cloud APIs/AI all direct — never via Hux servers. Auditable commits, sync protocol spec published.
Field-level encryption
SSH private keys, passwords, AccessKeys and MFA secrets are each AES-256-GCM encrypted; plaintext fields (hostnames, etc.) stay searchable
Hardware-backed Master Key
Sealed in Apple Keychain on macOS / iOS and in HUKS on HarmonyOS, device-bound, never written to disk
SQLCipher full-disk encryption
The entire database is AES-256-CBC encrypted; db_key is HKDF-SHA256 derived from the Master Key
Zero-knowledge cross-device sync
A 6-digit pairing code is PBKDF2-SHA256 derived (100,000 iterations) into sync_key; every change is independently AES-256-GCM encrypted — the server only sees ciphertext
SSH host-fingerprint verification
TOFU on first connect records the SHA-256 fingerprint; subsequent mismatches are rejected. known_hosts is per-device and never synced
Log redaction
AI streaming error responses auto-detect and redact any token of length ≥ 20, so providers can't echo your API Key into logs
Read-only cloud credentials
GCP is forced to compute.readonly scope; AWS / Aliyun limited to Describe* / List* — a leaked credential can read metadata at most
Always direct, never via Hux servers
SSH / SFTP connects straight to hosts, cloud APIs straight to endpoints, AI straight to providers, sync only transmits ciphertext — the server has nothing to decrypt
All of the above is verifiable by packet capture; sync-server is open source (Rust + axum) and the protocol spec is published
/ 09 · Cross-device sync
One account, every device, seamless.
PBKDF2 100k → AES-256-GCM. The server only ever sees ciphertext — guaranteed by cryptography.
/ Pairing code
5:00Valid for 5 minutes. Enter it on another device to establish the sync channel.
- Derivation
- PBKDF2-SHA256
- Iterations
- 100,000
- Cipher
- AES-256-GCM
- Server visibility
- Ciphertext only
- Synced
- Hosts · keys · notes
- Excluded
- Known hosts · AI history
- Self-host
- sync-server open source
- End-to-end
- PFS + device binding
/ FAQ
Before you buy, the things you're probably wondering.
Didn't find an answer? Email support@hux.app.
Is Hux open source?
+
The Rust core and the cross-device sync server (sync-server) are open source and self-hostable. The client app is closed source and subscription-based.
Will my AI data be uploaded to Hux?
+
No. You bring your own API Key and connect directly to the provider — Hux is not a proxy and stores nothing of your conversations. Enterprise LLM Gateways are supported.
Is the HarmonyOS app feature-complete?
+
It's at parity with the Apple version. SSH, SFTP, monitoring, K8s, Docker, AI, multi-cloud, sync and MFA are all covered.
Does one subscription cover every platform?
+
One Pro subscription covers every platform (macOS / iOS / iPadOS / HarmonyOS) and every device you log into.
Where is the sync server? Is my data safe?
+
End-to-end encrypted: the pairing code is PBKDF2-derived into a sync_key and changes are AES-256-GCM encrypted. The server only stores ciphertext. Self-hostable.
How long is the trial?
+
New accounts get a 14-day Pro trial, no credit card. It downgrades to Free automatically.
/ Native everywhere
One subscription,four platforms.
iOS
18+
iPadOS
18+
macOS
15+
HarmonyOS
5.0.3+
Hosts · keys · notes · AI · cloud credentials · MFA
/ Get started
Ready to evolve your ops terminal?
14 days of Pro free, every feature unlocked.