CoreBit
GitHub Install free
Desktop app

CoreBit Companion

One-click access to every device — with a zero-knowledge credential vault.

A cross-platform desktop app that connects to your CoreBit server and opens SSH, WinBox, RDP and Web sessions to any device, straight from your topology — with a built-in terminal and an end-to-end-encrypted vault for your team's credentials.

macOSUniversal .dmg Windows.exe installer Linux.AppImage

Connects to your CoreBit server with a personal API key.

One-click device access

Open SSH, WinBox, RDP and Web sessions to any CoreBit device — no copy-pasting hostnames or hunting for the right client.

Built-in SSH terminal

An embedded terminal and a local shell, so you can jump onto a device without ever leaving the app.

Zero-knowledge vault

Passwords and SSH keys are encrypted on your device (Argon2id + AES-256-GCM). CoreBit only ever stores an encrypted blob — it can't read them.

Shared team vaults

Give your team an encrypted vault per group, each with its own passphrase. Access is granted per user from CoreBit's web UI.

1Password ready

Store a 1Password reference instead of a password and resolve it live at launch via the op CLI — nothing extra kept on disk.

Personal devices

Add your own local devices alongside the ones from CoreBit, stored only on your machine.

Your secrets never leave your machine in the clear

Credentials are encrypted in Companion before they're ever sent. CoreBit stores only an opaque, client-encrypted blob and never sees your passwords, passphrases or keys. Small secrets live in your OS keychain; the rest in a single encrypted file on your device.

Zero-knowledge vault

How your logins stay safe

CoreBit Companion keeps every device login encrypted on your own machine and, when you sync, sends only an unreadable encrypted blob to the server. Here's the whole journey — where a login is kept, how it travels, and how the right one is chosen when you connect.

The big picture

A login's journey, end to end

1 Stored on your device Personal vault your own logins Team vaults shared with your team 2 Synced, encrypted Encrypted on device Argon2id + AES-256-GCM Server holds ciphertext only upload 3 Used at launch the right login is chosen in order 1 · Personal 2 · Team vault 3 · Shared default Connect
Personal — only you Team — shared Encrypt / connect
A login is stored in your personal vault or a shared team vault, encrypted on your device before it syncs so the server only ever holds an unreadable blob, and chosen by priority when you launch a connection.
The trust part

The server can't read your credentials

Everything is scrambled on your machine before it's uploaded, using your vault passphrase. That passphrase never leaves your device — so even CoreBit can't unlock what it stores.

Your device CoreBit server Your logins from your vaults Key from passphrase Argon2id · memory-hard Encrypt AES-256-GCM Encrypted blob unreadable Your passphrase never leaves the device Stores the blob can't read anything blob only pull back
Your passphrase turns into an encryption key with Argon2id (deliberately slow, to resist guessing), which locks the data with AES-256-GCM. Only the sealed blob is uploaded; pulling it back down and unlocking it happens entirely on your device. Team vaults work identically, with a shared passphrase your team exchanges privately.
Which login

How the right credential is picked

A device can have a login in several places at once. Companion always resolves them in the same order, so a connection opens with a predictable identity.

You launch a connection 1 · Your personal login always preferred 2 · A team vault oldest vault checked first 3 · Shared default last resort Chosen login connect Password manager fetched live, if used optional
Your personal login always wins. If there isn't one, team vaults are checked in the order they were created; a shared default is the final fallback. If a login is stored as a password-manager reference rather than a saved password, the secret is fetched live at the moment you connect — never kept on screen.
In short

What this gives you

Private by design
The server holds only encrypted blobs. Your passphrase and real passwords never leave your device.
Strong encryption
Argon2id key derivation into AES-256-GCM — modern, authenticated, and slow to brute-force.
Personal & team
Keep your own logins private, or share a vault across the team with one agreed passphrase.
Predictable
Personal → team → default. The same connection always opens with the same identity.
Safe teamwork
Team edits are version-checked, so one person's save can't silently overwrite another's.
Password managers
Optionally store a reference instead of a secret; it's resolved live, only when you connect.
get started

Map your network today

Install the free edition on your own hardware and have your first devices on a map in minutes.

Install free editionCompare plans
install.sh
curl -fsSL https://licensing.corebit.ease.dk/install.sh | sudo bash -s