GHOSTSHELL 0.2.0 · Windows 10/11 x64 · MIT · built on Tabby 1.0.238
GHOSTSHELL, the terminal and session manager for Windows engineers. Post-quantum from the key exchange up.
SSH offers four post-quantum hybrid key exchanges ahead of every classical one, led by ML-KEM-768 + X25519, and each tab shows the one the server chose: with any of them, a session recorded today stays sealed as long as either half holds. HTTPS, GhostVault's recovery and sharing, and the release signatures are hybrids too. Where a protocol has no post-quantum option, GHOSTSHELL labels it.
- SSH key exchange
mlkem768x25519-sha256offered first- SHA-256
- 5cef5b521d27…df083e
- Theme packs
- 61 NEON GRID packs · four intensities; Focus is zero motion
- GhostLine
- Tab completion, ghost-text suggestions and Ctrl+R history for cmd.exe
01 Post-quantum foundation
Two locks wherever the protocol allows them.
Hybrid cryptography pairs a post-quantum algorithm (ML-KEM, NTRU Prime, ML-DSA) with a classical one (X25519, P-256, P-384, Ed25519), and the pair holds as long as either half does: a future quantum computer breaks the classical half, a flaw in young post-quantum code the other, and neither opens it alone. On the connections GHOSTSHELL makes itself, it offers a hybrid first wherever the protocol defines one, and says so where none exists.
| Where | In 0.2.0 | Kind |
|---|---|---|
| SSH key exchange | Four post-quantum hybrids offered first, ML-KEM-768 + X25519 leading; each tab shows the one negotiated mlkem768x25519-sha256 | PQ hybrid |
| HTTPS through Node | X25519MLKEM768 first, then ML-KEM-1024 alone, then the classical groups | PQ hybrid |
| GhostVault recovery, escrow, sharing | ML-KEM-1024 + P-384 to encrypt, ML-DSA-87 + P-384 to sign shared bundles | PQ hybrid |
| GhostVault secrets | Argon2id, HKDF-SHA-512, AES-256-GCM | 256-bit symmetric |
| Releases | From 0.2.0, signed with the release key, ML-DSA-44 + Ed25519, and checked in your browser. This version carries no release signature.This version is signed. | Hash onlyPQ hybrid |
| SSH host and user keys, ML-DSA | ML-DSA-44 + Ed25519, asked for first from a server not yet trusted, and usable as your login key; an IETF draft | PQ hybrid |
| SSH host and user keys, classical | Ed25519, ECDSA and RSA, the keys most servers have today | Classical |
| RDP, VNC, Telnet, serial | No post-quantum protection: RDP is Windows' own client, VNC and Telnet are labeled unencrypted, serial is a cable | None |
02 What it is
Haunts every shell. Possesses none.→
For network, infrastructure and DevOps work: it finds the shells already on your machine, opens SSH, serial, Telnet, RDP, VNC and container sessions from one sidebar, and keeps secrets in GhostVault. It never injects code into cmd.exe, never edits your $PROFILE, and sends no telemetry.
A fork of Tabby, with a layer above it.
GHOSTSHELL is a fork of Tabby 1.0.238 (MIT) that keeps the base intact: SSH with jump hosts and port forwarding, SFTP, serial, Telnet, split panes and the plugin system. On top sits GHOSTSHELL's own layer: a session manager in the sidebar, a host status bar along the bottom, GhostLine, GhostVault, the network toolkit, and the NEON GRID and GhostFX look.
- Sidebar
- The session tree: open sessions, shell profiles, folders of hosts · Ctrl+Shift+O
- Tab bar
- Tabs and split panes · Ctrl+Tab switcher with thumbnails
- Terminal
- xterm.js on WebGL, with GhostFX on top
- Status bar
- Hostname, IPv4 and one connection-quality graph
- First run
- The Welcome tab: theme pack and how much motion, plus language, light or dark, and the global hotkey. Ctrl+Space shows and hides the window.
03 In numbers
What ships in 0.2.0, counted.
- NEON GRID theme packs, switched live
- 61
- tool grammars GhostLine completes from
- 17
- session importers: SecureCRT, MobaXterm, PuTTY, WinSCP, Windows Terminal, CSV
- 6
- highlighting packs: Cisco IOS, Junos, Linux logs, web access logs, Kubernetes
- 5
- SSH policies, from Quantum-safe only to Legacy
- 4
- ambient scenes behind the terminal text
- 6
- NSIS installer for Windows 10 and 11, x64
- 133.6 MB
- analytics and telemetry: none in the app, none on this site
- 0
04 On this site
The rest of the site.
- SecurityWhat protects what: SSH key exchange and authentication, HTTPS, GhostVault and releases, and the honest limits of RDP, VNC, Telnet and serial.
- FeaturesGhostLine for cmd.exe, NEON GRID and GhostFX, connections and sessions, and the network toolkit, with live demos.
- DownloadThe installer, the SHA-256 to check it against, the release key, and the way past SmartScreen.
- ResearchTechnical papers on GHOSTSHELL, and the landmark research its cryptography builds on.
- BoardAsk for a feature and vote on the others, without an account.
- AboutWho builds GHOSTSHELL, since when, and on what.
Request timed out.
This hop never answers. GHOSTSHELL has no analytics and no telemetry. This site keeps the same rule: no cookies, no analytics, nothing loaded from anyone else.