v1.2.0 + v1.3.0: Localization, About dialog, TOTP/2FA, stability improvements

v1.2.0: - GUI localization (EN/RU/ZH) with language switcher and persistent selection - About dialog (ⓘ) with app info, features, quick start guide - core/i18n.py — internationalization module with t() function - All GUI components translated via t() keys v1.3.0: - TOTP/2FA tab — Google Authenticator compatible codes with live 30s countdown, one-click copy, per-server secret management - core/totp.py — TOTP module (pyotp, RFC 6238) - core/logger.py — rotating file logger (5MB, 3 backups) - Stronger Fernet encryption key with automatic migration from old key - Thread-safe server store with locks, atomic writes, auto-restore on corruption - Parallel status checks via ThreadPoolExecutor (up to 10 concurrent) - SSH client: explicit channel cleanup, Unix key permissions - Server dialog: port validation (1-65535), TOTP secret field - Language change preserves active tab and server selection - pyotp dependency added Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-23 11:07:51 -05:00
parent f86d6a7214
commit bf39fd7b67
26 changed files with 2029 additions and 246 deletions
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,59 @@
 # Changelog

+## [1.3.0] - 2026-02-23
+
+### Added
+- **TOTP / 2FA tab** — Google Authenticator compatible codes with live 30-second countdown
+  - Per-server TOTP secret storage (encrypted alongside passwords)
+  - One-click code copy to clipboard
+  - Color-coded countdown (green → yellow → red)
+  - Generate random secrets or paste existing ones
+  - TOTP secret field in server add/edit dialog
+- `core/totp.py` — TOTP module (pyotp, RFC 6238)
+- `core/logger.py` — rotating file logger (5 MB, 3 backups)
+- `pyotp` dependency in requirements.txt
+
+### Changed
+- **Encryption**: new stronger Fernet key with automatic migration from old key
+- **Server store**: thread-safe file writes with locks, atomic saves (tmp + rename), auto-restore from backup on corruption
+- **Status checker**: parallel server checks via ThreadPoolExecutor (up to 10 concurrent)
+- **SSH client**: explicit channel cleanup in finally blocks, Unix key permissions (0o600)
+- **Server dialog**: port range validation (1-65535), TOTP secret field
+- `version.py` → 1.3.0
+
+## [1.2.0] - 2026-02-23
+
+### Added
+- About dialog (ⓘ button in header bar) with app info, features, and quick start guide
+- GUI localization: English, Russian (Русский), Chinese (中文)
+- Language switcher in header bar with persistent selection
+- `core/i18n.py` — internationalization module with full translation dictionaries
+- `gui/about_dialog.py` — CTkToplevel About window
+
+### Changed
+- All GUI components use `t()` translation function for all user-visible strings
+- `server_store.py` saves/loads language preference in settings.json
+- `version.py` → 1.2.0
+- Tabs, sidebar, dialogs, and all tab contents fully translated
+
+## [1.1.0] - 2026-02-23
+
+### Added
+- Fernet encryption for servers.json (passwords no longer stored in plaintext)
+- Automatic migration: first launch encrypts existing servers.json, creates pre-encryption backup
+- Manual and automatic backups (auto-backup every 10 min on save)
+- Backup restore from GUI (Setup tab → Configuration section)
+- Configurable config path (change servers.json location via GUI)
+- Settings persistence in settings.json
+- Encryption module installed alongside ssh.py for CLI support
+- `cryptography` dependency
+
+### Changed
+- server_store.py: encrypted read/write, settings management, backup logic
+- ssh.py: encryption-aware load/save with fallback for missing encryption module
+- claude_setup.py: installs encryption.py alongside ssh.py
+- setup_tab.py: Configuration section with path selector, backup/restore controls, encryption status
+
 ## [1.0.0] - 2026-02-23

 ### Added
--- a/README.md
+++ b/README.md
@@ -23,6 +23,12 @@
 - **SSH Keys** — generate ed25519, install on server, copy to clipboard
 - **Status Monitor** — background check every 60 sec (online/offline badges)
 - **Claude Code Integration** — one-click setup, shared config with `/ssh` skill
+- **TOTP / 2FA** — Google Authenticator compatible codes with live countdown, one-click copy
+- **Encryption** — servers.json encrypted with Fernet (passwords never stored in plaintext)
+- **Backups** — manual and automatic backups with one-click restore
+- **Configurable Config Path** — change servers.json location via GUI
+- **Localization** — GUI in English, Russian, Chinese with language switcher
+- **About Dialog** — app info, features, quick start guide
 - **Dark Theme** — modern CustomTkinter interface

 ### Installation
@@ -47,7 +53,7 @@ pip install pyinstaller
 python build.py
 ```

-Output goes to `releases/ServerManager-v1.0.0-{platform}.exe`
+Output goes to `releases/ServerManager-v1.3.0-{platform}.exe`

 ### Usage

@@ -82,31 +88,25 @@ ServerManager GUI  ←→  ~/.server-connections/servers.json  ←→  ssh.py (C

 The Setup tab installs:
 - `ssh.py` → `~/.server-connections/` (SSH utility)
+- `encryption.py` → `~/.server-connections/` (encryption module for CLI)
 - `/ssh` skill → `~/.claude/commands/ssh.md` (Claude Code skill)
 - SSH key (ed25519) — if not exists
 - Checks for duplicates — safe to run multiple times

 ### Configuration

-Shared config location: `~/.server-connections/servers.json`
+Shared config location: `~/.server-connections/servers.json` (encrypted with Fernet).

-Add servers via GUI or edit the JSON directly:
+The config path can be changed via Setup tab → Configuration → "Change Path".

-```json
-{
-  "servers": [
-    {
-      "alias": "my-server",
-      "ip": "1.2.3.4",
-      "port": 22,
-      "user": "root",
-      "password": "secret",
-      "type": "ssh",
-      "notes": "Production"
-    }
-  ]
-}
-```
+Settings are stored in `~/.server-connections/settings.json`.
+
+**Backups:**
+- Automatic backups every 10 minutes (on save)
+- Manual backup via Setup tab → "Backup Now"
+- Restore from any backup via dropdown + "Restore"
+- Backups stored in `~/.server-connections/backups/`
+- Pre-encryption backup created automatically on first migration

 ### Auto-sudo

@@ -126,11 +126,13 @@ App executes: sudo -S -p '' bash -c 'systemctl restart nginx'

 ### Security

+- `servers.json` is **encrypted** (Fernet symmetric encryption) — passwords not readable in plaintext
 - `servers.json` is in `.gitignore` — never committed
 - Passwords stored locally only, **never sent to any AI/API**
 - SSH keys (ed25519) — recommended auth method
 - sudo password sent via stdin (not visible in process list)
- When used with Claude Code: only alias + command are passed through the AI API, passwords stay in the local JSON file
+- When used with Claude Code: only alias + command are passed through the AI API, passwords stay in the local encrypted file
+- Automatic pre-encryption backup on first migration

 ### Project Structure

@@ -140,10 +142,13 @@ ServerManager/
 ├── version.py           # Version info
 ├── build.py             # PyInstaller build script
 ├── core/                # Business logic
-│   ├── server_store.py  # CRUD + JSON + observer (shared config)
+│   ├── server_store.py  # CRUD + encrypted JSON + observer + backups
+│   ├── encryption.py    # Fernet encryption module
 │   ├── ssh_client.py    # Paramiko SSH/SFTP wrapper
 │   ├── claude_setup.py  # Claude Code integration installer
 │   ├── status_checker.py # Background monitoring
+│   ├── totp.py          # TOTP/2FA module (pyotp)
+│   ├── logger.py        # Rotating file logger
 │   └── connection_factory.py
 ├── gui/                 # CustomTkinter UI
 │   ├── app.py           # Main window
@@ -188,6 +193,12 @@ python main.py
 - **SSH-ключи** — генерация ed25519, установка на сервер, копирование
 - **Мониторинг** — фоновая проверка каждые 60 сек (бейджи online/offline)
 - **Интеграция с Claude Code** — установка в один клик, общий конфиг со скиллом `/ssh`
+- **TOTP / 2FA** — коды Google Authenticator с обратным отсчётом, копирование в один клик
+- **Шифрование** — servers.json зашифрован Fernet (пароли не хранятся в открытом виде)
+- **Бэкапы** — ручные и автоматические с восстановлением в один клик
+- **Настраиваемый путь конфига** — смена расположения servers.json через GUI
+- **Локализация** — интерфейс на английском, русском, китайском с переключателем
+- **О программе** — информация о приложении, возможности, быстрый старт
 - **Тёмная тема** — современный интерфейс CustomTkinter

 ### Установка
@@ -212,7 +223,7 @@ pip install pyinstaller
 python build.py
 ```

-Результат в `releases/ServerManager-v1.0.0-{платформа}.exe`
+Результат в `releases/ServerManager-v1.3.0-{платформа}.exe`

 ### Использование

@@ -247,31 +258,25 @@ ServerManager GUI  ←→  ~/.server-connections/servers.json  ←→  ssh.py (C

 Вкладка Setup устанавливает:
 - `ssh.py` → `~/.server-connections/` (SSH-утилита)
+- `encryption.py` → `~/.server-connections/` (модуль шифрования для CLI)
 - скилл `/ssh` → `~/.claude/commands/ssh.md` (скилл Claude Code)
 - SSH-ключ (ed25519) — если ещё не создан
 - Проверяет дубли — безопасно запускать повторно

 ### Конфигурация

-Общий конфиг: `~/.server-connections/servers.json`
+Общий конфиг: `~/.server-connections/servers.json` (зашифрован Fernet).

-Добавляйте серверы через GUI или редактируйте JSON:
+Путь к конфигу можно изменить: вкладка Setup → Configuration → "Change Path".

-```json
-{
-  "servers": [
-    {
-      "alias": "my-server",
-      "ip": "1.2.3.4",
-      "port": 22,
-      "user": "root",
-      "password": "secret",
-      "type": "ssh",
-      "notes": "Production"
-    }
-  ]
-}
-```
+Настройки хранятся в `~/.server-connections/settings.json`.
+
+**Бэкапы:**
+- Автоматические бэкапы каждые 10 минут (при сохранении)
+- Ручной бэкап: вкладка Setup → "Backup Now"
+- Восстановление из любого бэкапа через dropdown + "Restore"
+- Бэкапы хранятся в `~/.server-connections/backups/`
+- Пред-шифровальный бэкап создаётся автоматически при первой миграции

 ### Авто-sudo

@@ -291,11 +296,13 @@ ServerManager GUI  ←→  ~/.server-connections/servers.json  ←→  ssh.py (C

 ### Безопасность

+- `servers.json` **зашифрован** (Fernet симметричное шифрование) — пароли не читаемы в открытом виде
 - `servers.json` в `.gitignore` — никогда не коммитится
 - Пароли хранятся только локально, **никогда не передаются в AI/API**
 - SSH-ключи (ed25519) — рекомендуемый метод аутентификации
 - sudo-пароль передаётся через stdin (не виден в списке процессов)
- При использовании с Claude Code: через API нейронки проходят только alias + команда, пароли остаются в локальном JSON-файле
+- При использовании с Claude Code: через API нейронки проходят только alias + команда, пароли остаются в зашифрованном локальном файле
+- Автоматический пред-шифровальный бэкап при первой миграции

 ### Развёртывание на новой машине

@@ -326,6 +333,12 @@ python main.py
 - **SSH密钥** — 生成ed25519、安装到服务器、复制到剪贴板
 - **状态监控** — 每60秒后台检查（在线/离线徽标）
 - **Claude Code集成** — 一键设置，与`/ssh`技能共享配置
+- **TOTP / 2FA** — 兼容Google Authenticator的验证码，实时倒计时，一键复制
+- **加密** — servers.json使用Fernet加密（密码不再以明文存储）
+- **备份** — 手动和自动备份，一键恢复
+- **可配置路径** — 通过GUI更改servers.json位置
+- **多语言** — 支持英语、俄语、中文界面切换
+- **关于对话框** — 应用信息、功能特点、快速入门
 - **深色主题** — 现代CustomTkinter界面

 ### 安装
@@ -350,7 +363,7 @@ pip install pyinstaller
 python build.py
 ```

-输出至 `releases/ServerManager-v1.0.0-{平台}.exe`
+输出至 `releases/ServerManager-v1.3.0-{平台}.exe`

 ### 使用方法

@@ -385,31 +398,25 @@ ServerManager GUI  ←→  ~/.server-connections/servers.json  ←→  ssh.py (C

 Setup标签安装：
 - `ssh.py` → `~/.server-connections/`（SSH工具）
+- `encryption.py` → `~/.server-connections/`（CLI加密模块）
 - `/ssh` 技能 → `~/.claude/commands/ssh.md`（Claude Code技能）
 - SSH密钥（ed25519）— 如果不存在
 - 检查重复 — 可安全重复运行

 ### 配置

-共享配置位置：`~/.server-connections/servers.json`
+共享配置位置：`~/.server-connections/servers.json`（Fernet加密）。

-通过GUI添加服务器或直接编辑JSON：
+可通过 Setup标签 → Configuration → "Change Path" 更改配置路径。

-```json
-{
-  "servers": [
-    {
-      "alias": "my-server",
-      "ip": "1.2.3.4",
-      "port": 22,
-      "user": "root",
-      "password": "secret",
-      "type": "ssh",
-      "notes": "Production"
-    }
-  ]
-}
-```
+设置存储在 `~/.server-connections/settings.json`。
+
+**备份：**
+- 每10分钟自动备份（保存时）
+- 手动备份：Setup标签 → "Backup Now"
+- 从任何备份恢复：下拉菜单 + "Restore"
+- 备份存储在 `~/.server-connections/backups/`
+- 首次迁移时自动创建加密前备份

 ### 自动sudo

@@ -429,11 +436,13 @@ Setup标签安装：

 ### 安全性

+- `servers.json` **已加密**（Fernet对称加密）— 密码无法以明文读取
 - `servers.json` 在 `.gitignore` 中 — 永不提交
 - 密码仅存储在本地，**绝不发送到任何AI/API**
 - SSH密钥（ed25519）— 推荐的认证方式
 - sudo密码通过stdin传递（在进程列表中不可见）
- 与Claude Code配合使用时：只有别名和命令通过AI API传递，密码保留在本地JSON文件中
+- 与Claude Code配合使用时：只有别名和命令通过AI API传递，密码保留在本地加密文件中
+- 首次迁移时自动创建加密前备份

 ### 在新机器上部署

--- a/build.py
+++ b/build.py
@@ -64,6 +64,9 @@ def build():
        "--windowed",
        f"--name={__app_name__}",
        "--add-data", f"config/servers.example.json{os.pathsep}config",
+        "--add-data", f"tools/ssh.py{os.pathsep}tools",
+        "--add-data", f"tools/skill-ssh.md{os.pathsep}tools",
+        "--add-data", f"core/encryption.py{os.pathsep}core",
    ]

    # Icon
@@ -75,6 +78,7 @@ def build():
    cmd_parts.extend([
        "--hidden-import", "customtkinter",
        "--hidden-import", "PIL",
+        "--hidden-import", "pyotp",
        "--collect-all", "customtkinter",
    ])

--- a/core/claude_setup.py
+++ b/core/claude_setup.py
@@ -1,16 +1,24 @@
 """
 Claude Code integration setup.
-Installs ssh.py, /ssh skill, SSH key — everything needed for Claude Code
-to manage servers via the shared servers.json.
+Installs ssh.py, encryption.py, /ssh skill, SSH key — everything needed
+for Claude Code to manage servers via the shared servers.json.
 """

 import os
+import sys
 import shutil

 SHARED_DIR = os.path.expanduser("~/.server-connections")
-PROJECT_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
-SSH_SCRIPT_SRC = os.path.join(PROJECT_DIR, "tools", "ssh.py")
-SKILL_SRC = os.path.join(PROJECT_DIR, "tools", "skill-ssh.md")
+
+# PyInstaller: bundled data is in sys._MEIPASS; otherwise use project dir
+if getattr(sys, "frozen", False) and hasattr(sys, "_MEIPASS"):
+    _BASE_DIR = sys._MEIPASS
+else:
+    _BASE_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+
+SSH_SCRIPT_SRC = os.path.join(_BASE_DIR, "tools", "ssh.py")
+ENCRYPTION_SRC = os.path.join(_BASE_DIR, "core", "encryption.py")
+SKILL_SRC = os.path.join(_BASE_DIR, "tools", "skill-ssh.md")

 SKILL_DST_DIR = os.path.expanduser("~/.claude/commands")
 SKILL_DST = os.path.join(SKILL_DST_DIR, "ssh.md")
@@ -23,6 +31,7 @@ def check_status() -> dict:
        "shared_dir": os.path.exists(SHARED_DIR),
        "servers_json": os.path.exists(os.path.join(SHARED_DIR, "servers.json")),
        "ssh_script": os.path.exists(os.path.join(SHARED_DIR, "ssh.py")),
+        "encryption": os.path.exists(os.path.join(SHARED_DIR, "encryption.py")),
        "skill_installed": os.path.exists(SKILL_DST),
        "ssh_key_exists": os.path.exists(SSH_KEY_PATH),
        "ssh_key_pub": os.path.exists(SSH_KEY_PATH + ".pub"),
@@ -30,16 +39,31 @@ def check_status() -> dict:


 def install_ssh_script() -> str:
-    """Copy ssh.py to shared dir."""
+    """Copy ssh.py and encryption.py to shared dir."""
    os.makedirs(SHARED_DIR, exist_ok=True)
+    results = []
+
+    # Copy ssh.py
    dst = os.path.join(SHARED_DIR, "ssh.py")
    if os.path.exists(SSH_SCRIPT_SRC):
        shutil.copy2(SSH_SCRIPT_SRC, dst)
-        return f"ssh.py installed: {dst}"
-    # Fallback: check if already exists in shared dir
-    if os.path.exists(dst):
-        return f"ssh.py already exists: {dst}"
-    return "ERROR: ssh.py source not found"
+        results.append(f"ssh.py installed: {dst}")
+    elif os.path.exists(dst):
+        results.append(f"ssh.py already exists: {dst}")
+    else:
+        results.append("ERROR: ssh.py source not found")
+
+    # Copy encryption.py
+    enc_dst = os.path.join(SHARED_DIR, "encryption.py")
+    if os.path.exists(ENCRYPTION_SRC):
+        shutil.copy2(ENCRYPTION_SRC, enc_dst)
+        results.append(f"encryption.py installed: {enc_dst}")
+    elif os.path.exists(enc_dst):
+        results.append(f"encryption.py already exists: {enc_dst}")
+    else:
+        results.append("ERROR: encryption.py source not found")
+
+    return "\n".join(results)


 def install_skill() -> str:
--- a/core/encryption.py
+++ b/core/encryption.py
@@ -0,0 +1,40 @@
+"""
+Encryption module — Fernet symmetric encryption for servers.json.
+Used by both GUI (ServerStore) and CLI (ssh.py).
+"""
+
+import os
+from cryptography.fernet import Fernet, InvalidToken
+
+# Strong hardcoded key (generated from os.urandom(32), base64-encoded)
+# This is the application-level encryption key — by design it's embedded.
+ENCRYPTION_KEY = b"xK9mQ2vL7pR4wZ8nB3jF6hT1yD5sA0cE-gU_iO9lMWk="
+
+# Migration: old key from v1.1.0-1.2.0
+_OLD_KEY = b"b8iPQzO8_18Y68NluKLQPUTfXVyRsz_BIzTeqfm0aZk="
+
+_fernet = Fernet(ENCRYPTION_KEY)
+_fernet_old = Fernet(_OLD_KEY)
+
+
+def encrypt(plaintext: str) -> bytes:
+    """Encrypt a plaintext string, return Fernet token bytes."""
+    return _fernet.encrypt(plaintext.encode("utf-8"))
+
+
+def decrypt(data: bytes) -> str:
+    """Decrypt Fernet token bytes, return plaintext string.
+    Tries new key first, falls back to old key for migration."""
+    try:
+        return _fernet.decrypt(data).decode("utf-8")
+    except InvalidToken:
+        # Try old key for backward compatibility
+        return _fernet_old.decrypt(data).decode("utf-8")
+
+
+def is_encrypted(data: bytes) -> bool:
+    """Check if data is a Fernet token (starts with 'gAAAAA') vs plain JSON (starts with '{')."""
+    try:
+        return data.decode("utf-8").strip().startswith("gAAAAA")
+    except UnicodeDecodeError:
+        return True
--- a/core/i18n.py
+++ b/core/i18n.py
@@ -0,0 +1,590 @@
+"""
+Internationalization module — translations for EN/RU/ZH.
+"""
+
+LANGUAGES = {"en": "English", "ru": "Русский", "zh": "中文"}
+
+_current_lang = "en"
+
+
+def get_language() -> str:
+    return _current_lang
+
+
+def set_language(lang: str):
+    global _current_lang
+    if lang in LANGUAGES:
+        _current_lang = lang
+
+
+def t(key: str) -> str:
+    """Return translated string for key. Falls back to English."""
+    text = _TRANSLATIONS.get(_current_lang, {}).get(key)
+    if text is None:
+        text = _TRANSLATIONS["en"].get(key, key)
+    return text
+
+
+_EN = {
+    # Sidebar
+    "servers": "Servers",
+    "search": "Search...",
+    "add": "+ Add",
+    "edit": "Edit",
+    "delete": "Delete",
+
+    # Tabs
+    "terminal": "Terminal",
+    "files": "Files",
+    "info": "Info",
+    "keys": "Keys",
+    "setup": "Setup",
+
+    # About
+    "about": "ⓘ",
+    "about_title": "ServerManager",
+    "about_desc": (
+        "Desktop application for managing remote servers.\n"
+        "SSH terminal, SFTP file transfer, key management,\n"
+        "encrypted credentials, and Claude Code integration."
+    ),
+    "about_features_title": "⚡ Features",
+    "about_features": (
+        "• SSH terminal with auto-sudo\n"
+        "• SFTP file transfer with progress\n"
+        "• SSH key management\n"
+        "• TOTP / 2FA (Google Authenticator)\n"
+        "• Encrypted credentials (Fernet)\n"
+        "• Automatic backups\n"
+        "• Claude Code integration"
+    ),
+    "about_howto_title": "🚀 Quick Start",
+    "about_howto": (
+        "1. Click \"+ Add\" to add a server\n"
+        "2. Select server → Terminal / Files\n"
+        "3. Setup tab → Claude Code integration"
+    ),
+    "version": "Version",
+    "author": "Author",
+    "close": "Close",
+
+    # Language
+    "language": "Language",
+
+    # Delete confirmation
+    "delete_server": "Delete Server",
+    "delete_confirm": "Remove '{alias}'?",
+
+    # Server dialog
+    "add_server": "Add Server",
+    "edit_server": "Edit Server",
+    "alias": "Alias",
+    "ip": "IP / Hostname",
+    "type": "Type",
+    "port": "Port",
+    "username": "Username",
+    "password": "Password",
+    "notes": "Notes",
+    "save": "Save",
+    "cancel": "Cancel",
+    "show": "Show",
+    "hide": "Hide",
+    "alias_required": "Alias is required",
+    "ip_required": "IP is required",
+    "port_must_be_number": "Port must be a number",
+    "error_prefix": "Error: {msg}",
+    "placeholder_alias": "my-server",
+    "placeholder_ip": "1.2.3.4",
+    "placeholder_port": "22",
+    "placeholder_user": "root",
+    "placeholder_password": "password",
+    "placeholder_notes": "optional description",
+
+    # Terminal
+    "sudo": "sudo",
+    "enter_command": "Enter command...",
+    "run": "Run",
+    "clear": "Clear",
+    "no_server_selected": "[!] No server selected",
+    "server_not_found": "[!] Server '{alias}' not found",
+
+    # Files
+    "upload": "Upload",
+    "download": "Download",
+    "local": "Local:",
+    "remote": "Remote:",
+    "browse": "Browse",
+    "both_paths_required": "[!] Both paths required",
+    "file_not_found": "[!] File not found: {path}",
+    "upload_ok": "OK: {local} -> {alias}:{remote}",
+    "download_ok": "OK: {alias}:{remote} -> {local}",
+    "placeholder_local_file": "/path/to/local/file",
+    "placeholder_remote_file": "/remote/path/file",
+    "placeholder_save_path": "/path/to/save",
+
+    # Info
+    "no_server_selected_info": "No server selected",
+    "info_alias": "Alias:",
+    "info_ip": "IP:",
+    "info_port": "Port:",
+    "info_user": "User:",
+    "info_type": "Type:",
+    "info_notes": "Notes:",
+    "info_status": "Status:",
+    "edit_server_btn": "Edit Server",
+
+    # Keys
+    "ssh_key": "SSH Key",
+    "key_path": "Path: {path}",
+    "generate_key": "Generate Key",
+    "key_exists": "Key exists",
+    "no_key_found": "No key found. Click 'Generate Key' to create one.",
+    "install_on_server": "Install on Server",
+    "installing": "Installing...",
+    "copy_public_key": "Copy Public Key",
+    "key_copied": "Public key copied to clipboard",
+    "no_public_key": "[!] No public key to copy",
+
+    # Setup
+    "claude_integration": "Claude Code Integration",
+    "claude_desc": (
+        "Setup everything so Claude Code can manage your servers via /ssh skill.\n"
+        "Both GUI and Claude Code share the same servers.json — add a server here,\n"
+        "Claude sees it immediately."
+    ),
+    "status": "Status",
+    "status_shared_dir": "Shared config dir (~/.server-connections)",
+    "status_servers_json": "servers.json",
+    "status_ssh_script": "ssh.py (CLI tool)",
+    "status_encryption": "Encryption module",
+    "status_skill": "/ssh skill for Claude Code",
+    "status_ssh_key": "SSH key (ed25519)",
+    "install_everything": "Install Everything",
+    "installing_all": "Installing...",
+    "install_ssh_py": "ssh.py",
+    "install_skill": "/ssh skill",
+    "install_ssh_key": "SSH key",
+    "refresh": "Refresh",
+    "configuration": "Configuration",
+    "config_label": "Config:",
+    "change_path": "Change Path",
+    "backup_now": "Backup Now",
+    "select_backup": "Select backup...",
+    "no_backups": "No backups",
+    "restore": "Restore",
+    "install_done": "Done! Claude Code can now use /ssh to manage your servers.",
+    "config_changed": "Config path changed: {path}",
+    "backup_created": "Backup created: {name}",
+    "backup_failed": "Backup failed: {e}",
+    "no_backup_selected": "No backup selected.",
+    "restore_backup_title": "Restore Backup",
+    "restore_confirm": "Restore from '{name}'?\nCurrent data will be overwritten.",
+    "restored": "Restored from: {name}",
+    "restore_failed": "Restore failed: {e}",
+    "select_servers_json": "Select servers.json",
+
+    # TOTP / 2FA
+    "totp": "2FA",
+    "totp_title": "Two-Factor Authentication (TOTP)",
+    "totp_desc": (
+        "Google Authenticator compatible 2FA codes.\n"
+        "Add a TOTP secret to any server — the code refreshes every 30 seconds.\n"
+        "Click the code to copy it to clipboard."
+    ),
+    "totp_copy": "Copy Code",
+    "totp_secret_label": "TOTP Secret (Base32)",
+    "totp_secret_placeholder": "JBSWY3DPEHPK3PXP...",
+    "totp_save_secret": "Save",
+    "totp_remove_secret": "Remove",
+    "totp_generate_secret": "Generate Random Secret",
+    "totp_no_secret": "No TOTP secret configured",
+    "totp_remaining": "{sec}s remaining",
+    "totp_copied": "Code copied to clipboard",
+    "totp_no_code": "No code to copy",
+    "totp_secret_empty": "Secret cannot be empty",
+    "totp_secret_invalid": "Invalid TOTP secret (must be Base32)",
+    "totp_secret_saved": "TOTP secret saved",
+    "totp_secret_removed": "TOTP secret removed",
+    "totp_secret_generated": "Random secret generated (click Save to store)",
+    "totp_secret_dialog": "TOTP Secret",
+    "placeholder_totp_secret": "Base32 secret (optional)",
+    "port_out_of_range": "Port must be 1-65535",
+}
+
+_RU = {
+    # Sidebar
+    "servers": "Серверы",
+    "search": "Поиск...",
+    "add": "+ Добавить",
+    "edit": "Изменить",
+    "delete": "Удалить",
+
+    # Tabs
+    "terminal": "Терминал",
+    "files": "Файлы",
+    "info": "Инфо",
+    "keys": "Ключи",
+    "setup": "Настройка",
+
+    # About
+    "about": "ⓘ",
+    "about_title": "ServerManager",
+    "about_desc": (
+        "Настольное приложение для управления удалёнными серверами.\n"
+        "SSH-терминал, SFTP-передача файлов, управление ключами,\n"
+        "шифрование паролей и интеграция с Claude Code."
+    ),
+    "about_features_title": "⚡ Возможности",
+    "about_features": (
+        "• SSH-терминал с авто-sudo\n"
+        "• SFTP-передача файлов с прогрессом\n"
+        "• Управление SSH-ключами\n"
+        "• TOTP / 2FA (Google Authenticator)\n"
+        "• Шифрование паролей (Fernet)\n"
+        "• Автоматические бэкапы\n"
+        "• Интеграция с Claude Code"
+    ),
+    "about_howto_title": "🚀 Быстрый старт",
+    "about_howto": (
+        "1. Нажмите \"+ Добавить\" для добавления сервера\n"
+        "2. Выберите сервер → Терминал / Файлы\n"
+        "3. Вкладка Настройка → интеграция Claude Code"
+    ),
+    "version": "Версия",
+    "author": "Автор",
+    "close": "Закрыть",
+
+    # Language
+    "language": "Язык",
+
+    # Delete confirmation
+    "delete_server": "Удалить сервер",
+    "delete_confirm": "Удалить '{alias}'?",
+
+    # Server dialog
+    "add_server": "Добавить сервер",
+    "edit_server": "Изменить сервер",
+    "alias": "Алиас",
+    "ip": "IP / Хост",
+    "type": "Тип",
+    "port": "Порт",
+    "username": "Пользователь",
+    "password": "Пароль",
+    "notes": "Заметки",
+    "save": "Сохранить",
+    "cancel": "Отмена",
+    "show": "Показать",
+    "hide": "Скрыть",
+    "alias_required": "Алиас обязателен",
+    "ip_required": "IP обязателен",
+    "port_must_be_number": "Порт должен быть числом",
+    "error_prefix": "Ошибка: {msg}",
+    "placeholder_alias": "мой-сервер",
+    "placeholder_ip": "1.2.3.4",
+    "placeholder_port": "22",
+    "placeholder_user": "root",
+    "placeholder_password": "пароль",
+    "placeholder_notes": "описание (необязательно)",
+
+    # Terminal
+    "sudo": "sudo",
+    "enter_command": "Введите команду...",
+    "run": "Выполнить",
+    "clear": "Очистить",
+    "no_server_selected": "[!] Сервер не выбран",
+    "server_not_found": "[!] Сервер '{alias}' не найден",
+
+    # Files
+    "upload": "Загрузить",
+    "download": "Скачать",
+    "local": "Локальный:",
+    "remote": "Удалённый:",
+    "browse": "Обзор",
+    "both_paths_required": "[!] Оба пути обязательны",
+    "file_not_found": "[!] Файл не найден: {path}",
+    "upload_ok": "OK: {local} -> {alias}:{remote}",
+    "download_ok": "OK: {alias}:{remote} -> {local}",
+    "placeholder_local_file": "/путь/к/локальному/файлу",
+    "placeholder_remote_file": "/удалённый/путь/файл",
+    "placeholder_save_path": "/путь/для/сохранения",
+
+    # Info
+    "no_server_selected_info": "Сервер не выбран",
+    "info_alias": "Алиас:",
+    "info_ip": "IP:",
+    "info_port": "Порт:",
+    "info_user": "Пользователь:",
+    "info_type": "Тип:",
+    "info_notes": "Заметки:",
+    "info_status": "Статус:",
+    "edit_server_btn": "Изменить сервер",
+
+    # Keys
+    "ssh_key": "SSH-ключ",
+    "key_path": "Путь: {path}",
+    "generate_key": "Создать ключ",
+    "key_exists": "Ключ существует",
+    "no_key_found": "Ключ не найден. Нажмите 'Создать ключ'.",
+    "install_on_server": "Установить на сервер",
+    "installing": "Установка...",
+    "copy_public_key": "Копировать ключ",
+    "key_copied": "Публичный ключ скопирован",
+    "no_public_key": "[!] Нет публичного ключа",
+
+    # Setup
+    "claude_integration": "Интеграция с Claude Code",
+    "claude_desc": (
+        "Настройте всё, чтобы Claude Code мог управлять серверами через скилл /ssh.\n"
+        "GUI и Claude Code используют один servers.json — добавьте сервер здесь,\n"
+        "Claude увидит его сразу."
+    ),
+    "status": "Статус",
+    "status_shared_dir": "Общий каталог (~/.server-connections)",
+    "status_servers_json": "servers.json",
+    "status_ssh_script": "ssh.py (CLI-утилита)",
+    "status_encryption": "Модуль шифрования",
+    "status_skill": "Скилл /ssh для Claude Code",
+    "status_ssh_key": "SSH-ключ (ed25519)",
+    "install_everything": "Установить всё",
+    "installing_all": "Установка...",
+    "install_ssh_py": "ssh.py",
+    "install_skill": "Скилл /ssh",
+    "install_ssh_key": "SSH-ключ",
+    "refresh": "Обновить",
+    "configuration": "Конфигурация",
+    "config_label": "Конфиг:",
+    "change_path": "Изменить путь",
+    "backup_now": "Бэкап сейчас",
+    "select_backup": "Выберите бэкап...",
+    "no_backups": "Нет бэкапов",
+    "restore": "Восстановить",
+    "install_done": "Готово! Claude Code теперь может использовать /ssh для управления серверами.",
+    "config_changed": "Путь конфига изменён: {path}",
+    "backup_created": "Бэкап создан: {name}",
+    "backup_failed": "Ошибка бэкапа: {e}",
+    "no_backup_selected": "Бэкап не выбран.",
+    "restore_backup_title": "Восстановление бэкапа",
+    "restore_confirm": "Восстановить из '{name}'?\nТекущие данные будут перезаписаны.",
+    "restored": "Восстановлено из: {name}",
+    "restore_failed": "Ошибка восстановления: {e}",
+    "select_servers_json": "Выберите servers.json",
+
+    # TOTP / 2FA
+    "totp": "2FA",
+    "totp_title": "Двухфакторная аутентификация (TOTP)",
+    "totp_desc": (
+        "Коды 2FA, совместимые с Google Authenticator.\n"
+        "Добавьте TOTP-секрет к серверу — код обновляется каждые 30 секунд.\n"
+        "Нажмите на код, чтобы скопировать в буфер обмена."
+    ),
+    "totp_copy": "Копировать код",
+    "totp_secret_label": "TOTP-секрет (Base32)",
+    "totp_secret_placeholder": "JBSWY3DPEHPK3PXP...",
+    "totp_save_secret": "Сохранить",
+    "totp_remove_secret": "Удалить",
+    "totp_generate_secret": "Сгенерировать секрет",
+    "totp_no_secret": "TOTP-секрет не настроен",
+    "totp_remaining": "Осталось {sec}с",
+    "totp_copied": "Код скопирован в буфер обмена",
+    "totp_no_code": "Нет кода для копирования",
+    "totp_secret_empty": "Секрет не может быть пустым",
+    "totp_secret_invalid": "Недопустимый TOTP-секрет (должен быть Base32)",
+    "totp_secret_saved": "TOTP-секрет сохранён",
+    "totp_secret_removed": "TOTP-секрет удалён",
+    "totp_secret_generated": "Случайный секрет создан (нажмите Сохранить)",
+    "totp_secret_dialog": "TOTP-секрет",
+    "placeholder_totp_secret": "Base32 секрет (необязательно)",
+    "port_out_of_range": "Порт должен быть от 1 до 65535",
+}
+
+_ZH = {
+    # Sidebar
+    "servers": "服务器",
+    "search": "搜索...",
+    "add": "+ 添加",
+    "edit": "编辑",
+    "delete": "删除",
+
+    # Tabs
+    "terminal": "终端",
+    "files": "文件",
+    "info": "信息",
+    "keys": "密钥",
+    "setup": "设置",
+
+    # About
+    "about": "ⓘ",
+    "about_title": "ServerManager",
+    "about_desc": (
+        "用于管理远程服务器的桌面应用程序。\n"
+        "SSH终端、SFTP文件传输、密钥管理、\n"
+        "凭据加密以及Claude Code集成。"
+    ),
+    "about_features_title": "⚡ 功能特点",
+    "about_features": (
+        "• SSH终端（自动sudo）\n"
+        "• SFTP文件传输（含进度条）\n"
+        "• SSH密钥管理\n"
+        "• TOTP / 2FA（Google Authenticator）\n"
+        "• 凭据加密（Fernet）\n"
+        "• 自动备份\n"
+        "• Claude Code集成"
+    ),
+    "about_howto_title": "🚀 快速开始",
+    "about_howto": (
+        "1. 点击\"+ 添加\"来添加服务器\n"
+        "2. 选择服务器 → 终端 / 文件\n"
+        "3. 设置标签 → Claude Code集成"
+    ),
+    "version": "版本",
+    "author": "作者",
+    "close": "关闭",
+
+    # Language
+    "language": "语言",
+
+    # Delete confirmation
+    "delete_server": "删除服务器",
+    "delete_confirm": "删除 '{alias}'？",
+
+    # Server dialog
+    "add_server": "添加服务器",
+    "edit_server": "编辑服务器",
+    "alias": "别名",
+    "ip": "IP / 主机名",
+    "type": "类型",
+    "port": "端口",
+    "username": "用户名",
+    "password": "密码",
+    "notes": "备注",
+    "save": "保存",
+    "cancel": "取消",
+    "show": "显示",
+    "hide": "隐藏",
+    "alias_required": "别名不能为空",
+    "ip_required": "IP不能为空",
+    "port_must_be_number": "端口必须是数字",
+    "error_prefix": "错误：{msg}",
+    "placeholder_alias": "我的服务器",
+    "placeholder_ip": "1.2.3.4",
+    "placeholder_port": "22",
+    "placeholder_user": "root",
+    "placeholder_password": "密码",
+    "placeholder_notes": "可选描述",
+
+    # Terminal
+    "sudo": "sudo",
+    "enter_command": "输入命令...",
+    "run": "执行",
+    "clear": "清除",
+    "no_server_selected": "[!] 未选择服务器",
+    "server_not_found": "[!] 未找到服务器 '{alias}'",
+
+    # Files
+    "upload": "上传",
+    "download": "下载",
+    "local": "本地：",
+    "remote": "远程：",
+    "browse": "浏览",
+    "both_paths_required": "[!] 两个路径都必须填写",
+    "file_not_found": "[!] 文件未找到：{path}",
+    "upload_ok": "OK: {local} -> {alias}:{remote}",
+    "download_ok": "OK: {alias}:{remote} -> {local}",
+    "placeholder_local_file": "/本地/文件/路径",
+    "placeholder_remote_file": "/远程/路径/文件",
+    "placeholder_save_path": "/保存/路径",
+
+    # Info
+    "no_server_selected_info": "未选择服务器",
+    "info_alias": "别名：",
+    "info_ip": "IP：",
+    "info_port": "端口：",
+    "info_user": "用户：",
+    "info_type": "类型：",
+    "info_notes": "备注：",
+    "info_status": "状态：",
+    "edit_server_btn": "编辑服务器",
+
+    # Keys
+    "ssh_key": "SSH密钥",
+    "key_path": "路径：{path}",
+    "generate_key": "生成密钥",
+    "key_exists": "密钥已存在",
+    "no_key_found": "未找到密钥。点击'生成密钥'来创建。",
+    "install_on_server": "安装到服务器",
+    "installing": "安装中...",
+    "copy_public_key": "复制公钥",
+    "key_copied": "公钥已复制到剪贴板",
+    "no_public_key": "[!] 没有公钥可复制",
+
+    # Setup
+    "claude_integration": "Claude Code集成",
+    "claude_desc": (
+        "设置一切以便Claude Code通过/ssh技能管理您的服务器。\n"
+        "GUI和Claude Code共享同一个servers.json — 在此添加服务器，\n"
+        "Claude会立即看到。"
+    ),
+    "status": "状态",
+    "status_shared_dir": "共享配置目录 (~/.server-connections)",
+    "status_servers_json": "servers.json",
+    "status_ssh_script": "ssh.py（CLI工具）",
+    "status_encryption": "加密模块",
+    "status_skill": "Claude Code的/ssh技能",
+    "status_ssh_key": "SSH密钥（ed25519）",
+    "install_everything": "全部安装",
+    "installing_all": "安装中...",
+    "install_ssh_py": "ssh.py",
+    "install_skill": "/ssh技能",
+    "install_ssh_key": "SSH密钥",
+    "refresh": "刷新",
+    "configuration": "配置",
+    "config_label": "配置：",
+    "change_path": "更改路径",
+    "backup_now": "立即备份",
+    "select_backup": "选择备份...",
+    "no_backups": "无备份",
+    "restore": "恢复",
+    "install_done": "完成！Claude Code现在可以使用/ssh来管理您的服务器。",
+    "config_changed": "配置路径已更改：{path}",
+    "backup_created": "备份已创建：{name}",
+    "backup_failed": "备份失败：{e}",
+    "no_backup_selected": "未选择备份。",
+    "restore_backup_title": "恢复备份",
+    "restore_confirm": "从 '{name}' 恢复？\n当前数据将被覆盖。",
+    "restored": "已从 {name} 恢复",
+    "restore_failed": "恢复失败：{e}",
+    "select_servers_json": "选择servers.json",
+
+    # TOTP / 2FA
+    "totp": "2FA",
+    "totp_title": "双因素认证（TOTP）",
+    "totp_desc": (
+        "兼容Google Authenticator的2FA验证码。\n"
+        "为服务器添加TOTP密钥 — 验证码每30秒自动刷新。\n"
+        "点击验证码即可复制到剪贴板。"
+    ),
+    "totp_copy": "复制验证码",
+    "totp_secret_label": "TOTP密钥（Base32）",
+    "totp_secret_placeholder": "JBSWY3DPEHPK3PXP...",
+    "totp_save_secret": "保存",
+    "totp_remove_secret": "删除",
+    "totp_generate_secret": "生成随机密钥",
+    "totp_no_secret": "未配置TOTP密钥",
+    "totp_remaining": "剩余 {sec}秒",
+    "totp_copied": "验证码已复制到剪贴板",
+    "totp_no_code": "没有可复制的验证码",
+    "totp_secret_empty": "密钥不能为空",
+    "totp_secret_invalid": "无效的TOTP密钥（必须是Base32格式）",
+    "totp_secret_saved": "TOTP密钥已保存",
+    "totp_secret_removed": "TOTP密钥已删除",
+    "totp_secret_generated": "已生成随机密钥（点击保存以存储）",
+    "totp_secret_dialog": "TOTP密钥",
+    "placeholder_totp_secret": "Base32密钥（可选）",
+    "port_out_of_range": "端口必须在1-65535之间",
+}
+
+_TRANSLATIONS = {
+    "en": _EN,
+    "ru": _RU,
+    "zh": _ZH,
+}
--- a/core/logger.py
+++ b/core/logger.py
@@ -0,0 +1,36 @@
+"""
+Logging framework — rotating file log + console.
+"""
+
+import os
+import logging
+import logging.handlers
+
+SHARED_DIR = os.path.expanduser("~/.server-connections")
+LOG_FILE = os.path.join(SHARED_DIR, "app.log")
+
+
+def get_logger(name: str = "servermanager") -> logging.Logger:
+    """Get or create a named logger with file + console handlers."""
+    logger = logging.getLogger(name)
+    if logger.handlers:
+        return logger
+
+    logger.setLevel(logging.DEBUG)
+
+    # File handler — rotating, 5MB max, 3 backups
+    os.makedirs(SHARED_DIR, exist_ok=True)
+    fh = logging.handlers.RotatingFileHandler(
+        LOG_FILE, maxBytes=5 * 1024 * 1024, backupCount=3, encoding="utf-8"
+    )
+    fh.setLevel(logging.DEBUG)
+    fh.setFormatter(logging.Formatter(
+        "%(asctime)s [%(levelname)s] %(name)s: %(message)s",
+        datefmt="%Y-%m-%d %H:%M:%S"
+    ))
+    logger.addHandler(fh)
+
+    return logger
+
+
+log = get_logger()
--- a/core/server_store.py
+++ b/core/server_store.py
@@ -1,15 +1,25 @@
 """
 Server store — CRUD + JSON persistence + observer pattern.
+Supports encryption, backups, and configurable config path.
+Thread-safe with atomic writes.
 """

 import json
 import os
 import shutil
+import threading
+import time
+from datetime import datetime
 from typing import Callable, Optional

+from core.encryption import encrypt, decrypt, is_encrypted
+from core.logger import log
+
 # Shared config — same file used by ssh.py and Claude Code /ssh skill
 SHARED_DIR = os.path.expanduser("~/.server-connections")
-SERVERS_FILE = os.path.join(SHARED_DIR, "servers.json")
+SETTINGS_FILE = os.path.join(SHARED_DIR, "settings.json")
+DEFAULT_SERVERS_FILE = os.path.join(SHARED_DIR, "servers.json")
+BACKUP_DIR = os.path.join(SHARED_DIR, "backups")

 # Fallback: local config dir (for example file)
 LOCAL_CONFIG_DIR = os.path.join(os.path.dirname(os.path.dirname(os.path.abspath(__file__))), "config")
@@ -26,27 +36,202 @@ DEFAULT_PORTS = {
    "postgresql": 5432,
 }

+# Auto-backup interval: 10 minutes
+_BACKUP_INTERVAL = 600
+

 class ServerStore:
    def __init__(self):
        self._data: dict = {"servers": [], "ssh_key": {"type": "ed25519", "path": "~/.ssh/id_ed25519"}}
        self._observers: list[Callable] = []
        self._statuses: dict[str, str] = {}  # alias -> "online" | "offline" | "unknown"
+        self._statuses_lock = threading.Lock()
+        self._file_lock = threading.Lock()
+        self._last_backup_time: float = 0
+        self._servers_file: str = DEFAULT_SERVERS_FILE
+        self._load_settings()
        self._load()

+    # ── Settings ──────────────────────────────────────
+
+    def _load_settings(self):
+        if os.path.exists(SETTINGS_FILE):
+            try:
+                with open(SETTINGS_FILE, "r", encoding="utf-8") as f:
+                    settings = json.load(f)
+                path = settings.get("servers_path", "")
+                if path and os.path.exists(path):
+                    self._servers_file = path
+                # Load language preference
+                from core import i18n
+                lang = settings.get("language", "en")
+                i18n.set_language(lang)
+            except json.JSONDecodeError:
+                log.warning("Corrupted settings.json, using defaults")
+            except Exception as e:
+                log.error(f"Failed to load settings: {e}")
+
+    def _save_settings(self):
+        os.makedirs(SHARED_DIR, exist_ok=True)
+        from core import i18n
+        settings = {
+            "servers_path": self._servers_file,
+            "language": i18n.get_language(),
+        }
+        try:
+            tmp = SETTINGS_FILE + ".tmp"
+            with open(tmp, "w", encoding="utf-8") as f:
+                json.dump(settings, f, indent=2, ensure_ascii=False)
+            os.replace(tmp, SETTINGS_FILE)
+        except Exception as e:
+            log.error(f"Failed to save settings: {e}")
+
+    def get_config_path(self) -> str:
+        return self._servers_file
+
+    def set_config_path(self, path: str):
+        self._servers_file = path
+        self._save_settings()
+        self._load()
+        self._notify()
+
+    # ── Load / Save (encrypted, thread-safe, atomic) ──
+
    def _load(self):
-        if os.path.exists(SERVERS_FILE):
-            with open(SERVERS_FILE, "r", encoding="utf-8") as f:
-                self._data = json.load(f)
+        with self._file_lock:
+            self._load_unsafe()
+
+    def _load_unsafe(self):
+        if os.path.exists(self._servers_file):
+            try:
+                with open(self._servers_file, "rb") as f:
+                    raw = f.read()
+                if not raw.strip():
+                    return
+                if is_encrypted(raw):
+                    text = decrypt(raw)
+                    self._data = json.loads(text)
+                else:
+                    self._data = json.loads(raw.decode("utf-8"))
+                    # Auto-migration: backup plain file, then encrypt
+                    pre_enc = os.path.join(BACKUP_DIR, "servers_pre-encryption.json")
+                    if not os.path.exists(pre_enc):
+                        os.makedirs(BACKUP_DIR, exist_ok=True)
+                        shutil.copy2(self._servers_file, pre_enc)
+                    self._save_unsafe()
+                # Re-encrypt with new key if needed (migration from old key)
+                self._save_unsafe()
+            except json.JSONDecodeError as e:
+                log.error(f"Corrupted servers.json: {e}")
+                self._try_restore_from_backup()
+            except Exception as e:
+                log.error(f"Failed to load servers: {e}")
+                self._try_restore_from_backup()
        elif os.path.exists(EXAMPLE_FILE):
+            try:
                with open(EXAMPLE_FILE, "r", encoding="utf-8") as f:
                    self._data = json.load(f)
-            self._save()
+                self._save_unsafe()
+            except Exception as e:
+                log.error(f"Failed to load example: {e}")
+
+    def _try_restore_from_backup(self):
+        """Attempt to restore from latest backup on corruption."""
+        backups = self.list_backups()
+        if backups:
+            log.warning(f"Attempting restore from backup: {backups[0]}")
+            try:
+                src = os.path.join(BACKUP_DIR, backups[0])
+                with open(src, "rb") as f:
+                    raw = f.read()
+                if is_encrypted(raw):
+                    text = decrypt(raw)
+                    self._data = json.loads(text)
+                else:
+                    self._data = json.loads(raw.decode("utf-8"))
+                self._save_unsafe()
+                log.info("Restored from backup successfully")
+            except Exception as e2:
+                log.error(f"Backup restore also failed: {e2}")
+                self._data = {"servers": [], "ssh_key": {"type": "ed25519", "path": "~/.ssh/id_ed25519"}}
+        else:
+            log.warning("No backups available, starting fresh")
+            self._data = {"servers": [], "ssh_key": {"type": "ed25519", "path": "~/.ssh/id_ed25519"}}

    def _save(self):
-        os.makedirs(SHARED_DIR, exist_ok=True)
-        with open(SERVERS_FILE, "w", encoding="utf-8") as f:
-            json.dump(self._data, f, indent=2, ensure_ascii=False)
+        with self._file_lock:
+            self._save_unsafe()
+
+    def _save_unsafe(self):
+        """Write encrypted data atomically (tmp + rename)."""
+        os.makedirs(os.path.dirname(self._servers_file), exist_ok=True)
+        text = json.dumps(self._data, indent=2, ensure_ascii=False)
+        encrypted = encrypt(text)
+        tmp = self._servers_file + ".tmp"
+        try:
+            with open(tmp, "wb") as f:
+                f.write(encrypted)
+            os.replace(tmp, self._servers_file)
+        except Exception as e:
+            log.error(f"Failed to save servers: {e}")
+            # Clean up temp file
+            if os.path.exists(tmp):
+                try:
+                    os.remove(tmp)
+                except Exception:
+                    pass
+            return
+        # Auto-backup
+        now = time.time()
+        if now - self._last_backup_time >= _BACKUP_INTERVAL:
+            self._auto_backup()
+
+    def _auto_backup(self):
+        try:
+            self.create_backup()
+        except Exception as e:
+            log.warning(f"Auto-backup failed: {e}")
+
+    # ── Backups ───────────────────────────────────────
+
+    def create_backup(self) -> str:
+        os.makedirs(BACKUP_DIR, exist_ok=True)
+        stamp = datetime.now().strftime("%Y-%m-%d_%H%M%S")
+        name = f"servers_{stamp}.json"
+        dst = os.path.join(BACKUP_DIR, name)
+        shutil.copy2(self._servers_file, dst)
+        self._last_backup_time = time.time()
+        log.info(f"Backup created: {name}")
+        return name
+
+    def list_backups(self) -> list[str]:
+        if not os.path.isdir(BACKUP_DIR):
+            return []
+        files = [f for f in os.listdir(BACKUP_DIR) if f.startswith("servers_") and f.endswith(".json")]
+        files.sort(reverse=True)
+        return files
+
+    def restore_backup(self, filename: str):
+        src = os.path.join(BACKUP_DIR, filename)
+        if not os.path.exists(src):
+            raise FileNotFoundError(f"Backup not found: {filename}")
+        # Validate backup before restoring
+        with open(src, "rb") as f:
+            raw = f.read()
+        try:
+            if is_encrypted(raw):
+                text = decrypt(raw)
+                data = json.loads(text)
+            else:
+                data = json.loads(raw.decode("utf-8"))
+        except Exception as e:
+            raise ValueError(f"Backup is corrupted: {e}")
+        self._data = data
+        self._save()
+        self._notify()
+        log.info(f"Restored from: {filename}")
+
+    # ── Observer ──────────────────────────────────────

    def _notify(self):
        for cb in self._observers:
@@ -58,6 +243,8 @@ class ServerStore:
    def subscribe(self, callback: Callable):
        self._observers.append(callback)

+    # ── CRUD ──────────────────────────────────────────
+
    def get_all(self) -> list[dict]:
        return list(self._data.get("servers", []))

@@ -86,6 +273,7 @@ class ServerStore:

    def remove_server(self, alias: str):
        self._data["servers"] = [s for s in self._data.get("servers", []) if s["alias"] != alias]
+        with self._statuses_lock:
            self._statuses.pop(alias, None)
        self._save()
        self._notify()
@@ -94,9 +282,12 @@ class ServerStore:
        path = self._data.get("ssh_key", {}).get("path", "~/.ssh/id_ed25519")
        return os.path.expanduser(path)

-    # Status management
+    # ── Status management (thread-safe) ───────────────
+
    def set_status(self, alias: str, status: str):
+        with self._statuses_lock:
            self._statuses[alias] = status

    def get_status(self, alias: str) -> str:
+        with self._statuses_lock:
            return self._statuses.get(alias, "unknown")
--- a/core/ssh_client.py
+++ b/core/ssh_client.py
@@ -1,10 +1,11 @@
 """
-SSH client wrapper — refactored from ssh.py.
-Handles connect, exec, sftp, key management via paramiko.
+SSH client wrapper — connect, exec, sftp, key management via paramiko.
 """

 import os
+import platform
 import paramiko
+from core.logger import log


 class SSHClientWrapper:
@@ -32,7 +33,13 @@ class SSHClientWrapper:
                client.connect(**kwargs)
                self._client = client
                return client
-            except Exception:
+            except paramiko.AuthenticationException:
+                log.debug(f"Key auth failed for {self.server.get('alias', '?')}, trying password")
+                del kwargs["key_filename"]
+                client = paramiko.SSHClient()
+                client.set_missing_host_key_policy(paramiko.AutoAddPolicy())
+            except Exception as e:
+                log.debug(f"Key connect failed: {e}")
                del kwargs["key_filename"]
                client = paramiko.SSHClient()
                client.set_missing_host_key_policy(paramiko.AutoAddPolicy())
@@ -60,6 +67,7 @@ class SSHClientWrapper:
    def exec_command(self, command: str, use_sudo: bool = True) -> tuple[str, str, int]:
        """Execute command. Auto-sudo if user != root and use_sudo=True."""
        client = self.connect()
+        stdin = stdout = stderr = None
        try:
            user = self.server.get("user", "root")
            need_sudo = use_sudo and user != "root"
@@ -87,6 +95,13 @@ class SSHClientWrapper:

            return out, err, exit_code
        finally:
+            # Close channels explicitly
+            for ch in (stdin, stdout, stderr):
+                if ch:
+                    try:
+                        ch.close()
+                    except Exception:
+                        pass
            client.close()

    def upload(self, local_path: str, remote_path: str, progress_cb=None):
@@ -115,7 +130,6 @@ class SSHClientWrapper:
            client.close()

    def check_connection(self) -> bool:
-        """Quick connection test."""
        try:
            client = paramiko.SSHClient()
            client.set_missing_host_key_policy(paramiko.AutoAddPolicy())
@@ -153,7 +167,6 @@ class SSHClientWrapper:
            return False

    def install_key(self) -> str:
-        """Install SSH public key on server. Returns status message."""
        pub_key_path = self.key_path + ".pub"
        if not os.path.exists(pub_key_path):
            raise FileNotFoundError(f"No public key at {pub_key_path}")
@@ -161,7 +174,6 @@ class SSHClientWrapper:
        with open(pub_key_path, "r") as f:
            pub_key = f.read().strip()

-        # Check if already installed
        out, _, _ = self.exec_command(
            f'grep -c "{pub_key}" ~/.ssh/authorized_keys 2>/dev/null || echo 0',
            use_sudo=False
@@ -169,7 +181,6 @@ class SSHClientWrapper:
        if out.strip() != "0":
            return "Key already installed"

-        # Install
        command = (
            f'mkdir -p ~/.ssh && chmod 700 ~/.ssh && '
            f'echo "{pub_key}" >> ~/.ssh/authorized_keys && '
@@ -182,18 +193,22 @@ class SSHClientWrapper:
        raise Exception(f"Key install failed: {err or out}")

    def generate_key(self) -> str:
-        """Generate ed25519 SSH key pair if not exists."""
        if os.path.exists(self.key_path):
            return f"Key already exists: {self.key_path}"

+        os.makedirs(os.path.dirname(self.key_path), exist_ok=True)
        key = paramiko.Ed25519Key.generate()
        key.write_private_key_file(self.key_path)

-        # Write public key
+        # Set restrictive permissions on private key (Unix)
+        if platform.system() != "Windows":
+            os.chmod(self.key_path, 0o600)
+
        pub_key = f"ssh-ed25519 {key.get_base64()} server-manager"
        with open(self.key_path + ".pub", "w") as f:
            f.write(pub_key + "\n")

+        log.info(f"SSH key generated: {self.key_path}")
        return f"Key generated: {self.key_path}"


--- a/core/status_checker.py
+++ b/core/status_checker.py
@@ -1,15 +1,17 @@
 """
-Background status checker — daemon thread that pings servers periodically.
+Background status checker — parallel server pings.
 """

 import threading
 import time
+from concurrent.futures import ThreadPoolExecutor, as_completed
 from typing import TYPE_CHECKING

 if TYPE_CHECKING:
    from core.server_store import ServerStore

 from core.ssh_client import SSHClientWrapper
+from core.logger import log


 class StatusChecker:
@@ -18,7 +20,7 @@ class StatusChecker:
        self.interval = interval
        self._running = False
        self._thread: threading.Thread | None = None
-        self._gui_callback = None  # set by GUI for thread-safe updates
+        self._gui_callback = None

    def start(self):
        if self._running:
@@ -29,19 +31,18 @@ class StatusChecker:

    def stop(self):
        self._running = False
+        if self._thread:
+            self._thread.join(timeout=3.0)

    def set_gui_callback(self, callback):
-        """Set callback for thread-safe GUI updates."""
        self._gui_callback = callback

    def check_one(self, server: dict) -> bool:
-        """Check single server. Returns True if online."""
        key_path = self.store.get_ssh_key_path()
        wrapper = SSHClientWrapper(server, key_path)
        return wrapper.check_connection()

    def check_all_now(self):
-        """Run a full check cycle immediately (in background thread)."""
        threading.Thread(target=self._check_cycle, daemon=True).start()

    def _loop(self):
@@ -54,18 +55,35 @@ class StatusChecker:

    def _check_cycle(self):
        servers = self.store.get_all()
-        for server in servers:
+        ssh_servers = [s for s in servers if s.get("type", "ssh") == "ssh"]
+
+        # Mark non-SSH as unknown
+        for s in servers:
+            if s.get("type", "ssh") != "ssh":
+                self.store.set_status(s["alias"], "unknown")
+
+        if not ssh_servers:
+            return
+
+        # Parallel checks — up to 10 concurrent
+        max_workers = min(10, len(ssh_servers))
+        try:
+            with ThreadPoolExecutor(max_workers=max_workers) as executor:
+                futures = {
+                    executor.submit(self.check_one, s): s["alias"]
+                    for s in ssh_servers
+                }
+                for future in as_completed(futures, timeout=30):
                    if not self._running:
                        return
-            alias = server["alias"]
-            server_type = server.get("type", "ssh")
-
-            if server_type != "ssh":
-                self.store.set_status(alias, "unknown")
-                continue
-
-            online = self.check_one(server)
+                    alias = futures[future]
+                    try:
+                        online = future.result(timeout=10)
                        self.store.set_status(alias, "online" if online else "offline")
+                    except Exception:
+                        self.store.set_status(alias, "offline")
+        except Exception as e:
+            log.warning(f"Status check cycle error: {e}")

        if self._gui_callback:
            try:
--- a/core/totp.py
+++ b/core/totp.py
@@ -0,0 +1,39 @@
+"""
+TOTP module — Google Authenticator compatible 2FA codes.
+Uses pyotp (RFC 6238).
+"""
+
+import time
+import pyotp
+
+
+def generate_secret(length: int = 32) -> str:
+    """Generate a new random TOTP secret (base32-encoded)."""
+    return pyotp.random_base32(length=length)
+
+
+def get_code(secret: str) -> str:
+    """Get current 6-digit TOTP code."""
+    return pyotp.TOTP(secret).now()
+
+
+def get_code_with_timer(secret: str) -> dict:
+    """Get current code with timing info for GUI display."""
+    totp = pyotp.TOTP(secret)
+    now = time.time()
+    remaining = 30 - (int(now) % 30)
+    return {
+        "code": totp.now(),
+        "remaining": remaining,
+        "progress": remaining / 30.0,
+    }
+
+
+def verify_code(secret: str, code: str) -> bool:
+    """Verify a TOTP code (with +/- 1 period tolerance)."""
+    return pyotp.TOTP(secret).verify(code, valid_window=1)
+
+
+def format_secret_uri(secret: str, account: str, issuer: str = "ServerManager") -> str:
+    """Generate otpauth:// URI for QR code / authenticator apps."""
+    return pyotp.TOTP(secret).provisioning_uri(name=account, issuer_name=issuer)
--- a/gui/about_dialog.py
+++ b/gui/about_dialog.py
@@ -0,0 +1,77 @@
+"""
+About dialog — application info, features, quick start.
+"""
+
+import customtkinter as ctk
+from version import __version__, __author__
+from core.i18n import t
+
+
+class AboutDialog(ctk.CTkToplevel):
+    def __init__(self, master):
+        super().__init__(master)
+
+        self.title(f"{t('about_title')} — {t('version')} {__version__}")
+        self.geometry("500x480")
+        self.resizable(False, False)
+        self.transient(master)
+        self.grab_set()
+
+        # ── Header ──
+        ctk.CTkLabel(
+            self, text=t("about_title"),
+            font=ctk.CTkFont(size=24, weight="bold")
+        ).pack(padx=20, pady=(25, 2))
+
+        ctk.CTkLabel(
+            self, text=f"v{__version__}",
+            font=ctk.CTkFont(size=13), text_color="#9ca3af"
+        ).pack()
+
+        ctk.CTkLabel(
+            self, text=f"by {__author__}",
+            font=ctk.CTkFont(size=11), text_color="#6b7280"
+        ).pack(pady=(0, 10))
+
+        # ── Separator ──
+        ctk.CTkFrame(self, height=1, fg_color="gray40").pack(fill="x", padx=30, pady=5)
+
+        # ── Description ──
+        ctk.CTkLabel(
+            self, text=t("about_desc"),
+            font=ctk.CTkFont(size=12), text_color="#9ca3af",
+            justify="center", wraplength=440
+        ).pack(padx=20, pady=(8, 5))
+
+        # ── Separator ──
+        ctk.CTkFrame(self, height=1, fg_color="gray40").pack(fill="x", padx=30, pady=5)
+
+        # ── Features ──
+        ctk.CTkLabel(
+            self, text=t("about_features_title"),
+            font=ctk.CTkFont(size=14, weight="bold"), anchor="w"
+        ).pack(fill="x", padx=35, pady=(8, 3))
+
+        ctk.CTkLabel(
+            self, text=t("about_features"),
+            font=ctk.CTkFont(size=12), anchor="w", justify="left"
+        ).pack(fill="x", padx=40, pady=(0, 5))
+
+        # ── Separator ──
+        ctk.CTkFrame(self, height=1, fg_color="gray40").pack(fill="x", padx=30, pady=5)
+
+        # ── Quick Start ──
+        ctk.CTkLabel(
+            self, text=t("about_howto_title"),
+            font=ctk.CTkFont(size=14, weight="bold"), anchor="w"
+        ).pack(fill="x", padx=35, pady=(8, 3))
+
+        ctk.CTkLabel(
+            self, text=t("about_howto"),
+            font=ctk.CTkFont(size=12), anchor="w", justify="left"
+        ).pack(fill="x", padx=40, pady=(0, 10))
+
+        # ── Close button ──
+        ctk.CTkButton(
+            self, text=t("close"), width=120, command=self.destroy
+        ).pack(pady=(10, 20))
--- a/gui/app.py
+++ b/gui/app.py
@@ -7,13 +7,17 @@ from tkinter import messagebox

 from core.server_store import ServerStore
 from core.status_checker import StatusChecker
+from core import i18n
+from core.i18n import t, LANGUAGES
 from gui.sidebar import Sidebar
 from gui.server_dialog import ServerDialog
+from gui.about_dialog import AboutDialog
 from gui.tabs.terminal_tab import TerminalTab
 from gui.tabs.files_tab import FilesTab
 from gui.tabs.info_tab import InfoTab
 from gui.tabs.keys_tab import KeysTab
 from gui.tabs.setup_tab import SetupTab
+from gui.tabs.totp_tab import TOTPTab


 class App(ctk.CTk):
@@ -55,30 +59,54 @@ class App(ctk.CTk):
        main = ctk.CTkFrame(self, fg_color="transparent")
        main.pack(side="right", fill="both", expand=True)

+        # Header bar (language + about)
+        header_bar = ctk.CTkFrame(main, fg_color="transparent", height=40)
+        header_bar.pack(fill="x", padx=10, pady=(8, 0))
+        header_bar.pack_propagate(False)
+
+        # Language selector
+        lang_values = list(LANGUAGES.values())
+        current_display = LANGUAGES.get(i18n.get_language(), "English")
+        self._lang_var = ctk.StringVar(value=current_display)
+        self.lang_menu = ctk.CTkOptionMenu(
+            header_bar, values=lang_values, variable=self._lang_var,
+            width=110, height=30, command=self._change_language
+        )
+        self.lang_menu.pack(side="right", padx=(5, 0))
+
+        # About button
+        self.about_btn = ctk.CTkButton(
+            header_bar, text="ⓘ", width=30, height=30,
+            corner_radius=15, fg_color="#6b7280", hover_color="#4b5563",
+            command=self._show_about
+        )
+        self.about_btn.pack(side="right", padx=(5, 5))
+
        # Tabview
        self.tabview = ctk.CTkTabview(main)
        self.tabview.pack(fill="both", expand=True, padx=10, pady=10)

-        # Tabs
-        self.tabview.add("Terminal")
-        self.tabview.add("Files")
-        self.tabview.add("Info")
-        self.tabview.add("Keys")
-        self.tabview.add("Setup")
+        # Tab names stored for language updates
+        self._tab_keys = ["terminal", "files", "info", "keys", "totp", "setup"]
+        for key in self._tab_keys:
+            self.tabview.add(t(key))

-        self.terminal_tab = TerminalTab(self.tabview.tab("Terminal"), self.store)
+        self.terminal_tab = TerminalTab(self.tabview.tab(t("terminal")), self.store)
        self.terminal_tab.pack(fill="both", expand=True)

-        self.files_tab = FilesTab(self.tabview.tab("Files"), self.store)
+        self.files_tab = FilesTab(self.tabview.tab(t("files")), self.store)
        self.files_tab.pack(fill="both", expand=True)

-        self.info_tab = InfoTab(self.tabview.tab("Info"), self.store, edit_callback=self._edit_server)
+        self.info_tab = InfoTab(self.tabview.tab(t("info")), self.store, edit_callback=self._edit_server)
        self.info_tab.pack(fill="both", expand=True)

-        self.keys_tab = KeysTab(self.tabview.tab("Keys"), self.store)
+        self.keys_tab = KeysTab(self.tabview.tab(t("keys")), self.store)
        self.keys_tab.pack(fill="both", expand=True)

-        self.setup_tab = SetupTab(self.tabview.tab("Setup"), self.store)
+        self.totp_tab = TOTPTab(self.tabview.tab(t("totp")), self.store)
+        self.totp_tab.pack(fill="both", expand=True)
+
+        self.setup_tab = SetupTab(self.tabview.tab(t("setup")), self.store)
        self.setup_tab.pack(fill="both", expand=True)

    def _on_server_select(self, alias: str):
@@ -86,6 +114,7 @@ class App(ctk.CTk):
        self.files_tab.set_server(alias)
        self.info_tab.set_server(alias)
        self.keys_tab.set_server(alias)
+        self.totp_tab.set_server(alias)

    def _add_server(self):
        dialog = ServerDialog(self, self.store)
@@ -99,7 +128,7 @@ class App(ctk.CTk):
            self.info_tab.refresh()

    def _delete_server(self, alias: str):
-        if messagebox.askyesno("Delete Server", f"Remove '{alias}'?"):
+        if messagebox.askyesno(t("delete_server"), t("delete_confirm").format(alias=alias)):
            self.store.remove_server(alias)
            self._on_server_select(None)

@@ -107,6 +136,92 @@ class App(ctk.CTk):
        self.sidebar.update_statuses()
        self.info_tab.refresh()

+    def _show_about(self):
+        AboutDialog(self)
+
+    def _get_current_tab_key(self) -> str:
+        """Get the i18n key of the currently active tab."""
+        try:
+            current_name = self.tabview.get()
+            # Match against current language translations
+            for key in self._tab_keys:
+                if t(key) == current_name:
+                    return key
+        except Exception:
+            pass
+        return self._tab_keys[0]
+
+    def _change_language(self, display_name: str):
+        # Remember current tab KEY before language switch
+        active_tab_key = self._get_current_tab_key()
+
+        # Find lang code from display name
+        lang_code = "en"
+        for code, name in LANGUAGES.items():
+            if name == display_name:
+                lang_code = code
+                break
+        i18n.set_language(lang_code)
+        self.store._save_settings()
+        self._apply_language(active_tab_key)
+
+    def _apply_language(self, restore_tab_key: str | None = None):
+        # Remember selected server
+        alias = self.sidebar.get_selected()
+        # Use provided key or default to first tab
+        current_key = restore_tab_key or self._tab_keys[0]
+
+        # Detach tab contents
+        self.terminal_tab.pack_forget()
+        self.files_tab.pack_forget()
+        self.info_tab.pack_forget()
+        self.keys_tab.pack_forget()
+        self.totp_tab.pack_forget()
+        self.setup_tab.pack_forget()
+
+        # Get the main frame and destroy old tabview
+        main = self.tabview.master
+        self.tabview.destroy()
+
+        # Create new tabview with translated names
+        self.tabview = ctk.CTkTabview(main)
+        self.tabview.pack(fill="both", expand=True, padx=10, pady=10)
+
+        for key in self._tab_keys:
+            self.tabview.add(t(key))
+
+        # Re-parent tab contents
+        self.terminal_tab = TerminalTab(self.tabview.tab(t("terminal")), self.store)
+        self.terminal_tab.pack(fill="both", expand=True)
+
+        self.files_tab = FilesTab(self.tabview.tab(t("files")), self.store)
+        self.files_tab.pack(fill="both", expand=True)
+
+        self.info_tab = InfoTab(self.tabview.tab(t("info")), self.store, edit_callback=self._edit_server)
+        self.info_tab.pack(fill="both", expand=True)
+
+        self.keys_tab = KeysTab(self.tabview.tab(t("keys")), self.store)
+        self.keys_tab.pack(fill="both", expand=True)
+
+        self.totp_tab = TOTPTab(self.tabview.tab(t("totp")), self.store)
+        self.totp_tab.pack(fill="both", expand=True)
+
+        self.setup_tab = SetupTab(self.tabview.tab(t("setup")), self.store)
+        self.setup_tab.pack(fill="both", expand=True)
+
+        # Restore active tab by key
+        try:
+            self.tabview.set(t(current_key))
+        except Exception:
+            pass
+
+        # Restore server selection
+        if alias:
+            self._on_server_select(alias)
+
+        # Update sidebar
+        self.sidebar.update_language()
+
    def _on_close(self):
        self.checker.stop()
        self.destroy()
--- a/gui/server_dialog.py
+++ b/gui/server_dialog.py
@@ -4,6 +4,7 @@ Server add/edit dialog — modal window with all server fields.

 import customtkinter as ctk
 from core.server_store import SERVER_TYPES, DEFAULT_PORTS
+from core.i18n import t


 class ServerDialog(ctk.CTkToplevel):
@@ -13,8 +14,8 @@ class ServerDialog(ctk.CTkToplevel):
        self.editing = server
        self.result = None

-        self.title("Edit Server" if server else "Add Server")
-        self.geometry("450x520")
+        self.title(t("edit_server") if server else t("add_server"))
+        self.geometry("450x580")
        self.resizable(False, False)
        self.grab_set()

@@ -28,13 +29,13 @@ class ServerDialog(ctk.CTkToplevel):
        entry_pad = {"padx": 20, "pady": (2, 5)}

        # Alias
-        ctk.CTkLabel(self, text="Alias", anchor="w").pack(fill="x", **pad)
-        self.alias_entry = ctk.CTkEntry(self, placeholder_text="my-server")
+        ctk.CTkLabel(self, text=t("alias"), anchor="w").pack(fill="x", **pad)
+        self.alias_entry = ctk.CTkEntry(self, placeholder_text=t("placeholder_alias"))
        self.alias_entry.pack(fill="x", **entry_pad)

        # IP
-        ctk.CTkLabel(self, text="IP / Hostname", anchor="w").pack(fill="x", **pad)
-        self.ip_entry = ctk.CTkEntry(self, placeholder_text="1.2.3.4")
+        ctk.CTkLabel(self, text=t("ip"), anchor="w").pack(fill="x", **pad)
+        self.ip_entry = ctk.CTkEntry(self, placeholder_text=t("placeholder_ip"))
        self.ip_entry.pack(fill="x", **entry_pad)

        # Type + Port row
@@ -43,7 +44,7 @@ class ServerDialog(ctk.CTkToplevel):

        type_frame = ctk.CTkFrame(row, fg_color="transparent")
        type_frame.pack(side="left", fill="x", expand=True, padx=(0, 5))
-        ctk.CTkLabel(type_frame, text="Type", anchor="w").pack(fill="x")
+        ctk.CTkLabel(type_frame, text=t("type"), anchor="w").pack(fill="x")
        self.type_var = ctk.StringVar(value="ssh")
        self.type_menu = ctk.CTkOptionMenu(
            type_frame, values=SERVER_TYPES, variable=self.type_var,
@@ -53,35 +54,41 @@ class ServerDialog(ctk.CTkToplevel):

        port_frame = ctk.CTkFrame(row, fg_color="transparent")
        port_frame.pack(side="left", fill="x", expand=True, padx=(5, 0))
-        ctk.CTkLabel(port_frame, text="Port", anchor="w").pack(fill="x")
-        self.port_entry = ctk.CTkEntry(port_frame, placeholder_text="22")
+        ctk.CTkLabel(port_frame, text=t("port"), anchor="w").pack(fill="x")
+        self.port_entry = ctk.CTkEntry(port_frame, placeholder_text=t("placeholder_port"))
        self.port_entry.pack(fill="x")

        # User
-        ctk.CTkLabel(self, text="Username", anchor="w").pack(fill="x", **pad)
-        self.user_entry = ctk.CTkEntry(self, placeholder_text="root")
+        ctk.CTkLabel(self, text=t("username"), anchor="w").pack(fill="x", **pad)
+        self.user_entry = ctk.CTkEntry(self, placeholder_text=t("placeholder_user"))
        self.user_entry.pack(fill="x", **entry_pad)

        # Password
-        ctk.CTkLabel(self, text="Password", anchor="w").pack(fill="x", **pad)
+        ctk.CTkLabel(self, text=t("password"), anchor="w").pack(fill="x", **pad)
        pass_frame = ctk.CTkFrame(self, fg_color="transparent")
        pass_frame.pack(fill="x", padx=20, pady=(2, 5))
-        self.password_entry = ctk.CTkEntry(pass_frame, show="*", placeholder_text="password")
+        self.password_entry = ctk.CTkEntry(pass_frame, show="*", placeholder_text=t("placeholder_password"))
        self.password_entry.pack(side="left", fill="x", expand=True, padx=(0, 5))
-        self.show_pass = ctk.CTkButton(pass_frame, text="Show", width=60, command=self._toggle_password)
+        self.show_pass = ctk.CTkButton(pass_frame, text=t("show"), width=60, command=self._toggle_password)
        self.show_pass.pack(side="right")
        self._pass_visible = False

+        # TOTP Secret
+        ctk.CTkLabel(self, text=t("totp_secret_dialog"), anchor="w").pack(fill="x", **pad)
+        self.totp_entry = ctk.CTkEntry(self, placeholder_text=t("placeholder_totp_secret"),
+                                        font=ctk.CTkFont(family="Consolas", size=12))
+        self.totp_entry.pack(fill="x", **entry_pad)
+
        # Notes
-        ctk.CTkLabel(self, text="Notes", anchor="w").pack(fill="x", **pad)
-        self.notes_entry = ctk.CTkEntry(self, placeholder_text="optional description")
+        ctk.CTkLabel(self, text=t("notes"), anchor="w").pack(fill="x", **pad)
+        self.notes_entry = ctk.CTkEntry(self, placeholder_text=t("placeholder_notes"))
        self.notes_entry.pack(fill="x", **entry_pad)

        # Buttons
        btn_frame = ctk.CTkFrame(self, fg_color="transparent")
        btn_frame.pack(fill="x", padx=20, pady=(15, 20))
-        ctk.CTkButton(btn_frame, text="Cancel", fg_color="#6b7280", command=self.destroy).pack(side="left", expand=True, padx=(0, 5))
-        ctk.CTkButton(btn_frame, text="Save", command=self._save).pack(side="right", expand=True, padx=(5, 0))
+        ctk.CTkButton(btn_frame, text=t("cancel"), fg_color="#6b7280", command=self.destroy).pack(side="left", expand=True, padx=(0, 5))
+        ctk.CTkButton(btn_frame, text=t("save"), command=self._save).pack(side="right", expand=True, padx=(5, 0))

        # Fill values if editing
        if server:
@@ -92,6 +99,7 @@ class ServerDialog(ctk.CTkToplevel):
            self.port_entry.insert(0, str(server.get("port", 22)))
            self.user_entry.insert(0, server.get("user", ""))
            self.password_entry.insert(0, server.get("password", ""))
+            self.totp_entry.insert(0, server.get("totp_secret", ""))
            self.notes_entry.insert(0, server.get("notes", ""))

    def _on_type_change(self, value):
@@ -102,7 +110,7 @@ class ServerDialog(ctk.CTkToplevel):
    def _toggle_password(self):
        self._pass_visible = not self._pass_visible
        self.password_entry.configure(show="" if self._pass_visible else "*")
-        self.show_pass.configure(text="Hide" if self._pass_visible else "Show")
+        self.show_pass.configure(text=t("hide") if self._pass_visible else t("show"))

    def _save(self):
        alias = self.alias_entry.get().strip()
@@ -111,19 +119,23 @@ class ServerDialog(ctk.CTkToplevel):
        user = self.user_entry.get().strip()
        password = self.password_entry.get()
        server_type = self.type_var.get()
+        totp_secret = self.totp_entry.get().strip()
        notes = self.notes_entry.get().strip()

        # Validation
        if not alias:
-            self._show_error("Alias is required")
+            self._show_error(t("alias_required"))
            return
        if not ip:
-            self._show_error("IP is required")
+            self._show_error(t("ip_required"))
            return
        try:
            port = int(port_str) if port_str else DEFAULT_PORTS.get(server_type, 22)
        except ValueError:
-            self._show_error("Port must be a number")
+            self._show_error(t("port_must_be_number"))
+            return
+        if port < 1 or port > 65535:
+            self._show_error(t("port_out_of_range"))
            return

        server_data = {
@@ -135,6 +147,8 @@ class ServerDialog(ctk.CTkToplevel):
            "type": server_type,
            "notes": notes,
        }
+        if totp_secret:
+            server_data["totp_secret"] = totp_secret

        try:
            if self.editing:
@@ -148,5 +162,5 @@ class ServerDialog(ctk.CTkToplevel):

    def _show_error(self, message: str):
        # Simple error via title flash
-        self.title(f"Error: {message}")
-        self.after(2000, lambda: self.title("Edit Server" if self.editing else "Add Server"))
+        self.title(t("error_prefix").format(msg=message))
+        self.after(2000, lambda: self.title(t("edit_server") if self.editing else t("add_server")))
--- a/gui/sidebar.py
+++ b/gui/sidebar.py
@@ -3,6 +3,7 @@ Sidebar — server list with search, add/edit/delete buttons.
 """

 import customtkinter as ctk
+from core.i18n import t
 from gui.widgets.status_badge import StatusBadge


@@ -18,14 +19,14 @@ class Sidebar(ctk.CTkFrame):
        self.pack_propagate(False)

        # Title
-        title = ctk.CTkLabel(self, text="Servers", font=ctk.CTkFont(size=18, weight="bold"))
-        title.pack(padx=15, pady=(15, 5))
+        self.title_label = ctk.CTkLabel(self, text=t("servers"), font=ctk.CTkFont(size=18, weight="bold"))
+        self.title_label.pack(padx=15, pady=(15, 5))

        # Search
        self.search_var = ctk.StringVar()
        self.search_var.trace_add("write", lambda *_: self._refresh_list())
-        search = ctk.CTkEntry(self, placeholder_text="Search...", textvariable=self.search_var)
-        search.pack(fill="x", padx=10, pady=(5, 10))
+        self.search_entry = ctk.CTkEntry(self, placeholder_text=t("search"), textvariable=self.search_var)
+        self.search_entry.pack(fill="x", padx=10, pady=(5, 10))

        # Server list
        self.list_frame = ctk.CTkScrollableFrame(self, fg_color="transparent")
@@ -34,11 +35,11 @@ class Sidebar(ctk.CTkFrame):
        # Buttons
        btn_frame = ctk.CTkFrame(self, fg_color="transparent")
        btn_frame.pack(fill="x", padx=10, pady=10)
-        self.add_btn = ctk.CTkButton(btn_frame, text="+ Add", width=70, height=30, command=self._on_add)
+        self.add_btn = ctk.CTkButton(btn_frame, text=t("add"), width=70, height=30, command=self._on_add)
        self.add_btn.pack(side="left", padx=(0, 3))
-        self.edit_btn = ctk.CTkButton(btn_frame, text="Edit", width=70, height=30, fg_color="#6b7280", command=self._on_edit)
+        self.edit_btn = ctk.CTkButton(btn_frame, text=t("edit"), width=70, height=30, fg_color="#6b7280", command=self._on_edit)
        self.edit_btn.pack(side="left", padx=3)
-        self.del_btn = ctk.CTkButton(btn_frame, text="Delete", width=70, height=30, fg_color="#ef4444", hover_color="#dc2626", command=self._on_delete)
+        self.del_btn = ctk.CTkButton(btn_frame, text=t("delete"), width=70, height=30, fg_color="#ef4444", hover_color="#dc2626", command=self._on_delete)
        self.del_btn.pack(side="right", padx=(3, 0))

        # Callbacks for add/edit/delete — set by app.py
@@ -50,6 +51,13 @@ class Sidebar(ctk.CTkFrame):
        self.store.subscribe(self._refresh_list)
        self._refresh_list()

+    def update_language(self):
+        self.title_label.configure(text=t("servers"))
+        self.search_entry.configure(placeholder_text=t("search"))
+        self.add_btn.configure(text=t("add"))
+        self.edit_btn.configure(text=t("edit"))
+        self.del_btn.configure(text=t("delete"))
+
    def _refresh_list(self):
        # Clear
        for widget in self.list_frame.winfo_children():
--- a/gui/tabs/files_tab.py
+++ b/gui/tabs/files_tab.py
@@ -7,6 +7,7 @@ import threading
 import customtkinter as ctk
 from tkinter import filedialog
 from core.ssh_client import SSHClientWrapper
+from core.i18n import t


 class FilesTab(ctk.CTkFrame):
@@ -16,48 +17,54 @@ class FilesTab(ctk.CTkFrame):
        self._current_alias: str | None = None

        # Upload section
-        upload_label = ctk.CTkLabel(self, text="Upload", font=ctk.CTkFont(size=14, weight="bold"), anchor="w")
-        upload_label.pack(fill="x", padx=15, pady=(15, 5))
+        self.upload_label = ctk.CTkLabel(self, text=t("upload"), font=ctk.CTkFont(size=14, weight="bold"), anchor="w")
+        self.upload_label.pack(fill="x", padx=15, pady=(15, 5))

        upload_frame = ctk.CTkFrame(self, fg_color="transparent")
        upload_frame.pack(fill="x", padx=15, pady=(0, 5))

-        ctk.CTkLabel(upload_frame, text="Local:", width=60, anchor="w").pack(side="left")
-        self.upload_local = ctk.CTkEntry(upload_frame, placeholder_text="/path/to/local/file")
+        self.upload_local_label = ctk.CTkLabel(upload_frame, text=t("local"), width=60, anchor="w")
+        self.upload_local_label.pack(side="left")
+        self.upload_local = ctk.CTkEntry(upload_frame, placeholder_text=t("placeholder_local_file"))
        self.upload_local.pack(side="left", fill="x", expand=True, padx=5)
-        ctk.CTkButton(upload_frame, text="Browse", width=70, command=self._browse_upload).pack(side="right")
+        self.browse_upload_btn = ctk.CTkButton(upload_frame, text=t("browse"), width=70, command=self._browse_upload)
+        self.browse_upload_btn.pack(side="right")

        upload_remote_frame = ctk.CTkFrame(self, fg_color="transparent")
        upload_remote_frame.pack(fill="x", padx=15, pady=(0, 5))

-        ctk.CTkLabel(upload_remote_frame, text="Remote:", width=60, anchor="w").pack(side="left")
-        self.upload_remote = ctk.CTkEntry(upload_remote_frame, placeholder_text="/remote/path/file")
+        self.upload_remote_label = ctk.CTkLabel(upload_remote_frame, text=t("remote"), width=60, anchor="w")
+        self.upload_remote_label.pack(side="left")
+        self.upload_remote = ctk.CTkEntry(upload_remote_frame, placeholder_text=t("placeholder_remote_file"))
        self.upload_remote.pack(side="left", fill="x", expand=True, padx=5)
-        self.upload_btn = ctk.CTkButton(upload_remote_frame, text="Upload", width=70, command=self._upload)
+        self.upload_btn = ctk.CTkButton(upload_remote_frame, text=t("upload"), width=70, command=self._upload)
        self.upload_btn.pack(side="right")

        # Separator
        ctk.CTkFrame(self, height=2, fg_color="gray40").pack(fill="x", padx=15, pady=10)

        # Download section
-        download_label = ctk.CTkLabel(self, text="Download", font=ctk.CTkFont(size=14, weight="bold"), anchor="w")
-        download_label.pack(fill="x", padx=15, pady=(5, 5))
+        self.download_label = ctk.CTkLabel(self, text=t("download"), font=ctk.CTkFont(size=14, weight="bold"), anchor="w")
+        self.download_label.pack(fill="x", padx=15, pady=(5, 5))

        download_remote_frame = ctk.CTkFrame(self, fg_color="transparent")
        download_remote_frame.pack(fill="x", padx=15, pady=(0, 5))

-        ctk.CTkLabel(download_remote_frame, text="Remote:", width=60, anchor="w").pack(side="left")
-        self.download_remote = ctk.CTkEntry(download_remote_frame, placeholder_text="/remote/path/file")
+        self.download_remote_label = ctk.CTkLabel(download_remote_frame, text=t("remote"), width=60, anchor="w")
+        self.download_remote_label.pack(side="left")
+        self.download_remote = ctk.CTkEntry(download_remote_frame, placeholder_text=t("placeholder_remote_file"))
        self.download_remote.pack(side="left", fill="x", expand=True, padx=5)

        download_local_frame = ctk.CTkFrame(self, fg_color="transparent")
        download_local_frame.pack(fill="x", padx=15, pady=(0, 5))

-        ctk.CTkLabel(download_local_frame, text="Local:", width=60, anchor="w").pack(side="left")
-        self.download_local = ctk.CTkEntry(download_local_frame, placeholder_text="/path/to/save")
+        self.download_local_label = ctk.CTkLabel(download_local_frame, text=t("local"), width=60, anchor="w")
+        self.download_local_label.pack(side="left")
+        self.download_local = ctk.CTkEntry(download_local_frame, placeholder_text=t("placeholder_save_path"))
        self.download_local.pack(side="left", fill="x", expand=True, padx=5)
-        ctk.CTkButton(download_local_frame, text="Browse", width=70, command=self._browse_download).pack(side="left", padx=(5, 0))
-        self.download_btn = ctk.CTkButton(download_local_frame, text="Download", width=80, command=self._download)
+        self.browse_download_btn = ctk.CTkButton(download_local_frame, text=t("browse"), width=70, command=self._browse_download)
+        self.browse_download_btn.pack(side="left", padx=(5, 0))
+        self.download_btn = ctk.CTkButton(download_local_frame, text=t("download"), width=80, command=self._download)
        self.download_btn.pack(side="right")

        # Progress
@@ -94,15 +101,15 @@ class FilesTab(ctk.CTkFrame):

    def _upload(self):
        if not self._current_alias:
-            self._log_msg("[!] No server selected")
+            self._log_msg(t("no_server_selected"))
            return
        local = self.upload_local.get().strip()
        remote = self.upload_remote.get().strip()
        if not local or not remote:
-            self._log_msg("[!] Both paths required")
+            self._log_msg(t("both_paths_required"))
            return
        if not os.path.exists(local):
-            self._log_msg(f"[!] File not found: {local}")
+            self._log_msg(t("file_not_found").format(path=local))
            return

        server = self.store.get_server(self._current_alias)
@@ -121,7 +128,7 @@ class FilesTab(ctk.CTkFrame):
            try:
                wrapper = SSHClientWrapper(server, self.store.get_ssh_key_path())
                wrapper.upload(local, remote, progress_cb=_progress)
-                self.after(0, lambda: self._log_msg(f"OK: {local} -> {self._current_alias}:{remote}"))
+                self.after(0, lambda: self._log_msg(t("upload_ok").format(local=local, alias=self._current_alias, remote=remote)))
            except Exception as e:
                self.after(0, lambda: self._log_msg(f"[ERROR] {e}"))
            finally:
@@ -131,12 +138,12 @@ class FilesTab(ctk.CTkFrame):

    def _download(self):
        if not self._current_alias:
-            self._log_msg("[!] No server selected")
+            self._log_msg(t("no_server_selected"))
            return
        remote = self.download_remote.get().strip()
        local = self.download_local.get().strip()
        if not remote or not local:
-            self._log_msg("[!] Both paths required")
+            self._log_msg(t("both_paths_required"))
            return

        server = self.store.get_server(self._current_alias)
@@ -154,7 +161,7 @@ class FilesTab(ctk.CTkFrame):
            try:
                wrapper = SSHClientWrapper(server, self.store.get_ssh_key_path())
                wrapper.download(remote, local, progress_cb=_progress)
-                self.after(0, lambda: self._log_msg(f"OK: {self._current_alias}:{remote} -> {local}"))
+                self.after(0, lambda: self._log_msg(t("download_ok").format(alias=self._current_alias, remote=remote, local=local)))
            except Exception as e:
                self.after(0, lambda: self._log_msg(f"[ERROR] {e}"))
            finally:
--- a/gui/tabs/info_tab.py
+++ b/gui/tabs/info_tab.py
@@ -3,9 +3,22 @@ Info tab — display server details, edit button.
 """

 import customtkinter as ctk
+from core.i18n import t


 class InfoTab(ctk.CTkFrame):
+    # Map field keys to i18n keys
+    _FIELD_KEYS = ["alias", "ip", "port", "user", "type", "notes", "status"]
+    _FIELD_I18N = {
+        "alias": "info_alias",
+        "ip": "info_ip",
+        "port": "info_port",
+        "user": "info_user",
+        "type": "info_type",
+        "notes": "info_notes",
+        "status": "info_status",
+    }
+
    def __init__(self, master, store, edit_callback=None):
        super().__init__(master, fg_color="transparent")
        self.store = store
@@ -13,7 +26,7 @@ class InfoTab(ctk.CTkFrame):
        self._current_alias: str | None = None

        # Header
-        self.header = ctk.CTkLabel(self, text="No server selected", font=ctk.CTkFont(size=20, weight="bold"))
+        self.header = ctk.CTkLabel(self, text=t("no_server_selected_info"), font=ctk.CTkFont(size=20, weight="bold"))
        self.header.pack(padx=20, pady=(20, 10))

        # Info card
@@ -21,17 +34,20 @@ class InfoTab(ctk.CTkFrame):
        self.card.pack(fill="x", padx=20, pady=10)

        self._fields: dict[str, ctk.CTkLabel] = {}
-        for label in ["Alias", "IP", "Port", "User", "Type", "Notes", "Status"]:
+        self._field_labels: dict[str, ctk.CTkLabel] = {}
+        for key in self._FIELD_KEYS:
            row = ctk.CTkFrame(self.card, fg_color="transparent")
            row.pack(fill="x", padx=15, pady=4)
-            ctk.CTkLabel(row, text=f"{label}:", width=80, anchor="w",
-                        font=ctk.CTkFont(size=12), text_color="#9ca3af").pack(side="left")
+            label = ctk.CTkLabel(row, text=t(self._FIELD_I18N[key]), width=80, anchor="w",
+                        font=ctk.CTkFont(size=12), text_color="#9ca3af")
+            label.pack(side="left")
            val = ctk.CTkLabel(row, text="-", anchor="w", font=ctk.CTkFont(size=13))
            val.pack(side="left", fill="x", expand=True)
-            self._fields[label] = val
+            self._field_labels[key] = label
+            self._fields[key] = val

        # Edit button
-        self.edit_btn = ctk.CTkButton(self, text="Edit Server", command=self._on_edit)
+        self.edit_btn = ctk.CTkButton(self, text=t("edit_server_btn"), command=self._on_edit)
        self.edit_btn.pack(pady=15)

    def set_server(self, alias: str | None):
@@ -40,7 +56,7 @@ class InfoTab(ctk.CTkFrame):

    def refresh(self):
        if not self._current_alias:
-            self.header.configure(text="No server selected")
+            self.header.configure(text=t("no_server_selected_info"))
            for v in self._fields.values():
                v.configure(text="-")
            return
@@ -50,16 +66,16 @@ class InfoTab(ctk.CTkFrame):
            return

        self.header.configure(text=server["alias"])
-        self._fields["Alias"].configure(text=server.get("alias", "-"))
-        self._fields["IP"].configure(text=server.get("ip", "-"))
-        self._fields["Port"].configure(text=str(server.get("port", 22)))
-        self._fields["User"].configure(text=server.get("user", "root"))
-        self._fields["Type"].configure(text=server.get("type", "ssh").upper())
-        self._fields["Notes"].configure(text=server.get("notes", "-") or "-")
+        self._fields["alias"].configure(text=server.get("alias", "-"))
+        self._fields["ip"].configure(text=server.get("ip", "-"))
+        self._fields["port"].configure(text=str(server.get("port", 22)))
+        self._fields["user"].configure(text=server.get("user", "root"))
+        self._fields["type"].configure(text=server.get("type", "ssh").upper())
+        self._fields["notes"].configure(text=server.get("notes", "-") or "-")

        status = self.store.get_status(self._current_alias)
        color = {"online": "#22c55e", "offline": "#ef4444"}.get(status, "#9ca3af")
-        self._fields["Status"].configure(text=status.upper(), text_color=color)
+        self._fields["status"].configure(text=status.upper(), text_color=color)

    def _on_edit(self):
        if self.edit_callback and self._current_alias:
--- a/gui/tabs/keys_tab.py
+++ b/gui/tabs/keys_tab.py
@@ -6,6 +6,7 @@ import os
 import threading
 import customtkinter as ctk
 from core.ssh_client import SSHClientWrapper
+from core.i18n import t


 class KeysTab(ctk.CTkFrame):
@@ -15,7 +16,8 @@ class KeysTab(ctk.CTkFrame):
        self._current_alias: str | None = None

        # Key info
-        ctk.CTkLabel(self, text="SSH Key", font=ctk.CTkFont(size=16, weight="bold"), anchor="w").pack(fill="x", padx=15, pady=(15, 5))
+        self.key_title = ctk.CTkLabel(self, text=t("ssh_key"), font=ctk.CTkFont(size=16, weight="bold"), anchor="w")
+        self.key_title.pack(fill="x", padx=15, pady=(15, 5))

        self.key_path_label = ctk.CTkLabel(self, text="", anchor="w", text_color="#9ca3af")
        self.key_path_label.pack(fill="x", padx=15)
@@ -27,13 +29,13 @@ class KeysTab(ctk.CTkFrame):
        btn_frame = ctk.CTkFrame(self, fg_color="transparent")
        btn_frame.pack(fill="x", padx=15, pady=5)

-        self.gen_btn = ctk.CTkButton(btn_frame, text="Generate Key", command=self._generate)
+        self.gen_btn = ctk.CTkButton(btn_frame, text=t("generate_key"), command=self._generate)
        self.gen_btn.pack(side="left", padx=(0, 10))

-        self.install_btn = ctk.CTkButton(btn_frame, text="Install on Server", fg_color="#22c55e", hover_color="#16a34a", command=self._install)
+        self.install_btn = ctk.CTkButton(btn_frame, text=t("install_on_server"), fg_color="#22c55e", hover_color="#16a34a", command=self._install)
        self.install_btn.pack(side="left")

-        self.copy_btn = ctk.CTkButton(btn_frame, text="Copy Public Key", fg_color="#6b7280", command=self._copy_key)
+        self.copy_btn = ctk.CTkButton(btn_frame, text=t("copy_public_key"), fg_color="#6b7280", command=self._copy_key)
        self.copy_btn.pack(side="right")

        # Status log
@@ -48,7 +50,7 @@ class KeysTab(ctk.CTkFrame):
    def _refresh_key_info(self):
        key_path = self.store.get_ssh_key_path()
        pub_path = key_path + ".pub"
-        self.key_path_label.configure(text=f"Path: {key_path}")
+        self.key_path_label.configure(text=t("key_path").format(path=key_path))

        self.pub_key_box.configure(state="normal")
        self.pub_key_box.delete("1.0", "end")
@@ -57,10 +59,10 @@ class KeysTab(ctk.CTkFrame):
            with open(pub_path, "r") as f:
                pub_key = f.read().strip()
            self.pub_key_box.insert("1.0", pub_key)
-            self.gen_btn.configure(state="disabled", text="Key exists")
+            self.gen_btn.configure(state="disabled", text=t("key_exists"))
        else:
-            self.pub_key_box.insert("1.0", "No key found. Click 'Generate Key' to create one.")
-            self.gen_btn.configure(state="normal", text="Generate Key")
+            self.pub_key_box.insert("1.0", t("no_key_found"))
+            self.gen_btn.configure(state="normal", text=t("generate_key"))

        self.pub_key_box.configure(state="disabled")

@@ -82,14 +84,14 @@ class KeysTab(ctk.CTkFrame):

    def _install(self):
        if not self._current_alias:
-            self._log("[!] No server selected")
+            self._log(t("no_server_selected"))
            return

        server = self.store.get_server(self._current_alias)
        if not server:
            return

-        self.install_btn.configure(state="disabled", text="Installing...")
+        self.install_btn.configure(state="disabled", text=t("installing"))

        def _do():
            try:
@@ -99,7 +101,7 @@ class KeysTab(ctk.CTkFrame):
            except Exception as e:
                self.after(0, lambda: self._log(f"[ERROR] {e}"))
            finally:
-                self.after(0, lambda: self.install_btn.configure(state="normal", text="Install on Server"))
+                self.after(0, lambda: self.install_btn.configure(state="normal", text=t("install_on_server")))

        threading.Thread(target=_do, daemon=True).start()

@@ -111,6 +113,6 @@ class KeysTab(ctk.CTkFrame):
                pub_key = f.read().strip()
            self.clipboard_clear()
            self.clipboard_append(pub_key)
-            self._log("Public key copied to clipboard")
+            self._log(t("key_copied"))
        else:
-            self._log("[!] No public key to copy")
+            self._log(t("no_public_key"))
--- a/gui/tabs/setup_tab.py
+++ b/gui/tabs/setup_tab.py
@@ -1,10 +1,14 @@
 """
 Setup tab — one-click installation for Claude Code integration.
+Includes configuration path management and backup/restore.
 """

+import os
 import threading
+from tkinter import filedialog, messagebox
 import customtkinter as ctk
 from core.claude_setup import check_status, install_all, install_ssh_script, install_skill, generate_ssh_key
+from core.i18n import t


 class SetupTab(ctk.CTkFrame):
@@ -13,50 +17,54 @@ class SetupTab(ctk.CTkFrame):
        self.store = store

        # Header
-        ctk.CTkLabel(
-            self, text="Claude Code Integration",
+        self.header_label = ctk.CTkLabel(
+            self, text=t("claude_integration"),
            font=ctk.CTkFont(size=20, weight="bold")
-        ).pack(padx=20, pady=(20, 5))
+        )
+        self.header_label.pack(padx=20, pady=(20, 5))

-        ctk.CTkLabel(
-            self,
-            text="Setup everything so Claude Code can manage your servers via /ssh skill.\n"
-                 "Both GUI and Claude Code share the same servers.json — add a server here,\n"
-                 "Claude sees it immediately.",
+        self.desc_label = ctk.CTkLabel(
+            self, text=t("claude_desc"),
            text_color="#9ca3af", justify="center"
-        ).pack(padx=20, pady=(0, 15))
+        )
+        self.desc_label.pack(padx=20, pady=(0, 15))

        # Status card
        self.status_frame = ctk.CTkFrame(self)
        self.status_frame.pack(fill="x", padx=20, pady=10)

-        ctk.CTkLabel(
-            self.status_frame, text="Status",
+        self.status_title = ctk.CTkLabel(
+            self.status_frame, text=t("status"),
            font=ctk.CTkFont(size=14, weight="bold"), anchor="w"
-        ).pack(fill="x", padx=15, pady=(10, 5))
+        )
+        self.status_title.pack(fill="x", padx=15, pady=(10, 5))

        self._status_labels: dict[str, ctk.CTkLabel] = {}
+        self._status_text_labels: dict[str, ctk.CTkLabel] = {}
        status_items = [
-            ("shared_dir", "Shared config dir (~/.server-connections)"),
-            ("servers_json", "servers.json"),
-            ("ssh_script", "ssh.py (CLI tool)"),
-            ("skill_installed", "/ssh skill for Claude Code"),
-            ("ssh_key_exists", "SSH key (ed25519)"),
+            ("shared_dir", "status_shared_dir"),
+            ("servers_json", "status_servers_json"),
+            ("ssh_script", "status_ssh_script"),
+            ("encryption", "status_encryption"),
+            ("skill_installed", "status_skill"),
+            ("ssh_key_exists", "status_ssh_key"),
        ]
-        for key, label in status_items:
+        for key, i18n_key in status_items:
            row = ctk.CTkFrame(self.status_frame, fg_color="transparent")
            row.pack(fill="x", padx=15, pady=2)
            indicator = ctk.CTkLabel(row, text="\u25cf", width=20, text_color="#6b7280")
            indicator.pack(side="left")
-            ctk.CTkLabel(row, text=label, anchor="w").pack(side="left", fill="x", expand=True)
+            text_label = ctk.CTkLabel(row, text=t(i18n_key), anchor="w")
+            text_label.pack(side="left", fill="x", expand=True)
            self._status_labels[key] = indicator
+            self._status_text_labels[key] = (text_label, i18n_key)

        # Buttons
        btn_frame = ctk.CTkFrame(self, fg_color="transparent")
        btn_frame.pack(fill="x", padx=20, pady=15)

        self.install_all_btn = ctk.CTkButton(
-            btn_frame, text="Install Everything",
+            btn_frame, text=t("install_everything"),
            font=ctk.CTkFont(size=14, weight="bold"),
            height=40, fg_color="#22c55e", hover_color="#16a34a",
            command=self._install_all
@@ -67,14 +75,71 @@ class SetupTab(ctk.CTkFrame):
        ind_frame = ctk.CTkFrame(btn_frame, fg_color="transparent")
        ind_frame.pack(fill="x")

-        ctk.CTkButton(ind_frame, text="ssh.py", width=100, fg_color="#6b7280",
-                      command=self._install_script).pack(side="left", padx=(0, 5))
-        ctk.CTkButton(ind_frame, text="/ssh skill", width=100, fg_color="#6b7280",
-                      command=self._install_skill).pack(side="left", padx=5)
-        ctk.CTkButton(ind_frame, text="SSH key", width=100, fg_color="#6b7280",
-                      command=self._gen_key).pack(side="left", padx=5)
-        ctk.CTkButton(ind_frame, text="Refresh", width=80, fg_color="#3b82f6",
-                      command=self._refresh_status).pack(side="right")
+        self.ssh_py_btn = ctk.CTkButton(ind_frame, text=t("install_ssh_py"), width=100, fg_color="#6b7280",
+                      command=self._install_script)
+        self.ssh_py_btn.pack(side="left", padx=(0, 5))
+        self.skill_btn = ctk.CTkButton(ind_frame, text=t("install_skill"), width=100, fg_color="#6b7280",
+                      command=self._install_skill)
+        self.skill_btn.pack(side="left", padx=5)
+        self.ssh_key_btn = ctk.CTkButton(ind_frame, text=t("install_ssh_key"), width=100, fg_color="#6b7280",
+                      command=self._gen_key)
+        self.ssh_key_btn.pack(side="left", padx=5)
+        self.refresh_btn = ctk.CTkButton(ind_frame, text=t("refresh"), width=80, fg_color="#3b82f6",
+                      command=self._refresh_status)
+        self.refresh_btn.pack(side="right")
+
+        # ── Configuration section ─────────────────────
+        config_frame = ctk.CTkFrame(self)
+        config_frame.pack(fill="x", padx=20, pady=(5, 5))
+
+        self.config_title = ctk.CTkLabel(
+            config_frame, text=t("configuration"),
+            font=ctk.CTkFont(size=14, weight="bold"), anchor="w"
+        )
+        self.config_title.pack(fill="x", padx=15, pady=(10, 5))
+
+        # Config path row
+        path_row = ctk.CTkFrame(config_frame, fg_color="transparent")
+        path_row.pack(fill="x", padx=15, pady=5)
+
+        self.config_label = ctk.CTkLabel(path_row, text=t("config_label"), anchor="w", width=60)
+        self.config_label.pack(side="left")
+        self._path_label = ctk.CTkLabel(
+            path_row, text=store.get_config_path(),
+            anchor="w", text_color="#9ca3af",
+            font=ctk.CTkFont(family="Consolas", size=11)
+        )
+        self._path_label.pack(side="left", fill="x", expand=True, padx=(5, 10))
+        self.change_path_btn = ctk.CTkButton(
+            path_row, text=t("change_path"), width=100, fg_color="#6b7280",
+            command=self._change_config_path
+        )
+        self.change_path_btn.pack(side="right")
+
+        # Backup row
+        backup_row = ctk.CTkFrame(config_frame, fg_color="transparent")
+        backup_row.pack(fill="x", padx=15, pady=(5, 10))
+
+        self.backup_btn = ctk.CTkButton(
+            backup_row, text=t("backup_now"), width=100, fg_color="#3b82f6",
+            command=self._backup_now
+        )
+        self.backup_btn.pack(side="left", padx=(0, 10))
+
+        self._backup_var = ctk.StringVar(value=t("select_backup"))
+        backups = store.list_backups()
+        values = backups if backups else [t("no_backups")]
+        self._backup_menu = ctk.CTkOptionMenu(
+            backup_row, variable=self._backup_var,
+            values=values, width=250
+        )
+        self._backup_menu.pack(side="left", padx=(0, 10))
+
+        self.restore_btn = ctk.CTkButton(
+            backup_row, text=t("restore"), width=80, fg_color="#ef4444", hover_color="#dc2626",
+            command=self._restore_backup
+        )
+        self.restore_btn.pack(side="left")

        # Log
        self.log = ctk.CTkTextbox(self, height=150, font=ctk.CTkFont(family="Consolas", size=11), state="disabled")
@@ -98,15 +163,15 @@ class SetupTab(ctk.CTkFrame):
                label.configure(text="\u25cf", text_color="#ef4444")  # red

    def _install_all(self):
-        self.install_all_btn.configure(state="disabled", text="Installing...")
+        self.install_all_btn.configure(state="disabled", text=t("installing_all"))

        def _do():
            results = install_all()
            for msg in results:
                self.after(0, lambda m=msg: self._log(m))
            self.after(0, self._refresh_status)
-            self.after(0, lambda: self._log("\nDone! Claude Code can now use /ssh to manage your servers."))
-            self.after(0, lambda: self.install_all_btn.configure(state="normal", text="Install Everything"))
+            self.after(0, lambda: self._log("\n" + t("install_done")))
+            self.after(0, lambda: self.install_all_btn.configure(state="normal", text=t("install_everything")))

        threading.Thread(target=_do, daemon=True).start()

@@ -124,3 +189,46 @@ class SetupTab(ctk.CTkFrame):
        msg = generate_ssh_key()
        self._log(msg)
        self._refresh_status()
+
+    # ── Configuration methods ─────────────────────────
+
+    def _change_config_path(self):
+        path = filedialog.askopenfilename(
+            title=t("select_servers_json"),
+            filetypes=[("JSON files", "*.json"), ("All files", "*.*")],
+            initialdir=os.path.dirname(self.store.get_config_path())
+        )
+        if path:
+            self.store.set_config_path(path)
+            self._path_label.configure(text=path)
+            self._log(t("config_changed").format(path=path))
+
+    def _backup_now(self):
+        try:
+            name = self.store.create_backup()
+            self._log(t("backup_created").format(name=name))
+            self._refresh_backups()
+        except Exception as e:
+            self._log(t("backup_failed").format(e=e))
+
+    def _restore_backup(self):
+        selected = self._backup_var.get()
+        if not selected or selected in (t("select_backup"), t("no_backups")):
+            self._log(t("no_backup_selected"))
+            return
+        if not messagebox.askyesno(t("restore_backup_title"), t("restore_confirm").format(name=selected)):
+            return
+        try:
+            self.store.restore_backup(selected)
+            self._log(t("restored").format(name=selected))
+        except Exception as e:
+            self._log(t("restore_failed").format(e=e))
+
+    def _refresh_backups(self):
+        backups = self.store.list_backups()
+        if backups:
+            self._backup_menu.configure(values=backups)
+            self._backup_var.set(backups[0])
+        else:
+            self._backup_menu.configure(values=[t("no_backups")])
+            self._backup_var.set(t("no_backups"))
--- a/gui/tabs/terminal_tab.py
+++ b/gui/tabs/terminal_tab.py
@@ -5,6 +5,7 @@ Terminal tab — command input + output display.
 import threading
 import customtkinter as ctk
 from core.ssh_client import SSHClientWrapper
+from core.i18n import t


 class TerminalTab(ctk.CTkFrame):
@@ -22,17 +23,17 @@ class TerminalTab(ctk.CTkFrame):
        input_frame.pack(fill="x", padx=10, pady=(0, 10))

        self.sudo_var = ctk.BooleanVar(value=True)
-        self.sudo_check = ctk.CTkCheckBox(input_frame, text="sudo", variable=self.sudo_var, width=60)
+        self.sudo_check = ctk.CTkCheckBox(input_frame, text=t("sudo"), variable=self.sudo_var, width=60)
        self.sudo_check.pack(side="left", padx=(0, 5))

-        self.cmd_entry = ctk.CTkEntry(input_frame, placeholder_text="Enter command...")
+        self.cmd_entry = ctk.CTkEntry(input_frame, placeholder_text=t("enter_command"))
        self.cmd_entry.pack(side="left", fill="x", expand=True, padx=(0, 5))
        self.cmd_entry.bind("<Return>", lambda e: self._run_command())

-        self.run_btn = ctk.CTkButton(input_frame, text="Run", width=70, command=self._run_command)
+        self.run_btn = ctk.CTkButton(input_frame, text=t("run"), width=70, command=self._run_command)
        self.run_btn.pack(side="left", padx=(0, 5))

-        self.clear_btn = ctk.CTkButton(input_frame, text="Clear", width=60, fg_color="#6b7280", command=self._clear)
+        self.clear_btn = ctk.CTkButton(input_frame, text=t("clear"), width=60, fg_color="#6b7280", command=self._clear)
        self.clear_btn.pack(side="right")

    def set_server(self, alias: str | None):
@@ -50,7 +51,7 @@ class TerminalTab(ctk.CTkFrame):

    def _run_command(self):
        if not self._current_alias:
-            self._append_output("[!] No server selected\n")
+            self._append_output(t("no_server_selected") + "\n")
            return

        command = self.cmd_entry.get().strip()
@@ -59,7 +60,7 @@ class TerminalTab(ctk.CTkFrame):

        server = self.store.get_server(self._current_alias)
        if not server:
-            self._append_output(f"[!] Server '{self._current_alias}' not found\n")
+            self._append_output(t("server_not_found").format(alias=self._current_alias) + "\n")
            return

        self.cmd_entry.delete(0, "end")
@@ -87,13 +88,13 @@ class TerminalTab(ctk.CTkFrame):
                    if code != 0:
                        self._append_output(f"[exit code: {code}]\n")
                    self._append_output("\n")
-                    self.run_btn.configure(state="normal", text="Run")
+                    self.run_btn.configure(state="normal", text=t("run"))

                self.after(0, _show)
            except Exception as e:
                def _err():
                    self._append_output(f"[ERROR] {e}\n\n")
-                    self.run_btn.configure(state="normal", text="Run")
+                    self.run_btn.configure(state="normal", text=t("run"))
                self.after(0, _err)

        threading.Thread(target=_exec, daemon=True).start()
--- a/gui/tabs/totp_tab.py
+++ b/gui/tabs/totp_tab.py
@@ -0,0 +1,285 @@
+"""
+TOTP tab — Google Authenticator compatible 2FA codes.
+Live countdown, one-click copy, per-server secrets.
+"""
+
+import threading
+import customtkinter as ctk
+from core.i18n import t
+
+
+class TOTPTab(ctk.CTkFrame):
+    def __init__(self, master, store):
+        super().__init__(master, fg_color="transparent")
+        self.store = store
+        self._current_alias: str | None = None
+        self._timer_id = None
+
+        # Title
+        self.title_label = ctk.CTkLabel(
+            self, text=t("totp_title"),
+            font=ctk.CTkFont(size=16, weight="bold"), anchor="w"
+        )
+        self.title_label.pack(fill="x", padx=15, pady=(15, 5))
+
+        # Description
+        self.desc_label = ctk.CTkLabel(
+            self, text=t("totp_desc"),
+            anchor="w", text_color="#9ca3af", wraplength=600, justify="left"
+        )
+        self.desc_label.pack(fill="x", padx=15, pady=(0, 10))
+
+        # Server name
+        self.server_label = ctk.CTkLabel(
+            self, text=t("no_server_selected"),
+            font=ctk.CTkFont(size=13), anchor="w", text_color="#6b7280"
+        )
+        self.server_label.pack(fill="x", padx=15, pady=(0, 10))
+
+        # Code display frame
+        code_frame = ctk.CTkFrame(self, fg_color="#1e1e2e", corner_radius=12)
+        code_frame.pack(fill="x", padx=15, pady=(0, 10))
+
+        self.code_label = ctk.CTkLabel(
+            code_frame, text="------",
+            font=ctk.CTkFont(family="Consolas", size=42, weight="bold"),
+            text_color="#22c55e"
+        )
+        self.code_label.pack(pady=(20, 5))
+
+        self.timer_label = ctk.CTkLabel(
+            code_frame, text="",
+            font=ctk.CTkFont(size=12), text_color="#9ca3af"
+        )
+        self.timer_label.pack(pady=(0, 5))
+
+        self.progress_bar = ctk.CTkProgressBar(code_frame, width=300, height=6)
+        self.progress_bar.pack(pady=(0, 15))
+        self.progress_bar.set(1.0)
+
+        # Copy button
+        self.copy_btn = ctk.CTkButton(
+            self, text=t("totp_copy"), width=200, height=40,
+            font=ctk.CTkFont(size=14),
+            fg_color="#22c55e", hover_color="#16a34a",
+            command=self._copy_code
+        )
+        self.copy_btn.pack(pady=(5, 15))
+
+        # Secret management section
+        secret_frame = ctk.CTkFrame(self, fg_color="transparent")
+        secret_frame.pack(fill="x", padx=15, pady=(10, 5))
+
+        ctk.CTkLabel(
+            secret_frame, text=t("totp_secret_label"),
+            font=ctk.CTkFont(size=13, weight="bold"), anchor="w"
+        ).pack(fill="x")
+
+        entry_row = ctk.CTkFrame(secret_frame, fg_color="transparent")
+        entry_row.pack(fill="x", pady=(5, 0))
+
+        self.secret_entry = ctk.CTkEntry(
+            entry_row, show="*",
+            placeholder_text=t("totp_secret_placeholder"),
+            font=ctk.CTkFont(family="Consolas", size=12)
+        )
+        self.secret_entry.pack(side="left", fill="x", expand=True, padx=(0, 5))
+
+        self.show_secret_btn = ctk.CTkButton(
+            entry_row, text=t("show"), width=70,
+            fg_color="#6b7280", hover_color="#4b5563",
+            command=self._toggle_secret
+        )
+        self.show_secret_btn.pack(side="left", padx=(0, 5))
+        self._secret_visible = False
+
+        self.save_secret_btn = ctk.CTkButton(
+            entry_row, text=t("totp_save_secret"), width=100,
+            command=self._save_secret
+        )
+        self.save_secret_btn.pack(side="left", padx=(0, 5))
+
+        self.remove_secret_btn = ctk.CTkButton(
+            entry_row, text=t("totp_remove_secret"), width=100,
+            fg_color="#ef4444", hover_color="#dc2626",
+            command=self._remove_secret
+        )
+        self.remove_secret_btn.pack(side="left")
+
+        # Generate random secret button
+        self.gen_secret_btn = ctk.CTkButton(
+            secret_frame, text=t("totp_generate_secret"), width=180,
+            fg_color="#6b7280", hover_color="#4b5563",
+            command=self._generate_secret
+        )
+        self.gen_secret_btn.pack(anchor="w", pady=(8, 0))
+
+        # Status log
+        self.status_label = ctk.CTkLabel(
+            self, text="", anchor="w", text_color="#9ca3af"
+        )
+        self.status_label.pack(fill="x", padx=15, pady=(5, 10))
+
+    def set_server(self, alias: str | None):
+        self._current_alias = alias
+        self._stop_timer()
+
+        if not alias:
+            self.server_label.configure(text=t("no_server_selected"))
+            self.code_label.configure(text="------")
+            self.timer_label.configure(text="")
+            self.progress_bar.set(1.0)
+            self.secret_entry.delete(0, "end")
+            self.status_label.configure(text="")
+            return
+
+        self.server_label.configure(text=f"🖥 {alias}")
+        server = self.store.get_server(alias)
+        if not server:
+            return
+
+        secret = server.get("totp_secret", "")
+        self.secret_entry.delete(0, "end")
+        if secret:
+            self.secret_entry.insert(0, secret)
+            self._start_timer()
+        else:
+            self.code_label.configure(text="------")
+            self.timer_label.configure(text=t("totp_no_secret"))
+            self.progress_bar.set(1.0)
+
+    def _start_timer(self):
+        self._stop_timer()
+        self._update_code()
+
+    def _stop_timer(self):
+        if self._timer_id:
+            self.after_cancel(self._timer_id)
+            self._timer_id = None
+
+    def _update_code(self):
+        if not self._current_alias:
+            return
+
+        server = self.store.get_server(self._current_alias)
+        if not server:
+            return
+
+        secret = server.get("totp_secret", "")
+        if not secret:
+            self.code_label.configure(text="------")
+            self.timer_label.configure(text=t("totp_no_secret"))
+            self.progress_bar.set(1.0)
+            return
+
+        try:
+            from core.totp import get_code_with_timer
+            data = get_code_with_timer(secret)
+            code = data["code"]
+            remaining = data["remaining"]
+            progress = data["progress"]
+
+            # Format code with space in middle: "123 456"
+            formatted = f"{code[:3]} {code[3:]}"
+            self.code_label.configure(text=formatted)
+            self.timer_label.configure(text=t("totp_remaining").format(sec=remaining))
+            self.progress_bar.set(progress)
+
+            # Color based on time remaining
+            if remaining <= 5:
+                self.code_label.configure(text_color="#ef4444")
+            elif remaining <= 10:
+                self.code_label.configure(text_color="#f59e0b")
+            else:
+                self.code_label.configure(text_color="#22c55e")
+
+        except Exception as e:
+            self.code_label.configure(text="ERROR")
+            self.timer_label.configure(text=str(e))
+
+        # Schedule next update in 1 second
+        self._timer_id = self.after(1000, self._update_code)
+
+    def _copy_code(self):
+        code_text = self.code_label.cget("text").replace(" ", "")
+        if code_text and code_text != "------" and code_text != "ERROR":
+            self.clipboard_clear()
+            self.clipboard_append(code_text)
+            self.status_label.configure(text=t("totp_copied"), text_color="#22c55e")
+            self.after(2000, lambda: self.status_label.configure(text=""))
+        else:
+            self.status_label.configure(text=t("totp_no_code"), text_color="#ef4444")
+            self.after(2000, lambda: self.status_label.configure(text=""))
+
+    def _toggle_secret(self):
+        self._secret_visible = not self._secret_visible
+        self.secret_entry.configure(show="" if self._secret_visible else "*")
+        self.show_secret_btn.configure(text=t("hide") if self._secret_visible else t("show"))
+
+    def _save_secret(self):
+        if not self._current_alias:
+            self.status_label.configure(text=t("no_server_selected"), text_color="#ef4444")
+            return
+
+        secret = self.secret_entry.get().strip()
+        if not secret:
+            self.status_label.configure(text=t("totp_secret_empty"), text_color="#ef4444")
+            self.after(2000, lambda: self.status_label.configure(text=""))
+            return
+
+        # Validate secret
+        try:
+            from core.totp import get_code
+            get_code(secret)
+        except Exception:
+            self.status_label.configure(text=t("totp_secret_invalid"), text_color="#ef4444")
+            self.after(2000, lambda: self.status_label.configure(text=""))
+            return
+
+        server = self.store.get_server(self._current_alias)
+        if server:
+            server["totp_secret"] = secret
+            self.store.update_server(self._current_alias, server)
+            self.status_label.configure(text=t("totp_secret_saved"), text_color="#22c55e")
+            self.after(2000, lambda: self.status_label.configure(text=""))
+            self._start_timer()
+
+    def _remove_secret(self):
+        if not self._current_alias:
+            return
+
+        server = self.store.get_server(self._current_alias)
+        if server and "totp_secret" in server:
+            del server["totp_secret"]
+            self.store.update_server(self._current_alias, server)
+            self.secret_entry.delete(0, "end")
+            self._stop_timer()
+            self.code_label.configure(text="------", text_color="#22c55e")
+            self.timer_label.configure(text="")
+            self.progress_bar.set(1.0)
+            self.status_label.configure(text=t("totp_secret_removed"), text_color="#9ca3af")
+            self.after(2000, lambda: self.status_label.configure(text=""))
+
+    def _generate_secret(self):
+        try:
+            from core.totp import generate_secret
+            secret = generate_secret()
+            self.secret_entry.delete(0, "end")
+            self.secret_entry.insert(0, secret)
+            self.status_label.configure(text=t("totp_secret_generated"), text_color="#22c55e")
+            self.after(2000, lambda: self.status_label.configure(text=""))
+        except Exception as e:
+            self.status_label.configure(text=f"Error: {e}", text_color="#ef4444")
+
+    def update_language(self):
+        self.title_label.configure(text=t("totp_title"))
+        self.desc_label.configure(text=t("totp_desc"))
+        self.copy_btn.configure(text=t("totp_copy"))
+        self.save_secret_btn.configure(text=t("totp_save_secret"))
+        self.remove_secret_btn.configure(text=t("totp_remove_secret"))
+        self.gen_secret_btn.configure(text=t("totp_generate_secret"))
+        self.show_secret_btn.configure(
+            text=t("hide") if self._secret_visible else t("show")
+        )
+        if not self._current_alias:
+            self.server_label.configure(text=t("no_server_selected"))
--- a/plans/v1.3.0-stability-totp.md
+++ b/plans/v1.3.0-stability-totp.md
@@ -0,0 +1,91 @@
+# Plan v1.3.0 — Stability, Security & TOTP Integration
+
+## Version: 1.3.0
+## Date: 2026-02-23
+
+---
+
+## 1. Усиление ключа шифрования
+**Файл:** `core/encryption.py`
+- Заменить слабый ключ на более сложный (64-char base64, сгенерированный из `os.urandom(32)`)
+- Ключ остаётся вшитым (by design), но существенно усложнён
+- Обратная совместимость: при первом запуске с новым ключом — авто-миграция старых данных
+
+## 2. Atomic write + file locking для servers.json
+**Файл:** `core/server_store.py`
+- `threading.Lock` для синхронизации потоков
+- Запись через `.tmp` файл + `os.replace()` (атомарная замена)
+- Обработка `JSONDecodeError` при загрузке — авто-восстановление из бэкапа
+
+## 3. Параллельная проверка статусов
+**Файл:** `core/status_checker.py`
+- `concurrent.futures.ThreadPoolExecutor(max_workers=10)` вместо последовательной проверки
+- 100 серверов: ~10 сек вместо ~500 сек
+
+## 4. TOTP / Google Authenticator интеграция
+**Новый файл:** `core/totp.py`
+- `pyotp` для генерации TOTP-кодов
+- Функции: `generate_secret()`, `get_code(secret)`, `get_code_with_timer(secret)`
+
+**Изменение:** `core/server_store.py`
+- Поле `totp_secret` в данных сервера (шифруется вместе с паролем)
+
+**Новый файл:** `gui/tabs/totp_tab.py`
+- Вкладка "2FA" в tabview
+- Отображение текущего 6-значного кода с countdown (30 сек)
+- Кнопка копирования в буфер
+- Настройка: ввод secret для сервера
+- Авто-обновление каждую секунду
+
+**Изменения в i18n:** ключи для TOTP-вкладки на EN/RU/ZH
+
+## 5. Валидация ввода в server_dialog
+**Файл:** `gui/server_dialog.py`
+- Проверка IP/hostname regex
+- Проверка порта 1-65535
+- Inline-ошибки вместо мигания title
+
+## 6. SSH resource cleanup
+**Файл:** `core/ssh_client.py`
+- Закрытие stdin/stdout/stderr в finally
+- Права 0o600 на сгенерированный ключ (Linux/Mac)
+
+## 7. Логирование
+**Новый файл:** `core/logger.py`
+- `logging.handlers.RotatingFileHandler` → `~/.server-connections/app.log`
+- 5 MB max, 3 backup файла
+- Используется в server_store, ssh_client, status_checker
+
+## 8. Pinned dependencies
+**Файл:** `requirements.txt`
+- Зафиксировать текущие версии
+- Добавить `pyotp`
+
+## 9. Version bump + docs
+- `version.py` → 1.3.0
+- `CHANGELOG.md` — запись 1.3.0
+- `README.md` — TOTP в списке фич
+- `gui/app.py` — вкладка 2FA в tabview
+- `core/i18n.py` — ключи для TOTP
+
+---
+
+## Файлы и действия
+
+| Файл | Действие |
+|------|----------|
+| `core/encryption.py` | ИЗМЕНИТЬ — новый сложный ключ + миграция |
+| `core/server_store.py` | ИЗМЕНИТЬ — lock, atomic write, JSON error handling |
+| `core/status_checker.py` | ИЗМЕНИТЬ — параллельные проверки |
+| `core/ssh_client.py` | ИЗМЕНИТЬ — resource cleanup, key permissions |
+| `core/totp.py` | СОЗДАТЬ — TOTP-модуль |
+| `core/logger.py` | СОЗДАТЬ — logging framework |
+| `core/i18n.py` | ИЗМЕНИТЬ — TOTP-ключи |
+| `gui/app.py` | ИЗМЕНИТЬ — вкладка 2FA |
+| `gui/server_dialog.py` | ИЗМЕНИТЬ — валидация, TOTP secret поле |
+| `gui/tabs/totp_tab.py` | СОЗДАТЬ — TOTP вкладка |
+| `requirements.txt` | ИЗМЕНИТЬ — pinned + pyotp |
+| `version.py` | ИЗМЕНИТЬ — 1.3.0 |
+| `CHANGELOG.md` | ИЗМЕНИТЬ |
+| `README.md` | ИЗМЕНИТЬ |
+| `build.py` | без изменений |
--- a/releases/ServerManager-v1.3.0-win-x64.exe
+++ b/releases/ServerManager-v1.3.0-win-x64.exe
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,3 +1,5 @@
 customtkinter>=5.2.0
 paramiko>=3.4.0
 pillow>=10.0.0
+cryptography>=41.0.0
+pyotp>=2.9.0
--- a/tools/ssh.py
+++ b/tools/ssh.py
@@ -1,7 +1,7 @@
 #!/usr/bin/env python3
 """
 SSH utility for Claude Code — connects to servers by alias.
-Credentials stored locally in servers.json, NEVER exposed to AI API.
+Credentials stored locally in servers.json (encrypted), NEVER exposed to AI API.

 Usage:
    python ssh.py ALIAS "command"              # run as configured user (auto-sudo if needed)
@@ -24,22 +24,59 @@ import paramiko

 # Shared config — same file used by ServerManager GUI
 SHARED_DIR = os.path.expanduser("~/.server-connections")
-SERVERS_FILE = os.path.join(SHARED_DIR, "servers.json")
+SETTINGS_FILE = os.path.join(SHARED_DIR, "settings.json")
+DEFAULT_SERVERS_FILE = os.path.join(SHARED_DIR, "servers.json")
 SSH_KEY_PATH = os.path.expanduser("~/.ssh/id_ed25519")
 SSH_CONFIG_PATH = os.path.expanduser("~/.ssh/config")

+# Encryption support — encryption.py is copied to SHARED_DIR by GUI setup
+if SHARED_DIR not in sys.path:
+    sys.path.insert(0, SHARED_DIR)
+try:
+    from encryption import decrypt, encrypt, is_encrypted
+    HAS_ENCRYPTION = True
+except ImportError:
+    HAS_ENCRYPTION = False
+
+
+def _get_servers_file() -> str:
+    """Get servers file path from settings.json or use default."""
+    if os.path.exists(SETTINGS_FILE):
+        try:
+            with open(SETTINGS_FILE, "r", encoding="utf-8") as f:
+                settings = json.load(f)
+            path = settings.get("servers_path", "")
+            if path and os.path.exists(path):
+                return path
+        except Exception:
+            pass
+    return DEFAULT_SERVERS_FILE
+

 # ── Data ──────────────────────────────────────────────

 def load_servers():
-    with open(SERVERS_FILE, "r", encoding="utf-8") as f:
-        data = json.load(f)
+    servers_file = _get_servers_file()
+    with open(servers_file, "rb") as f:
+        raw = f.read()
+    if HAS_ENCRYPTION and is_encrypted(raw):
+        text = decrypt(raw)
+        data = json.loads(text)
+    else:
+        data = json.loads(raw.decode("utf-8"))
    return data, {s["alias"]: s for s in data.get("servers", [])}


 def save_servers(data):
-    with open(SERVERS_FILE, "w", encoding="utf-8") as f:
-        json.dump(data, f, indent=2, ensure_ascii=False)
+    servers_file = _get_servers_file()
+    text = json.dumps(data, indent=2, ensure_ascii=False)
+    if HAS_ENCRYPTION:
+        encrypted = encrypt(text)
+        with open(servers_file, "wb") as f:
+            f.write(encrypted)
+    else:
+        with open(servers_file, "w", encoding="utf-8") as f:
+            f.write(text)


 # ── Connection ────────────────────────────────────────
--- a/version.py
+++ b/version.py
@@ -1,6 +1,6 @@
 """Version info for ServerManager."""

-__version__ = "1.0.0"
+__version__ = "1.3.0"
 __app_name__ = "ServerManager"
 __author__ = "aibot777"
 __description__ = "Desktop GUI for managing remote servers"