TOTEMSurfAvailable · v1.0.0Your browser. Your VPN, your servers. All in one window.
Most people run three things side by side: a VPN client, a browser, and a terminal for their servers. None of them knows about the others. TOTEMSurf is those three as one desktop app — and because the tunnel belongs to the browser rather than to the whole computer, it can decide site by site what goes through it.
macOS 14 or later, or Windows 10 and 11 (64-bit). Notarized by Apple on the Mac, signed by Oceanic Consulting VOF on Windows. Updates itself from update.totemsurf.app, and every update is signed.
The one thing a system VPN cannot do
Choose, site by site, what goes through the tunnel
A VPN that covers the whole computer only sees addresses. The browser knows the name of the site you typed — so TOTEMSurf can route each site on its own. Try it:
Turn on JavaScript to try the routing demo. In short: every site goes through the tunnel unless a rule sends it direct or blocks it, and private addresses always go direct.
What makes it different
Routing per site, not per computer
Send your bank direct, everything else through the tunnel, and block a tracker outright. A VPN for the whole computer never sees the site name, only an address — the browser does.
Connected means proven
The shield turns green only after traffic has actually gone through the server and come out the other side. A server that connects but carries nothing does not count.
Your servers, in the same app
SSH, SFTP and FTP with split panes, several servers open at once, saved hosts, and port forwarding that reconnects by itself.
Profiles that are really separate
Each profile has its own encrypted database, its own cookies and its own key. Lock one with a password and nothing on the machine can open it without that password.
Passwords behind your fingerprint
Saved logins fill in with one click. Showing, copying or editing one asks for Touch ID or Windows Hello first.
An assistant beside the page
Ask the built-in assistant about the page you are reading, or open Claude, ChatGPT or Gemini in a side panel with your own account.
Blocking built in
Ad and tracker blocking is part of the browser — no extension with permission to read your pages.
Updates you can trust
Every update is signed, and the app refuses one whose signature does not match — even if the download server itself were taken over.
What it deliberately does not do
A page that lists only strengths is a page nobody can check.
It uses the web engine your system already has and keeps up to date — WebKit on macOS, Microsoft Edge WebView2 on Windows.
Blocking is built in instead. There is no Chrome Web Store inside it.
Only the browser's traffic goes through the VPN. For the whole device, use the TOTEMVPN app.
On your phone, use TOTEMVPN's mobile app.
At a glance
- Platforms
- macOS 14 or later · Windows 10 and 11 (64-bit)
- VPN
- A TOTEMVPN account — sign in inside the app
- Engine
- WebKit on macOS · Edge WebView2 on Windows
- Updates
- Automatic and signed, from update.totemsurf.app
Questions
Do I need a TOTEMVPN account?
For the VPN, yes — you sign in inside the app. The browser, the SSH console and the assistant work without one.
Does a site I route direct get slower?
No. A site you send direct never touches the tunnel.
Where are my passwords stored?
Encrypted on your own computer. The key is kept in the macOS Keychain or the Windows Credential Manager, never in a file next to the data.