What a 3270 emulator does
IBM’s 3270 terminals have been the front end of mainframe applications since the 1970s. The terminals are long gone. The applications written for them still handle claims, payments, orders and benefits on z/OS, under CICS, IMS and TSO. A 3270 emulator is the program that stands in for the terminal.
A 3270 screen doesn’t behave like a web page or a Unix terminal. The mainframe sends a whole screen at once, divided into fields. Some fields are protected, some take input and some accept only numbers. The person fills in fields locally, and nothing goes to the host until they press Enter, a PF key, a PA key or Clear. Then the terminal sends back only the fields that changed.
The emulator reproduces all of that. It draws the screen and applies the field rules. It maps the 3270 keys, such as PF1 to PF24, PA1 to PA3, Clear, Reset and Attention, onto a PC or Mac keyboard. It also converts between EBCDIC, the mainframe’s character encoding, and the characters on the PC. That uses a code page such as 037 for US English, or 1140, which is 037 with the euro sign.
Screen sizes come from the original terminal models. Model 2 is 24 rows by 80 columns, and it’s the size most applications are written for. Model 3 is 32×80, Model 4 is 43×80 and Model 5 is 27×132.
TN3270 and TN3270E in plain English
Real 3270 terminals connected to a control unit that was cabled to the mainframe and usually spoke SNA. TN3270 replaced the cable with a Telnet connection over TCP/IP. The emulator connects to a TN3270 server, usually the one in z/OS Communications Server, and the server hands the session to the application through VTAM.
Plain TN3270 left gaps. The client couldn’t ask for a particular terminal name. There was no standard way to run a printer, and keys such as Attention and System Request had no agreed meaning. TN3270E closes those gaps. Its current definition is RFC 2355, published in June 1998. In practice it adds six things.
- Device names. The emulator can ask for a specific LU name. CICS terminal IDs, security rules and print routing that depend on the name keep working.
- Printer sessions. A 3287 printer session receives print jobs from the host. TN3270E can tie a printer to a person’s display session, so their prints come out at their desk.
- Attention and System Request. These keys get standard Telnet signals, so Attention in TSO and System Request behave as they did on a real terminal.
- Responses. The host can ask for a positive or negative response to each message, as SNA applications expect.
- The BIND image. The server passes along the SNA BIND, which tells the emulator what the application expects, such as the screen size.
- SCS printing. Printer data in SNA character string (SCS) format, which many older print applications still produce.
TN3270E is negotiated when the connection opens. If one side doesn’t support it, the session can fall back to plain TN3270. Today “TN3270 client,” “TN3270E emulator” and “3270 emulator” all mean the same kind of product.
Most sites now require TLS on these connections, set up on z/OS with AT-TLS or in the TN3270E server’s own configuration. Without it, user IDs and passwords cross the network as plain text. IBM i uses a close relative, the 5250 data stream over TN5250, and many companies need both in one emulator.
What a modern 3270 emulator should do
Every emulator can draw a 3270 screen. In a large company, the differences that matter are how much control IT has and how much work the emulator saves the people using it.
Run where people work
That means Windows, a native Mac app and a browser, plus Citrix and Azure Virtual Desktop where you already use them. A Mac user shouldn’t need a Windows desktop in Citrix to reach CICS. A contractor shouldn’t wait three weeks for an imaged laptop. See 3270 on Mac and Citrix and AVD.
Bring sessions and keyboard maps across
People have years of muscle memory in their keyboard maps. A new emulator should read the old session and keymap files directly. It should list anything it can’t convert and say why, instead of dropping settings without a word.
Take orders from IT
Connections, encryption and feature switches should come from Group Policy, Intune or a Mac configuration profile, and the emulator itself should enforce them. Otherwise a user can get around IT’s settings just by typing a different host address.
Encrypt with validated cryptography
TLS 1.2 or later should be the default. Regulated and public-sector buyers often need a FIPS 140 validated cryptographic module. Using the operating system’s TLS (SChannel on Windows, Apple’s Security framework on macOS) gets you that without the emulator carrying cryptography of its own. Ask about certificate pinning and smart-card sign-in too.
Produce evidence without leaking screens
Security teams want connections, copies, prints, file transfers and blocked attempts in Splunk, Sentinel, QRadar or ArcSight. They don’t want screen contents or keystrokes in those logs. Card numbers should be masked in anything that leaves the screen, such as copies, prints and tickets. Privileged sessions may also need a tamper-evident recording.
Cut retyping, without host changes
A lot of mainframe work is copying between screens and spreadsheets. Built-in tools that fill a screen from Excel, capture a multi-page list into one table or show a screen as a form save hours, and nobody has to touch the COBOL.
Explain errors, inside your network
An abend code or an SQLCODE means nothing to a new hire. A good emulator explains it on the spot. If it uses AI, the model should run on the PC or on a server you control. Text should be masked before it goes anywhere, and IT should be able to turn the AI off. Our mainframe error code library explains common codes in plain English.
Licensing you can read
Look for a published price and a plain rule for counting seats. Ask whether the vendor can send a back-dated bill after an audit. A license that’s checked on the computer, with no phone-home, also makes vendor risk review shorter.
Free and open-source options
The open-source x3270 family includes x3270, c3270 for a text terminal and wc3270 for Windows. On the Mac, DX3270 is a free native app announced in May 2026. Both are fine for an individual developer or systems programmer. Large IT teams usually also need settings that IT pushes and locks, and a vendor to call. The Mac page covers the free options in more detail.
Before your next renewal
The vendor market has changed since 2024. Rocket Software bought OpenText’s Application Modernization and Connectivity business, the former Micro Focus and Attachmate products, for $2.275 billion. Rocket now sells Reflection, Rumba, Extra!, InfoConnect and BlueZone, and is consolidating them into Rocket Secure Host Access. BlueZone is now sold as Rocket Terminal Emulator. Ericom stopped selling PowerTerm in March 2025, and its support ends on June 30, 2027.
If your emulator is one of these, ask four questions before you renew.
- What has the per-seat price done over the last three renewals, and is the next increase capped? Our customers describe yearly increases of 9–14% (Fifth Third), 12% at the last renewal (The Home Depot), and 10% plus a five-year commitment (Union Pacific).
- How many licensed seats were used in the last 90 days? Fifth Third found 3,300 of its 7,400 seats unused.
- Is there a native Mac version, and a browser option that doesn’t need a separate product?
- What happens to your product, and your contract, if it’s folded into a new one?
The switching guide shows what WND Terminal imports from each product. The savings calculator estimates the difference for your seat count.
Checked in October 2026 against RFC 2355 (TN3270 Enhancements), SD Times on the Rocket acquisition, IT Jungle on Rocket Secure Host Access and Ericom’s end-of-sale notice. Customer figures are from WND’s published customer stories.