aliases:
- Security/privacy for Obsidian Sync
- Access control for Obsidian Sync
description: Learn about the security and privacy considerations for Obsidian Sync.
mobile: false
permalink: sync/security
publish: trueFor your safety, Obsidian Sync encrypts your remote vault and all communication with Obsidian's servers.
When you create a new remote vault, you have two options:
We recommend end-to-end encryption for all users as it is the most private and secure option. However, be aware that if you forget or lose your encryption password, your data remains encrypted and unusable forever. We're not able to recover your password, or any encrypted data for you.
Your choice only affects your remote vault. Obsidian doesn't encrypt your local vault.
End-to-end encryption means that the data is encrypted from the moment it leaves your device, and can only be decrypted using your encryption key once it's back on one of your devices.
We can't read your data. Neither can any potential eavesdroppers, such as your internet service provider.
In the rare case of a complete server breach, your data remains encrypted—no one can decrypt your files without knowing your password.
Standard encryption is fundamentally less secure than end-to-end encryption, but it can be a convenient option if you do not expect the data you are syncing to be completely private. For example, if your synced vault is published to a public website like this Help site, then end-to-end encryption is not necessary.
Standard encryption is the same method of encryption used by cloud storage companies and software-as-a-service platforms, such as Google Docs, Dropbox, and iCloud (without Advanced Data Protection). Your encryption key is generated by the app and used to protect your data in transit and on the server. Because the encryption key is stored on company servers, it can be used to decrypt your data, e.g. in a case where the company is subject to a search warrant, or in a case where you want to access your data via a web browser.
End-to-end encryption guarantees that Obsidian can never access your data and should always be used to sync data that you wish to remain completely private and secure.
For data security, we implement industry-standard encryption protocols. Specifically, we use AES-256, the strongest encryption standard, widely employed in contexts such as online banking. The encryption process involves the following technical details:
Yes. See our guide, how to verify Obsidian Sync's end-to-end encryption. This guide provide step-by-step instructions for you to trustlessly verify the end-to-end encryption of your data when it is sent and received via Sync servers.
Yes. Obsidian has been independently audited. Visit our Security page to view audit reports. Regular audits by third-party security firms ensure that Obsidian code and procedures meet the highest security standards.
If you ever lose or forget the encryption password, you won't be able to connect additional vaults to your remote vault. Since the encryption password isn't saved anywhere, it's forever lost.
Your data, however, is usually safely stored locally on each of your devices.
To continue using Obsidian Sync, we suggest doing a full re-setup to be able to add new devices to your Sync system:
Our data centers, powered by DigitalOcean, provide geo-regional remote vault hosting options in the following locations:
Automatic: Your data center is chosen based on your IP location.
Asia: Singapore
Europe: Frankfurt, Germany
North America: San Francisco, USA
Oceania: Sydney, Australia
To locate your Obsidian Sync server, follow these steps:
Host server: wss://sync-xx.obsidian.mdThis line indicates the server where your remote vault is hosted. For more details on the server's locations and uptime, visit our status page.
To regulate access to Obsidian Sync on your network, you need to manage the following domains:
sync-xx.obsidian.md
The xx in this case represents a number ranging from 1 - 100.
sync-*.obsidian.md to account for the continuous growth in subdomain numbers.