What is Synch?

Synch is an end-to-end encrypted sync tool for Obsidian vaults. It encrypts everything on your device before transmission, keeping notes, paths, and keys private from the server. Features include near-real-time synchronization, encrypted version history with deleted file recovery, and intelligent Markdown conflict resolution that auto-merges compatible edits while saving conflict copies for overlapping changes. Images, audio, video, and PDFs sync by default. Deploy your own server on Cloudflare Workers, Docker Compose, or systemd, then configure the Obsidian plugin to use your endpoint. The project uses the MIT license and is maintained by the hjinco organization.

Should you self-host Synch?

Synch scores 49/100 on selfhost.directory (how scoring works) and ranks #7 of 15 in File Sync. It has 269 GitHub stars.

It shipped 10 stable releases in the past year. The latest, 0.5.5, came out on 6 October 2026. New versions land roughly every 2 days.

Setup is moderate: expect some configuration beyond a single command. It is MIT-licensed and written mostly in Typescript.

Its closest alternative on selfhost.directory is NoteDiscovery (62/100, 2 855 stars). It scores higher overall, so compare the two before you pick. See Synch vs NoteDiscovery side by side.

Features

Automatic Markdown conflict merging
Conflict copies for overlapping edits
Custom API URL
Deleted file recovery
Desktop and mobile Obsidian support
Encrypted version history
End-to-end encryption
Multiple file type support
Near-instant synchronization

How to configure Synch

AUTH_ALLOWED_EMAILSyou@example.com,family@example.comRequired comma-separated allowlist for new account sign-ups. Existing users can still sign in after their address is removed.
Required comma-separated allowlist for new account sign-ups. Existing users can still sign in after their address is removed.
values: Comma-separated email addresses
BETTER_AUTH_SECRETRandom secret for authentication. Generate with: openssl rand -hex 32
Random secret for authentication. Generate with: openssl rand -hex 32
values: 64-character hex string
BLOB_STORAGEdiskBlob storage backend: "disk" (default, stored under the data volume) or "s3"
Blob storage backend: "disk" (default, stored under the data volume) or "s3"
values: disk, s3
CORS_ORIGINOptional restriction for which origins may call the API (defaults to PUBLIC_URL)
Optional restriction for which origins may call the API (defaults to PUBLIC_URL)
values: Valid URL
GITHUB_CLIENT_IDOptional GitHub OAuth client ID for GitHub sign-in
Optional GitHub OAuth client ID for GitHub sign-in
values: GitHub OAuth client ID
GITHUB_CLIENT_SECRETOptional GitHub OAuth client secret for GitHub sign-in
Optional GitHub OAuth client secret for GitHub sign-in
values: GitHub OAuth client secret
GOOGLE_CLIENT_IDOptional Google OAuth client ID for Google sign-in
Optional Google OAuth client ID for Google sign-in
values: Google OAuth client ID
GOOGLE_CLIENT_SECRETOptional Google OAuth client secret for Google sign-in
Optional Google OAuth client secret for Google sign-in
values: Google OAuth client secret
HOST0.0.0.0Interface to bind to. Defaults to 0.0.0.0 (all interfaces). Set to 127.0.0.1 to bind only to localhost.
Interface to bind to. Defaults to 0.0.0.0 (all interfaces). Set to 127.0.0.1 to bind only to localhost.
values: IP address
PUBLIC_URLhttp://localhost:8787The address clients will reach this server at, with no trailing slash. Must match how you actually access it including scheme and port.
The address clients will reach this server at, with no trailing slash. Must match how you actually access it including scheme and port.
values: Any valid URL
REQUEST_TIMEOUT_MS300000Total time allowed to receive an HTTP request in milliseconds (default 300000)
Total time allowed to receive an HTTP request in milliseconds (default 300000)
values: Integer milliseconds up to 1500000
S3_ACCESS_KEY_IDS3 access key ID
S3 access key ID
values: Access key ID
S3_BUCKETS3 bucket name for blob storage
S3 bucket name for blob storage
values: Bucket name
S3_ENDPOINTS3-compatible endpoint URL when using S3 blob storage
S3-compatible endpoint URL when using S3 blob storage
values: Valid URL
S3_REGIONautoS3 region (default: auto)
S3 region (default: auto)
values: AWS region or auto
S3_SECRET_ACCESS_KEYS3 secret access key
S3 secret access key
values: Secret access key
SYNC_TOKEN_SECRETRandom secret for sync tokens. Generate with: openssl rand -hex 32
Random secret for sync tokens. Generate with: openssl rand -hex 32
values: 64-character hex string