Syncthing is an open-source, peer-to-peer continuous file synchronization program that syncs folders directly between a user's own devices over TLS, with no account and no central server; its infrastructure and website are paid for by the Syncthing Foundation, a registered Swedish non-profit with a three-person named board, and the code is published under the Mozilla Public License 2.0. The project's own security documentation is unusually candid about what does leave the device: the project-run global discovery servers learn each device's ID and external IP, public relay servers (which cannot read file data) learn device IDs, IPs and traffic volume, automatic upgrade checks contact project servers, and anonymous crash reporting is on by default while usage reporting is off by default. Caveats include the beta status of encryption for untrusted devices, discontinuation of the official Android app in December 2024 (a community fork continues), and the absence of a bug bounty or any independent security audit found in this research; the project publishes GitHub security advisories and a signed-release verification process, and no breach or regulatory action was found.
TIMELINE
NO ENTRIES ON FILE YET.
TOOLS WE RECOMMEND
PLUS
RECEIPTS
13 ON FILE
COLLECTION
Syncthing's Security Principles documentation discloses what its default configuration sends to project-run infrastructure: with global discovery on (the default) a device announces its device ID and listening port every 30 minutes so the discovery servers can map device ID to external IP; automatic upgrade checks contact the project's download site at startup and every twelve hours but contain no identifiable information; usage reporting defaults to off, though the GUI asks once about enabling it.
Syncthing's homepage states that none of the user's data is ever stored anywhere other than the user's own computers, that there is no central server that could be compromised legally or illegally, that all communication is secured using TLS with perfect forward secrecy, and that every device is identified by a strong cryptographic certificate — a design with no account and no operator-held copy of the synced files.
Syncthing's source repository publishes the complete code under the Mozilla Public License Version 2.0, letting anyone inspect, audit or fork the software that actually runs.
Syncthing's homepage discloses that Kastelo, a commercial company, provides commercial support for Syncthing and sponsors the project with development resources — the main named commercial party alongside the non-profit foundation.
The README of the official syncthing-android repository states the app is discontinued, with its last GitHub and F-Droid release accompanying the December 2024 Syncthing version, citing Google Play publishing difficulties and lack of active maintenance; Android users are left to community forks or other means, a maintenance-continuity gap for the mobile platform.
The Syncthing Foundation page states the foundation is a registered Swedish non-profit foundation whose bylaws set its purpose as maintaining and encouraging development and usage of Syncthing and its required infrastructure; in practice it pays for the website, discovery servers and build servers. The page links the bylaws and the fiscal-2020 annual report as PDFs, and names the three board members — Audrius Butkevicius, Jakob Borg and Simon Frei — with contact addresses. No Swedish organisation number appears in the page text.
Privacy Guides lists Syncthing as its File Sync recommendation, under criteria that include not storing decrypted data on a remote server, being open-source, and having clients for Linux, macOS and Windows or a web interface.
Syncthing's Untrusted (Encrypted) Devices documentation describes an option to sync a folder to an untrusted device (such as a cloud server) in encrypted form using a per-folder password, protecting file data, metadata and directory structure, but it carries a warning that the feature should still be considered beta / testing only, and it states that folder ID and label and approximate file sizes are not protected.
Syncthing's Relaying documentation states that when two devices cannot connect directly they may use a public relay; the connection remains end-to-end encrypted and the relay only retransmits encrypted data much like a router, but a device must register with a relay to be reachable, so the relay operator learns the device's IP address and device ID and can see the amount of traffic flowing between devices. Relaying is enabled by default and can be disabled or restricted to specific relays.
Syncthing's security page provides a dedicated vulnerability-reporting address (security@syncthing.net) with a security-team PGP key, and documents how to verify PGP-signed release checksums against the release key — a disclosure channel and supply-chain verification procedure, though no bug bounty or independent third-party audit report is published on the page.
Syncthing's GitHub security advisories page lists two published advisories, both rated moderate: a cross-site scripting issue in the web GUI (GHSA-9rp6-23gf-4c3h, June 2023) and a crash from a malformed relay protocol message (GHSA-x462-89pf-6r5h, April 2021) — a public, dated vulnerability disclosure history; no breach or regulatory action involving the project was found in this research.
Syncthing's FAQ explains that outgoing connections to unexpected addresses are most likely to relay servers run by volunteers around the world, that a public list of active relays exists for comparison, and that relays do not and cannot see the data transmitted through them — the client's documented network footprint beyond the user's own devices.
Syncthing's Automatic Crash Reporting documentation states that crash reports are enabled out of the box for most users (disableable in advanced configuration), and that a report contains version information and a technical thread trace but no log data, file names, device IDs, statistics, unique identifier, or other personally identifiable information — the only automatic outbound reporting the client documents beyond opt-in usage reporting.