Is Obsidian Sync End-to-End Encrypted? What It Actually Protects (2026)

You have a vault full of notes: meeting minutes, half-finished ideas, client details, maybe a few passwords you swore you would move to a manager later. You want them on your laptop, your phone, and your desktop, all in sync. And you want to know one thing before you turn sync on: if someone breaks into the sync provider, can they read your notes?

That is the real question behind "is Obsidian Sync end-to-end encrypted?" It is not academic. It decides whether a server breach leaks your readable life or leaks unreadable noise. Here is the honest answer, what it covers, and, just as important, what it does not cover.

Quick Answer

Yes. Obsidian Sync, the official paid sync service from the makers of Obsidian, is end-to-end encrypted. You set a separate encryption password, your notes are encrypted on your device before they leave it, and Obsidian's servers store ciphertext they say they cannot read. That is a genuine end-to-end design and a good one. The important caveat: this protects your notes only while they travel and while they sit on Obsidian's servers. The Markdown files inside your vault on your own disk stay in plain text, unencrypted. And if you sync with iCloud, Dropbox, or Google Drive instead of Obsidian Sync, none of that end-to-end encryption applies. So Obsidian Sync encrypts the pipe, not the vault.

Why this question matters for a knowledge worker

If you live in Obsidian, your vault is not a toy. It is often the single densest record of how you think and what you are working on. For a consultant it holds client notes. For a researcher it holds unpublished work. For a founder it holds strategy and numbers. For a lot of people it quietly holds credentials, health details, and personal things that were never meant for anyone else.

The threat you are actually worried about is not usually a hacker at your keyboard. It is the boring, common one: a company that stores your data gets breached, and a dump of readable documents ends up somewhere it should not. End-to-end encryption is the specific defense against that scenario. When it is real, a breach of the server leaks ciphertext, and ciphertext is useless without your key. When it is missing, a breach leaks your actual sentences.

So "is it end-to-end encrypted?" is really "if my sync provider is breached tomorrow, do they leak my notes or gibberish?" For Obsidian Sync, the answer is gibberish. That is the good news. The nuance is where.

What Obsidian Sync actually encrypts

Obsidian Sync is a subscription add-on, separate from the free Obsidian app. When you enable it, you create a remote vault and, crucially, you can set an encryption password that is different from your account password. Your notes are encrypted on your device with a key derived from that password before they are uploaded. Obsidian's documentation describes this as end-to-end encryption and states that they cannot read your notes or recover them if you lose the password. That last part, no recovery, is the honest tell of a real end-to-end system: if the provider genuinely cannot read your data, they also cannot reset your lost password for you.

Under the hood this is the same family of building blocks any serious encrypted app uses: a strong symmetric cipher for the content and a password-derived key so the server never holds the key in the clear. If you want the plain-language version of what that cipher name means, see our explainer on what AES-256-GCM is and why it matters for notes apps. And if the terms "end-to-end" and "zero-knowledge" blur together for you, they are related but not identical, which we break down in end-to-end vs zero-knowledge encryption.

So far, so good. If you pay for Obsidian Sync and set an encryption password, your notes in transit and at rest on Obsidian's infrastructure are protected by end-to-end encryption. For the specific fear of "the sync company gets hacked," you are covered.

What Obsidian Sync does not encrypt

Here is where honesty matters more than marketing.

Your local vault is plain text. Obsidian stores your notes as ordinary Markdown files in a normal folder on your disk. Anyone or anything with access to that folder, another app, a backup tool, malware, a coworker on a shared machine, someone who picks up your unlocked laptop, can open those files in any text editor and read every word. Obsidian has no native at-rest encryption for the vault itself. Sync encryption does not change what sits on your own drive.

Third-party sync is not covered at all. Many Obsidian users never pay for Obsidian Sync. They put the vault in an iCloud, Dropbox, OneDrive, or Google Drive folder and let that service sync it. In that setup, Obsidian's end-to-end encryption is simply not in play. Your notes are readable Markdown files sitting in a consumer cloud that holds the keys and, depending on the provider and jurisdiction, can scan or hand them over. This is a completely different privacy posture, and it is easy to end up there without realizing it.

Attachments and file structure. Vaults are not just text. They hold PDFs, images, and other attachments. Your local copies of those are unencrypted too. End-to-end sync protects them in transit and on the server, but on your machine they are as exposed as the notes.

The distinction that trips people up is the difference between encrypted in transit, end-to-end, and encrypted at rest on your own device. They protect against different things, and having one does not give you the others. We laid out the concrete differences in zero-knowledge vs end-to-end vs encrypted at rest, which is worth ten minutes if you care about this.

Obsidian Sync at a glance

Question	Obsidian Sync (official)	Third-party sync (iCloud, Dropbox, etc.)
End-to-end encrypted in transit and on server?	Yes, with an encryption password	No, the provider can read the files
Notes encrypted at rest on your own disk?	No, plain-text Markdown	No, plain-text Markdown
Can the provider read your notes?	No (they state they cannot)	Yes, generally
Recovery if you lose the encryption password?	No, by design	Not applicable
Cost	Paid subscription	Free with your existing cloud

The pattern is clear. Obsidian Sync gives you real end-to-end protection for the network and the server, and nothing for the copy on your machine. That is not a flaw exactly, it is a design choice: Obsidian keeps the local vault as open plain files so its huge plugin ecosystem and your other tools can touch them. But you should know it is the trade you are making.

What this means for you in practice

If you use Obsidian and care about privacy, here is a concrete, honest checklist.

If you use official Obsidian Sync, set an encryption password. This is what makes it end-to-end. Do not rely on the account password alone. Store the encryption password somewhere safe, because no one can recover it for you.
Know which sync you are actually using. If your vault lives in an iCloud or Dropbox folder, you do not have end-to-end encryption on those notes, full stop. Decide if that is acceptable for what your vault holds.
Protect the local copy separately. Because the vault on disk is plain text, add a layer there. Full-disk encryption (FileVault on macOS, BitLocker on Windows, LUKS on Linux) protects the files when the machine is powered off or stolen. It does not protect them while you are logged in and another app is running, but it closes the stolen-laptop gap. Our practical guide to encrypting your notes walks through the threat models so you can match the tool to the risk.
Do not store true secrets in plain-text notes. Passwords, recovery codes, and keys belong in a dedicated password manager with its own encryption, not in an unencrypted Markdown file, no matter how good your sync is.
Back up in a way that stays private. A backup of a plain-text vault is a plain-text vault in a second place. If you copy it to another cloud, you have doubled your exposure. Use encrypted archives or zero-knowledge backup, as we describe in backing up encrypted notes without breaking zero-knowledge.

Done honestly, Obsidian plus its official sync plus full-disk encryption is a reasonable setup for many people. The gap that remains is the one full-disk encryption cannot close: while you are working, your notes are readable plain files on a running system, and any app or process with access can read them.

Where Filarr fits, honestly

We build Filarr, so treat this section with the skepticism it deserves. Filarr takes the opposite default from Obsidian: instead of plain files on disk with encryption bolted on for sync, every file is encrypted on your disk from the start. Each file gets its own key (a file encryption key wrapped by a key derived from your password), using AES-256-GCM, with PBKDF2-SHA512 at 600,000 iterations for the key derivation (Argon2id is available too). Cloud sync exists but is optional, and when you use it the server only ever sees opaque encrypted blobs, the same zero-knowledge posture Obsidian Sync targets, described in how our optional cloud sync stays zero-knowledge.

What that buys you is the piece Obsidian leaves open: the copy on your own machine is encrypted at rest, not just plain Markdown waiting to be read. Filarr also keeps notes, arbitrary files, and a graph that links them in one app, which Obsidian does with notes and plugins.

What Filarr does not do, and where Obsidian is stronger: Obsidian has a far larger plugin ecosystem, a bigger and older community, and years more maturity. Filarr is younger, our mobile app is still in progress, and if your workflow depends on a specific Obsidian plugin, we may simply not have an equivalent. Encryption at rest is also not magic. If malware is running as you while you are unlocked, no notes app fully saves you, and Filarr is not a substitute for a password manager or for basic device hygiene. If you want the side-by-side without the sales gloss, we wrote Obsidian vs Filarr, encrypted notes head to head, and a broader survey in the best encrypted note-taking apps in 2026.

The honest summary: if you love Obsidian, keep it, turn on Sync with an encryption password, and add full-disk encryption. If your main worry is that the plain-text copy on your own disk is exposed and you want encryption to be the default rather than an add-on, that is the specific problem Filarr was built for.

FAQ

Is Obsidian Sync really end-to-end encrypted, or is that marketing? It is genuinely end-to-end. Obsidian states they cannot read your notes and cannot recover your encryption password if you lose it, which is the honest signature of a real end-to-end system. The limit is scope: it protects data in transit and on their servers, not the plain-text copy on your own disk.

Are my Obsidian notes encrypted on my computer? No. By default Obsidian stores your vault as ordinary Markdown files that any text editor can open. Sync encryption does not change this. To protect the local copy, use full-disk encryption or an app that encrypts files at rest.

What if I sync my vault with iCloud or Dropbox instead of Obsidian Sync? Then you have no Obsidian end-to-end encryption on those notes at all. They are plain files in a cloud that holds the keys and can generally read them. That is a very different privacy posture from paying for Obsidian Sync with an encryption password.

Can Obsidian recover my notes if I forget the encryption password? No, and that is intentional. Because the encryption is end-to-end, they never hold your key, so they cannot decrypt or reset it. Save the encryption password somewhere durable and separate from your account password.

Is full-disk encryption enough for my Obsidian vault? It closes the stolen or powered-off laptop gap, which is worth doing. It does not protect the files while you are logged in, since they are decrypted and readable to any running app. For at-rest protection during normal use, you need an app that encrypts each file, not just the disk volume.

This article is general information, not legal or security advice for your specific situation. Verify current Obsidian Sync details on Obsidian's own documentation, since services change.