← Back to Directory
Logo: Syncthing

Syncthing

Swedish open-source continuous file sync: encrypted peer-to-peer folders between your devices, with no mandatory central cloud store for file contents.

Open sourceSelf-hosted
open-sourceprivacyself-hostedfile-syncp2pmpldecentralized
Visit WebsiteAsk an EU migration specialistFeedback & corrections

Syncthing is a continuous file synchronization program: create, change, or delete a file on one machine and peers that share the same folder replicate that state when they are online. It is stewarded by the Syncthing Foundation, a Swedish non-profit whose purpose is to maintain the free software and its required infrastructure.

It exists as an alternative to Dropbox-style SaaS. Folder contents are not uploaded to a vendor-operated multi-tenant cloud. Official copy emphasizes that your data stays on computers you control, and there is no central server that holds the file payload.

The concrete differentiator is Device ID peering: devices identify each other from TLS certificates and you approve remote IDs explicitly. The software is MPL-2.0 open source. There is no official first-party iOS client.

Open source (MPL-2.0)Peer-to-peer syncNo central file storeSelf-operated clientsSwedish foundationTLS device IDs

Shortlist Syncthing when you need open-source, encrypted continuous folder sync between devices you approve—without a mandatory vendor cloud for file contents. Skip when you need guest share links, IdP-driven Hub collaboration, or zero-ops SaaS HA: prefer Nextcloud/Seafile or Dropbox/Google Drive/OneDrive depending on residency and ops appetite.

Key capabilities

Syncthing keeps shared folders in sync whenever peers are online, exchanging file contents directly between machines you configure. The project states none of your data is stored anywhere other than on your computers—there is no mandatory Syncthing cloud tenancy for file bytes. Limit: availability requires at least one peer online with the data; many operators add a always-on NAS or VPS as a third peer.

Each device generates a certificate; the SHA-256 fingerprint is the Device ID. Connections use TLS (docs: TLS 1.2/1.3 in security notes; BEP requires TLS 1.3+). Both sides must add each other's ID before any folder sharing—stolen IDs alone do not grant access. Limit: protect config and key material on disk; lost devices must be revoked from other peers.

Standard send-receive folders bidirectionally sync changes. Send-only hosts publish a reference tree and can override the cluster; receive-only nodes accept remote changes and can revert local edits—useful for backup mirrors and distribution points. Protocol also defines receive-encrypted folders for untrusted storage peers. Limit: not a multi-tenant share-link server; guest upload portals belong to products like Nextcloud.

Files are split into hashed blocks (Block Exchange Protocol). Renames and metadata updates avoid full retransfers; additional online devices can supply blocks in parallel similar to torrent-style fan-out. Limit: first full hash scan of large trees is CPU-heavy; relayed connections are much slower than direct LAN/WAN paths.

Optional versioning (trash can, simple keep-N, staggered age tiers, or external command) archives replaced/deleted versions received from the cluster under .stversions or a custom path. Helps recover from remote mistakes. Limit: local edits on the same device are not versioned by Syncthing—pair with real backup tools for disaster recovery.

Default global discovery and public relays help NAT traversal but are optional: you can disable them, pin private relays, or run strelaysrv/stdiscosrv yourself. Admin GUI defaults to localhost:8384; REST API supports automation. Cross-platform binaries cover major desktop/server OSes plus Android; iOS is community/commercial only.

At a glance

Steward
Syncthing Foundation (Swedish non-profit)
License
MPL-2.0
Architecture
Peer-to-peer continuous file sync (BEP over TLS)
File storage
On your devices only (no vendor content cloud)
Commercial model
Free software; optional third-party support (e.g. Kastelo)
iOS
No official client; community/commercial wrappers

Best fit when

  • Teams and individuals who must keep folder replicas only on devices/infrastructure they control
  • Homelab and privacy-focused multi-device setups (laptop + phone + NAS) without a consumer cloud account
  • Branch or field scenarios that accept mutual Device ID trust instead of SaaS share links
  • Operators willing to run an always-on peer (NAS/VPS) for availability while keeping pure P2P semantics
  • Buyers shortlisting open protocols (documented BEP) and inspectable MPL-2.0 code over proprietary P2P

Poor fit when

  • Need for browser guest uploads, public share links, or enterprise IdP policy on a central app server
  • Expectation of vendor-operated multi-region HA and a contractual SaaS DPA for file storage
  • Non-technical orgs unwilling to manage pairing, firewalls, versioning, and peer online windows
  • Primary backup/disaster-recovery requirement without a separate backup product (Syncthing propagates deletes)
  • First-party official iOS as a hard requirement (community/commercial wrappers only)

Consider instead when

  • When: You need a self-hosted collaboration Hub with shares, Talk, office, and IdP

    Consider: Nextcloud

    Different architecture—central server and Hub apps vs pure P2P folders.

  • When: You want library-oriented server sync with a classic file-server control plane

    Consider: Seafile

    Server-centric libraries rather than equal peers.

  • When: You need zero-ops global SaaS file sync with vendor-run tenancy

    Consider: Dropbox, Google Drive, or OneDrive

    Simpler onboarding; files live in a US-group cloud tenancy.

Jurisdiction & ownership

Legal entity
Syncthing Foundation (registered Swedish non-profit foundation)
Governing law
Sweden (foundation); operator law for device-held data
US parent / control
No known US parent
CLOUD Act exposure (indicative)
Low
Hosting / residency
No Syncthing multi-tenant file hosting: contents stay on user-operated devices. Optional default global discovery (documented as hosted by @calmh) maps Device ID to IP/port. Public relays are volunteer-run and retransmit ciphertext only. Automatic upgrades may download release artifacts from GitHub. Operators can disable discovery/relaying, pin private relays, or self-host discovery/relay daemons.

Indicative only, not legal advice. Vendor-as-file-host CLOUD Act exposure is low because there is no central content tenancy. Residual metadata visibility on public discovery/relays and upgrade fetches via GitHub are why the checklist row is partial, not a clean bill. Hosting a peer on AWS/GCP/Azure is an infrastructure choice separate from the Foundation.

  • Independent security / no-logs auditNot applicable
  • ISO 27001Not found
  • SOC 2 / SOC 3Not found
  • GDPR / EU data protectionPartial
  • +3

Considerations & known limitations

  • HighDeletes and mistakes replicate to peers

    Syncthing is continuous sync, not backup. Without versioning and separate backups, a bad delete or ransomware-encrypted tree can fan out. Project FAQ explicitly discourages treating it as a sole backup tool.

  • MediumOperator owns connectivity and pairing

    Mutual Device ID setup, firewall/UPnP, and avoiding slow relay paths require basic ops skill. Non-technical orgs may prefer managed SaaS.

  • MediumDefault discovery/relays see metadata

    Public discovery maps IDs to IPs; volunteer relays see IDs, IPs, and traffic volume (not plaintext). Disable or self-host when metadata exposure is in scope.

  • MediumDevice keys equal device identity

    Anyone with config and TLS keys can impersonate a device. Encrypt disks, revoke lost peers, and restrict GUI bind addresses with auth.

  • LowNo official iOS client

    iOS support depends on community (e.g. Sushitrain) or commercial wrappers (e.g. Mobius Sync) with platform background limits.

Open questions for due diligence

  • Will production peers use default public discovery/relays, private infrastructure, or static addresses only?
  • Which always-on peer (if any) provides availability, and what hoster/jurisdiction is that machine in?
  • Is file versioning plus a separate backup product defined for delete/ransomware scenarios?
  • Do any regulated workflows require an independent code/crypto review of the exact release you will pin?
  • Is official mobile platform coverage (especially iOS) a hard procurement constraint?
Request vendor DPA / enterprise contact
Ask an EU migration specialist
Visit WebsiteCompare similar toolsView alternativesFeedback & corrections

Frequently Asked Questions

No. Official materials state file data lives on your devices and is exchanged peer-to-peer when those devices are online together. There is no Syncthing multi-tenant storage account for folder contents. Optional global discovery servers only map device IDs to addresses; relays retransmit already-encrypted traffic if direct connect fails. You can disable discovery/relaying or run private infrastructure.

Devices authenticate with TLS certificates. The Device ID is a human-friendly encoding of the certificate fingerprint. Documentation states IDs need not be secret—knowing an ID may help locate an IP via global discovery, but both sides must explicitly add each other before a sync connection is accepted. Protect the on-disk config and key files; revoke lost devices.

Choose Syncthing for decentralized continuous folder mirrors with mutual device trust and no mandatory application server or web share UX. Choose Nextcloud when you need a central Hub (shares, Talk, groupware, office, IdP policies). Choose Seafile for library-oriented server sync with a classic file-server shape. They solve adjacent problems; many orgs run Syncthing for specific high-control folders beside a Hub.

Project FAQ: no—it is not an ideal backup application because deletes and corruptions can propagate to every peer. File versioning helps against some remote mistakes, but you should still use purpose-built backup (snapshots, offline media, immutable object storage). Common pattern: Syncthing for live multi-device working copies + separate backup of a receive-only or NAS peer.

With defaults, clients announce to global discovery (currently documented as hosted by @calmh) and may use public volunteer relays when NAT blocks direct paths. Relays cannot read file plaintext but learn device IDs, IPs, and rough traffic volume. Automatic upgrades fetch release artifacts via GitHub. Hardened deployments disable unused services, force direct addresses, self-host discovery/relays, and control upgrade channels via packages.

Core Syncthing is free MPL-2.0 open-source software with no seat license for sync itself. The Syncthing Foundation (Swedish non-profit) funds project infrastructure. Third parties such as Kastelo offer commercial support/sponsorship; community and commercial iOS wrappers exist separately. Confirm support contracts on those vendors' sites—no retail plan table is part of the core project.