2026-05-14 Obsidian Sync Passes Cure53 and Trail of Bits Audits
Canonical version: 2026-05-14 Obsidian Sync Passes Cure53 and Trail of Bits Audits.
The Obsidian team just published the results of two independent security audits of Obsidian Sync; one by Cure53 (Berlin, October 2024) and one by Trail of Bits (New York, December 2025). Both cover the Sync API, server, and cryptography. All findings have been addressed via remediations validated by the auditors themselves.
This is the third batch of audits Obsidian has shared publicly, after the desktop and mobile client audits in January 2024 and December 2024.
What the Auditors Looked At
The two audits target the Sync service itself: API endpoints, server behavior, key management, and the encryption upgrade shipped on August 22, 2025 alongside Obsidian 1.9.11.
Cure53 flagged four low-priority issues and one medium-priority issue. Trail of Bits found eleven. Obsidian fixed the issues that needed fixing and documented the rest as trade-offs.
Documented Trade-Offs
Two findings from Trail of Bits won't be "fixed" because they're intentional. Obsidian is now explicit about them on their Sync security page:
- Deterministic file-hash encryption. The same file content + same key + same salt produces the same encrypted hash. This is how Sync detects duplicates and avoids re-uploading identical data; it matters for version history and large files. The trade-off is that a compromised server with the ability to force you to upload chosen files could test whether one of your files matches.
- Path-to-content mapping is server-readable. Some metadata is not end-to-end encrypted; who uploaded a file, when, and how encrypted paths map to encrypted content. The server needs this to route changes and keep devices in sync. A compromised server could swap the mapping, but it still couldn't read the underlying content.
I appreciate that Obsidian writes these down clearly instead of glossing over them. Any real-world sync product has to balance confidentiality against performance, storage, and cost.
"Managed Encryption" Is Now "Standard Encryption"
Following a Cure53 finding, the old "managed encryption" mode (server-managed keys instead of end-to-end) was renamed to "standard encryption", and the docs were rewritten to spell out the risk of not picking the default end-to-end option. That naming was misleading; the new wording is much clearer.
If you're on Sync, it's worth a 30-second check that your vault is using end-to-end encryption rather than the standard mode.
My Take
I run Obsidian Sync on multiple devices for my main vault, so these audits concern me directly.
Obsidian paid two well-known security firms to audit Sync. Both reports are out in public, with everything Cure53 and Trail of Bits found. The bugs that needed fixing got fixed. The handful of things they decided NOT to "fix" (because they're real trade-offs for performance and storage) are documented openly on the security page so you can decide for yourself whether you're OK with them.
I expect a company that stores my private notes to publish full audit reports like these.
The Cure53 report notes:
It is imperative to acknowledge the swift actions taken by the Obsidian team in working on addressing several of these identified vulnerabilities shortly after the conclusion of the audit.
References
- Announcement — Obsidian Sync audited by Cure53 and Trail of Bits
- Obsidian Security page
- Cure53 audit — summary and full report
- Trail of Bits audit — full report
- Sync security page (limitations + standard encryption risks)
- Verify Obsidian Sync's end-to-end encryption
Related
About Sébastien
Ready to get to the next level?
Found this valuable? Share it with someone who needs it.