Syncthing keeps folders identical across two or more devices. Install it on each one, exchange device IDs, share a folder, and every change on one side appears on the others, continuously and in the background. There is no central copy: files go straight between your devices over TLS, so it works like Dropbox without anyone else holding your data.
It has been around since 2013 and the project's stated goals put not losing data first and security second, which shows in how conservative it is. You get file versioning, ignore patterns, send-only and receive-only folders, and a web interface on localhost:8384 for everything. It runs on Windows, macOS, Linux, BSD and Android (through community apps), and it handles very large folders well.
About 89,800 stars and 398 contributors, MPL-2.0, written in Go, at v2.1.7 when scanned. The honest limits: there is no web access to your files from a browser elsewhere, and two devices only sync when both are online at the same time, so a small always-on machine helps.
- Repository: github.com/syncthing/syncthing
- Licence: MPL-2.0 (Mozilla Public License 2.0)
- Language: Go. Stars: 89.8K. Forks: 5,542. Last push: Oct 26, 2026.
- Scan: safe, Oct 26, 2026, commit 70b5bc7
Who it is for
People who want their documents, photos or notes on every device without paying for or trusting a cloud service, and anyone who needs to keep a folder in step between a laptop, a desktop and a home server.
Getting started
1. macOS or Linux (Homebrew)
brew install syncthing2. Start it as a background service
brew services start syncthing3. Run it with Docker instead
docker run -p 8384:8384 -p 22000:22000/tcp -p 22000:22000/udp -v /wherever/st-sync:/var/syncthing syncthing/syncthingThen open http://127.0.0.1:8384 to add devices and folders. Windows and macOS users who want a tray app can use one of the community wrappers listed in the docs; Debian and Ubuntu users can add the project's own apt repository.
Safety scan
We cloned syncthing/syncthing at commit 70b5bc7 on Oct 26, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- The one secret hit is a test key in lib/signature/signature_test.go, used to check release-signature verification. No suspicious code patterns, no committed binaries; the bare-IP URLs are in tests and use documentation addresses such as 192.0.2.42.
- The Syncthing hosts in the code are its own infrastructure: global discovery and relays.syncthing.net help devices find each other across networks, upgrades.syncthing.net serves signed updates, and crash.syncthing.net receives crash reports. Relayed traffic stays end-to-end encrypted, and each service can be disabled in Settings.
- 3 known advisories, all unrated: two in the AWS SDK's S3 encryption client and one flagging the deprecated openpgp package in golang.org/x/crypto. None is high or critical.
- 8 workflows, all 22 third-party actions pinned to commits. One uses pull_request_target (pr-metadata.yaml), but only to label pull requests with a pinned action and read-only contents permission; it does not check out the contributor's code.
- Security policy, contributing guide and Dependabot present. Release binaries are GPG-signed and the built-in updater checks an ECDSA signature. OpenSSF Scorecard 5.8.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | 1 candidate found and read; see the notes above. |
| Suspicious code | None found. |
| Install-time code | None: nothing runs at install beyond the package manager itself. |
| Committed binaries | None. |
| CI workflows | 8 workflows. 1 uses pull_request_target, none check out the pull request head. 0 of 22 third-party actions pinned to a tag rather than a commit. |
| Network hosts | 40 distinct hosts referenced from source; most often mozilla.org, github.com, relays.syncthing.net, docs.microsoft.com. 5 URLs to a bare IP address, listed under the raw findings. |
| Known vulnerabilities | 3 advisories across 97 pinned packages: 0 critical, 0 high, 0 moderate, 0 low, 3 unrated. go.mod: 97 packages, 3 advisories. |
| Project hygiene | Has security policy, automated dependency updates, licence file, contributing guide. Missing CodeQL. |
| OpenSSF Scorecard | 5.8 out of 10, as of Oct 19, 2026. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
Secret candidates (1, redacted)
| Where | Rule | Match |
|---|---|---|
| lib/signature/signature_test.go:18 | private-key | -----B…--- (30 chars) |
URLs to bare IP addresses (5)
| Where | Rule | Match |
|---|---|---|
| lib/config/config_test.go:767 | ip-literal-url | {"192.0.2.42:8080", "http://192.0.2.42:8080/"}, |
| lib/connections/connections_test.go:161 | ip-literal-url | {mustParseURI("http://1.2.3.4:5678"), false, false, false}, // generally bad |
| lib/discover/global_test.go:62 | ip-literal-url | if _, err := NewGlobal("http://192.0.2.42/", tls.Certificate{}, nil, events.NoopLogger, registry); err == nil { |
| lib/discover/global_test.go:66 | ip-literal-url | if _, err := NewGlobal("http://192.0.2.42/?insecure", tls.Certificate{}, nil, events.NoopLogger, registry); err == nil { |
| lib/discover/global_test.go:70 | ip-literal-url | if _, err := NewGlobal("http://192.0.2.42/?noannounce", tls.Certificate{}, nil, events.NoopLogger, registry); err == nil { |
Worst known vulnerabilities (3 of 3)
| Advisory | Severity | Package | Summary |
|---|---|---|---|
| GHSA-7f33-f4f5-xwgw | unknown | github.com/aws/aws-sdk-go@1.55.8 | In-band key negotiation issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go |
| GHSA-f5pg-7wfw-84q9 | unknown | github.com/aws/aws-sdk-go@1.55.8 | CBC padding oracle issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go |
| GO-2026-5932 | unknown | golang.org/x/crypto@0.57.0 | The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues |
Workflows worth a look
- .github/workflows/pr-metadata.yaml: pull_request_target
By the numbers
| Stars | 89.8K |
|---|---|
| Forks | 5,542 |
| Contributors | 398 |
| Commits | 8,220 |
| Open issues | 374 |
| Open pull requests | 17 |
| Releases | 490 |
| Latest release | v2.1.7 |
| Licence | MPL-2.0 |
| Main language | Go |
| Project age | 12 years |
| Last push | Oct 26, 2026 |
| Tracked files | 945 |
| Lines of code | 164.2K |
| Checkout size | 14 MB |
Lines by language: Go 121.3K, JSON 26.7K, JavaScript 4,951, HTML 3,897, YAML 2,056, Shell 1,991.
Questions
Is Syncthing free?
Yes. Syncthing is free and open source under MPL-2.0, with no paid tier, no account and no storage limit beyond your own disks.
Is Syncthing a backup?
Not on its own. It mirrors changes, so a deleted or overwritten file is deleted or overwritten everywhere. Turn on file versioning for a safety net, and keep a real backup of anything important.
Can Syncthing sync over the internet?
Yes. Devices on different networks find each other through global discovery and connect directly, falling back to an encrypted relay when a direct connection is not possible. Your data is never stored on those servers.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.