Obsidian is a note-taking app that keeps every note as an ordinary file on your own computer.

Obsidian's core app never sends your notes anywhere. The only way your data leaves your device is an optional paid feature called Obsidian Sync, used to copy a vault between your own devices. When you set up a synced vault, you choose between two modes.

The two sync modes

The default is end-to-end encryption. Your notes are scrambled into unreadable form on your own device, using a password only you know, before they are sent anywhere.

They can only be unscrambled again on one of your own devices. Obsidian's own help pages state plainly that nobody, including Obsidian's own staff, can decrypt notes protected this way, even if their servers were completely broken into.

The alternative is standard encryption, where Obsidian holds the key that unlocks your data. This is weaker by design, but Obsidian says it can be reasonable for a vault that is already public, such as one published as a website.

With standard encryption, Obsidian could technically be forced to hand over readable notes in response to a legal request. With end-to-end encryption, it could not, because it never has the key.

How the encryption works

Obsidian documents the exact process behind end-to-end encryption. Your password is combined with a random value unique to your vault, called a salt. That combination is run through an algorithm called scrypt, a deliberately slow algorithm that makes passwords hard to guess by brute force, to produce a base key.

The base key then goes through a second step, an algorithm called HKDF, which turns it into the key that scrambles your notes. That final key locks and unlocks your data using AES-256 in Galois/Counter Mode, a widely used encryption standard.

Unusually, Obsidian publishes the exact lines of code for this check. A technically minded user can paste them into their own browser console, pull their vault's salt, capture one of their own sync messages, and decrypt it themselves. Doing so proves Obsidian could not have read it.

The two limits Obsidian discloses

Obsidian also discloses two real limits on this system, rather than hiding them. First, file fingerprints (used to detect duplicate files and avoid re-uploading them) are encrypted in a way that always produces the same result for the same file. Obsidian describes a worst-case scenario where this matters.

The scenario needs two things to go wrong at once. If its servers were compromised, and an attacker could also force a user to upload a specific file, that attacker could learn whether the file matched something uploaded before. They still could not read its contents.

Second, some metadata is readable by Obsidian's servers, because the servers need it to route sync updates and keep version history. This metadata means which device uploaded or deleted a file and when, and which encrypted file path corresponds to which encrypted content. Few companies document their own security trade-offs this openly.

Because plugins can be built by anyone, Obsidian runs a review process before letting them into its official directory, called Obsidian Community. Every plugin version goes through an automated scan, including updates rather than only the first submission. The scan checks it against Obsidian's developer rules, reviews the code for known security problems, and screens for malware.

Obsidian's own team also does manual, human review, focused on plugins that are popular, featured, or flagged by users. Each plugin gets a visible scorecard showing the results of these checks.

What Obsidian says is coming next

Obsidian says it is working toward showing users, before they install a plugin, exactly what that plugin can access, such as the network, the file system, or the clipboard. It also plans a label for verified, trusted developers. Users can report a suspected security issue directly to Obsidian's team at any time.

The core Obsidian app is free forever, for personal use, commercial use, non-profits, schools, and government bodies alike. No account is required to download or use it, and Obsidian says it does not collect personal information from users who don't sign up for a paid extra.

Two paid services

Obsidian sells two optional services instead of charging for the app itself. Both are cheaper per month if you pay for a year up front.

• Sync copies your vault between your own devices using the encryption described above. It costs 4 US dollars per user per month billed annually, or 5 US dollars billed monthly.
• Publish turns chosen notes into a public website, hosted on Obsidian's own servers rather than your device. It costs 8 US dollars per site per month billed annually, or 10 US dollars billed monthly.

Two optional licences that buy no features

Obsidian also sells two licences that exist purely to fund the company. Neither unlocks anything inside the app.

• A Catalyst licence is a one-time payment of 25 US dollars. It works like a tip jar for individual supporters, giving early access to test versions and community badges, but no functional benefit in the app.
• A Commercial licence is 50 US dollars per user per year, letting a company formally support Obsidian's development. Obsidian states this purchase does not unlock any extra features, and there is no minimum number of seats required.

Obsidian was created by Shida Li and Erica Xu, who met while studying at the University of Waterloo. They had previously built an outlining app together called Dynalist. The first beta version was released on March 30, 2020. The app then spent about two and a half years in beta, reaching version 1.0.0 on October 13, 2022. A spatial note-arranging feature called Canvas followed two months later, in December 2022.

Steph Ango joined as CEO on February 6, 2023, after contributing to the 1.0.0 release and being active in Obsidian's user community. He had previously worked at a startup called Lumi before it was acquired in 2021.

It is free, but it is not open source

Obsidian is free to use but proprietary. Its underlying source code is closed, and not published for anyone to inspect or modify. This is a real trade-off worth naming for a product whose main pitch is that you own and control your data. Your notes themselves are open, plain-text files you can read with any tool, but the app that creates and manages them is not open source.