Sync
OpenSync is a sync engine and the relay it talks to. Files are chunked and sealed on your device before anything leaves it, so the relay stores ciphertext it has no key for — and it is one small binary, which is why you can just run your own instead.
wss://relay.opensync.network
Paste this into any OpenSync app's relay setting. Blobs are served from the same host, so it is one URL rather than two.
{
"kind": 30078,
"pubkey": "9f8613b5ea74e070015860538b3fde38…",
"tags": [["d", "vault"]],
"content": "AtdVnQ7yK1pR8cFmW0hLxNqZsJvB4eGdTiYoUaXk…"
}That content is the whole of what the server has. The filename, the folder it sits in, its size before compression and which blobs belong to it are all inside it, sealed under a key this machine has never seen.
Features
Not the encryption itself — that part is settled. The parts that break a sync product are the second device, the lost device, and the two devices that edited the same file.
Content is chunked, then each chunk is sealed with XChaCha20-Poly1305 under a key derived on the device. Blobs are addressed by the hash of their ciphertext and verified against a hash of their plaintext — two different hashes, so no account can confirm what another account is storing.
A second device joins with a ten-character code over a PAKE, not a pasted key. One code, one attempt — the granting state is consumed whether the guess was right or wrong, so thirty bits stand against a single online guess rather than against a dictionary.
A recovery kit on paper, whose two keys carry bech32 checksums and are bound together by a fingerprint — because a checksum catches a typo but not two correctly typed keys from different printouts.
Two devices editing one file gives you the newer version and a conflict copy beside it — named after the device whose version is inside it, which is the only name that tells you which one to open. Nothing is discarded quietly.
Deletion on any relay is advisory — you are asking. Re-sealing the whole namespace under a new key is the only removal that does not depend on the server's goodwill, and the new key is published nowhere, because the device you are rotating away from is holding the old one.
The relay is a single executable over SQLite: a data directory, a database file, a TOML. If you would rather not trust this one, the escape hatch is a ten-minute install rather than a migration project.
How it works
Everything that decides what your data is happens on your device. The relay's entire job is to hold bytes and hand them back in the right order.
01
An account is a keypair, generated locally. No email, no password, nothing to reset — and nothing a server could hand to anyone who asked for it.
02
Content is split, each chunk sealed under a derived key, and a manifest describing the whole set is sealed too. Identical content deduplicates because the nonces are derived rather than random.
03
About 250 bytes saying where the current manifest is, plus the blobs themselves. Ordering comes from a counter the devices keep, never from a timestamp — a clock is client-set and can lie.
04
It fetches the pointer, decrypts the manifest, and pulls only the chunks it does not already hold. Everything it learns, it learns by decrypting.
Download
They share an account, a relay and an encryption model, so a second one is a checkbox rather than a second signup, a second bill and a second thing to trust.
Copy on the Mac, paste on the phone. A menu-bar app, a ⌘⇧V history panel, a CLI and a web page, all on one history that folds to a union rather than a winner — an append-only log is the one thing last-writer-wins gets wrong.
macOS · command line · browser
A community plugin that syncs a vault — notes, attachments and folder structure — without the vault's contents or its filenames ever reaching the server in the clear.
Obsidian on desktop and mobile
A browser extension whose vault lives in the service worker, so a badge can appear in a login field with no window open. Autofill is gesture-gated: a click or a shortcut, and nothing at all between page load and a filled field.
Chrome · Edge · browser
An Android keyboard carrying the clipboard inside it — because since Android 10 the active input method is the only thing permitted to read the clipboard in the background. A keyboard is not a feature here, it is the permission.
Android 10 and later
Privacy
Not a policy — a list. If something is not on the left-hand column it is not on the server, and the reason is structural rather than promised.
| The relay holds | Why, or why not |
|---|---|
| Ciphertext, and how many bytes of it | It has to store something and bill something. Bytes are the only thing it can count. |
| A public key per account | It is how a write is checked against an account. It is not linked to a name, an email or a payment. |
| When each blob arrived | A consequence of storing it. Expiry sweeps need it. |
| Filenames and folder structure | They live inside the sealed manifest. The server sees one opaque blob, not a tree. |
| File contents | Sealed on the device. The key is never sent, in any form, at any point. |
| Which blobs belong to which file | That mapping is the manifest, and the manifest is sealed too. |
| An email address or a password | There is no login. An account is a keypair your device made. |
| Analytics, trackers, or a third-party script | This page loads its fonts and its stylesheet from this domain and nothing else from anywhere. |
The honest limit: a relay can always see that an account is active and roughly how much it stores. Traffic analysis is not solved by encryption, and nobody should tell you otherwise. Running the relay yourself is the answer to that one, which is why it is one binary.
Pricing
A 504-note vault is 4.7 MB. One phone photo is bigger than a year of writing, so the split is by what a thing is rather than by a quota you can cross without noticing — and the paid side has no price yet, because an app that lists a plan nobody can buy has already promised something.
Free
Attachments — images, PDFs, audio, video — are the paid part here, and there is nothing to buy yet, so today they stay on the device they came from. Nothing is ever deleted for being on the wrong side of that line.
Nothing to sign up for and nobody to ask. Open any OpenSync app, let it make an account, and it syncs — the relay has never heard of you and serves you anyway.
Point an app at itFree, unmetered
The apps do not know or care which relay they are pointed at, and the encryption is identical either way. If you are going to end up here eventually, start here.
Run your own OpenSync relayFAQ
Ciphertext, its size, and when it arrived. Filenames, folder structure and file contents are inside the sealed manifest, so the relay cannot enumerate them. It never receives a key.
Text is free and unlimited — notes, clipboard, credentials, settings. Attachments are the paid part on this relay: images, PDFs and audio are three orders of magnitude bigger than text and are the only part that costs real storage. A relay you run yourself is not metered at all, because what is being sold is running the server rather than the feature. There is no subscription, and no price yet — when there is one it will be written here before it is charged anywhere.
There is no password, no email login and no signup. An account is a keypair your first device generates, and this relay serves it the moment it exists — there is nothing to register and nobody to ask.
The size of what an unknown account may keep. A signed request only proves somebody controls a keypair, and a keypair is free to generate — so an account nobody has granted anything to gets 100 MB, which is roomy for every note, password and clipboard you will ever write and uninteresting to anyone looking for somewhere to put films. Bounding the cost rather than the guest list is what makes a gate unnecessary instead of merely absent.
The recovery kit is the last copy of an account, and it is printed rather than stored. Without it, and without a paired device, the data is gone — the relay is holding ciphertext it has no key for. That is the cost of the server not being able to read your files, and it is not a cost we can remove without removing the property.
With a ten-character code shown on the first device, exchanged over SPAKE2. One code, one attempt: the granting state is consumed whether the guess was right or wrong, so thirty bits stand against a single online guess rather than against a dictionary. No key is ever typed twice, and nothing sensitive is ever in a clipboard.
The newer version wins and the older one is kept beside it as a conflict copy, named after the device whose version is inside it. Nothing is discarded silently. The clipboard is the deliberate exception: an append-only history folds to a union, because last-writer-wins on a log means a freshly paired device publishes an empty history and wins.
Yes, and the design assumes you might. The relay holds no key and no plaintext, so moving is a matter of pointing the same account at a different URL and letting it upload. Nothing has to be exported, because nothing was ever in a format only we can read.
It speaks a small part of the Nostr protocol — enough that ordinary tools can talk to it — but it is not a public relay and will refuse most kinds of event outright. Nostr is used here as a wire format on our own server, not as free infrastructure belonging to somebody else.