Peer-to-Peer File Sync Security

Syncthing Security Testing: Admin UI, API Key, Device Trust Model, Relay Server, and Discovery

📅 July 3, 2026 ⏱ 12 min read 🏷 Syncthing, File Sync Security, Admin UI Security, Device Trust, Relay Server Security

Syncthing is a widely deployed open-source peer-to-peer file synchronization tool used in home labs, small businesses, and privacy-conscious environments as an alternative to cloud file sync services. Its security model is distinct from traditional client-server tools: Syncthing's web GUI defaults to listening on 127.0.0.1:8384 but is commonly reconfigured to 0.0.0.0:8384 for remote management — when no GUI authentication is configured, this exposes a full file system management interface to the local network without TLS; Syncthing's REST API uses an API key stored in config.xml that provides programmatic access to add/remove sync folders, devices, and configuration — the API key is readable from the configuration file by any process with filesystem access; Syncthing's device trust model relies on device IDs derived from TLS certificates — the security of the sync relationship depends entirely on correctly verifying device IDs during the pairing process; Syncthing's global discovery server can be queried to determine whether a specific device ID is currently online; and relay servers route encrypted traffic between devices that cannot directly connect, with relay operators able to observe connection metadata including device IDs, connection timing, and data volumes. This guide covers systematic Syncthing security assessment.

Admin GUI Network Exposure
API Key Extraction
Device Discovery Testing
Device Trust Model Testing
Syncthing Security Hardening

Admin GUI Network Exposure

# Syncthing GUI at port 8384 — check if accessible on network interfaces
# Default: 127.0.0.1:8384 (localhost only)
# Common misconfiguration: 0.0.0.0:8384 (all interfaces)

SYNCTHING_HOST="syncthing.example.com"  # Or try LAN scan for :8384

# Check if GUI is accessible without authentication
GUI_STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
  "http://${SYNCTHING_HOST}:8384/" 2>/dev/null)
echo "GUI HTTP status: ${GUI_STATUS}"
# 200 = accessible; check if auth is required or bypassed

# Probe REST API without API key (returns 403 if auth configured, 200 if not)
API_STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
  "http://${SYNCTHING_HOST}:8384/rest/system/status" 2>/dev/null)
echo "API without key: ${API_STATUS}"
# 403 = auth required (good); 200 = no auth on API (bad)

# Check for Syncthing sync protocol port (typically 22000)
# TCP/22000 and UDP/22000 (QUIC) are the sync ports — scan these in addition to :8384
nmap -p 8384,22000 "${SYNCTHING_HOST}" 2>/dev/null | grep -E "(open|filtered)"

API Key Extraction

# Syncthing API key location in config.xml
# Linux: ~/.config/syncthing/config.xml
# macOS: ~/Library/Application Support/Syncthing/config.xml
# Windows: %LOCALAPPDATA%\Syncthing\config.xml
# Docker: /config/config.xml

# Extract API key from config file (requires filesystem access)
grep -oP '(?<=)[^<]+' ~/.config/syncthing/config.xml 2>/dev/null

# Test API key against REST API
API_KEY="your-syncthing-api-key"
SYNCTHING_URL="http://syncthing.example.com:8384"

# Get system configuration
curl -s "${SYNCTHING_URL}/rest/config" \
  -H "X-API-Key: ${API_KEY}" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
folders = d.get('folders',[])
devices = d.get('devices',[])
print(f'Sync folders: {len(folders)}')
for f in folders[:5]:
    print(f\"  {f.get('label',f.get('id','?'))} path={f.get('path','?')}\")
print(f'Devices: {len(devices)}')
" 2>/dev/null

Syncthing Security Hardening

Syncthing Security Hardening Checklist:

Bind GUI to localhost only — ensure the GUI address in config.xml is set to 127.0.0.1:8384, not 0.0.0.0:8384; if remote access is needed, use an SSH tunnel or VPN instead of exposing the Syncthing GUI directly on the network
Enable GUI authentication with a strong password — configure username and password in the GUI Settings → GUI section; the password is hashed with bcrypt in config.xml; without authentication any LAN user who reaches port 8384 has full control
Enable TLS for the GUI — check "Use HTTPS for GUI" in Settings to enable TLS for the admin interface; Syncthing generates a self-signed certificate by default, which should be replaced with a valid certificate for production use
Protect config.xml file permissions — the config.xml file contains the API key; ensure it is readable only by the syncthing service user; on Linux, verify permissions are 600 and owner is the syncthing user
Verify device IDs during pairing — carefully verify device IDs when accepting new sync peer connections; the security of the P2P sync depends on correct device ID verification to prevent syncing with an attacker-controlled device
Disable global discovery if not needed — if all Syncthing devices are on the same private network, disable global discovery in Settings → Connections to prevent device presence from being discoverable via the discovery server
Consider disabling relay connections — relay servers route encrypted traffic but can observe connection metadata; disable relaying in Settings → Connections if direct connections are always available, or run a private relay server

Security Test	Method	Risk
GUI on 0.0.0.0:8384 without authentication	GET http://{host}:8384/ — admin interface accessible to all LAN users; allows adding sync folders to any path and configuring sync to attacker-controlled devices	Critical
API key readable from config.xml	Read ~/.config/syncthing/config.xml — API key gives full programmatic access to folder configuration, device management, and file system path enumeration	High
REST API without auth header	GET /rest/system/status without X-API-Key — 200 response means API authentication is disabled, full API access without credentials	Critical
Global discovery device presence	Query discovery.syncthing.net with known device ID — confirms whether device is currently online, timing of activity, and connection endpoints	Medium
Relay server connection metadata	Traffic routed through relay.syncthing.net reveals device IDs, connection timing, and data volumes to relay operator — metadata exposure risk	Medium
Sync folder path traversal via API	POST /rest/config/folders with path set to sensitive directory (e.g., /etc, /home) — sync an attacker-controlled folder to receive copies of sensitive files	High

Automate Syncthing Security Testing

Ironimo tests Syncthing deployments for GUI bound to all interfaces (0.0.0.0:8384) without authentication exposing admin access to all LAN users, REST API accessible without API key header, API key extractable from config.xml filesystem access, device discovery presence via the global discovery server revealing online status, relay server connection metadata exposure through default relay configuration, and sync folder path configuration allowing sensitive filesystem paths to be added via the API for data exfiltration.

Start free scan

Table of Contents

Admin GUI Network Exposure

API Key Extraction

Syncthing Security Hardening

Automate Syncthing Security Testing