Syncthing File Synchronization Over Tor Hidden Services
Syncthing is an open-source file synchronization tool that synchronizes files directly between devices without a central server. By default, Syncthing uses global discovery servers and relay servers to find and connect peers, which exposes device IP addresses to Syncthing's infrastructure. For users who need to synchronize files between devices without revealing device locations or depending on third-party infrastructure, configuring Syncthing over Tor hidden services provides private, infrastructure-independent synchronization. This setup creates a .onion address for each Syncthing instance and configures peers to connect through Tor rather than through Syncthing's clearnet discovery infrastructure. The result is a truly decentralized sync system where neither device's IP address is revealed to the other and no third-party infrastructure is required.
Need this done for your project?
We implement, you ship. Async, documented, done in days.
Syncthing's default configuration uses Syncthing's global discovery servers (announce the device ID and current IP/port), Syncthing relay servers (relay traffic when direct connection fails), and Syncthing's STUN-based NAT traversal (reveals public IP to STUN servers). Each of these reveals the device's public IP address to third-party infrastructure. For threat models where IP address exposure is unacceptable (journalists syncing sensitive documents between field and office, activists syncing across jurisdictions, researchers handling sensitive data), this default behavior is problematic. Routing Syncthing over Tor eliminates IP exposure: each device's Syncthing instance becomes accessible only via its .onion address, and connections are established through Tor circuits that hide the originating IP from the peer.
Creating Hidden Services for Syncthing
Configure a Tor hidden service for each device's Syncthing instance. In /etc/tor/torrc: HiddenServiceDir /var/lib/tor/syncthing/ and HiddenServicePort 22000 127.0.0.1:22000 (Syncthing's default sync port). After starting Tor, the .onion address is in /var/lib/tor/syncthing/hostname. Repeat on each device that participates in the sync. Each device gets its own .onion address. Share .onion addresses between trusted devices through an out-of-band channel (encrypted message, in-person, Signal). Do the same for Syncthing's GUI if you need remote management: HiddenServicePort 8384 127.0.0.1:8384.
Configuring Syncthing to Use Tor
In Syncthing's configuration (GUI at http://localhost:8384 or edit config.xml): (1) Disable global discovery: Options -> Uncheck 'Enable Global Discovery', (2) Disable relay usage: Options -> Uncheck 'Enable Relaying', (3) Add SOCKS5 proxy: Advanced -> Global Options -> SOCKS5 proxy: socks5://127.0.0.1:9050, (4) Set listen address to TCP: tcp://127.0.0.1:22000 (listen only on loopback, not on public interface), (5) In device configuration for each peer, set their address to tcp://peeraddress.onion:22000 explicitly (not 'dynamic'). After these changes, Syncthing connects to each peer through the Tor SOCKS5 proxy using the peer's .onion address. No traffic leaves through the clearnet network.
Performance Considerations for Tor-Routed Sync
Tor adds latency and reduces throughput compared to direct connections. Syncthing over Tor is suitable for: document synchronization (office files, notes, code), photo libraries (accepts slower sync), configuration files (small, infrequent). Less suitable for: large media libraries where initial sync involves hundreds of gigabytes, real-time collaboration where sync latency affects workflow. Tor bandwidth for a single circuit is typically 1-10 Mbit/s sustained, depending on the relays selected. Initial sync of large datasets will be slow (100GB at 1 Mbit/s = approximately 22 hours). For large initial syncs, use a clearnet transfer for the initial bulk sync and switch to Tor-based sync for subsequent changes.
Multi-Device Setup and Key Management
For syncing across more than two devices, each device gets its own .onion address and Syncthing device ID. Share .onion addresses between all devices that need to sync with each other. Syncthing's device ID (SHA-256 of the device's TLS certificate) provides additional authentication - even if a peer presents the correct .onion address, Syncthing verifies the device ID before accepting the connection. To add a new device: install Syncthing, configure the Tor hidden service, share the .onion address and device ID with existing devices, and add the new device in each existing device's Syncthing GUI. The sync topology is configurable: star (one central device syncs with all others), mesh (all devices sync with all others), or selective (device A syncs with B but not C). Mesh topology provides resilience but requires sharing .onion addresses between all N devices.